How often do you read some news headline about free speech denied and human rights being suppressed
and think, that sucks, but there's nothing I can do about it from my distant place?
I guess you could vote slightly differently in your next election, and maybe, just maybe,
it'll have a small impact in four years' time. Well, if you're a technologist or developer,
you have way more power than you realize. Still, the challenge is, could you use your skills to
make a difference? Maybe you could remove a layer of surveillance or add a layer of anonymity to
the affected people? If the answer is yes, and it probably is, actually, then the question becomes,
what would you do, and even should you act? This week on Talk Python to Me, you'll meet Pete Fine,
who spent two years of his life helping others using his technical skills. His story is both
inspiring and amazing. This is Talk Python to Me, episode 61, recorded May 12, 2016.
Welcome to Talk Python to Me, a weekly podcast on Python, the language, the libraries, the ecosystem,
and the personalities. This is your host, Michael Kennedy. Follow me on Twitter, where I'm at,
mkennedy. Keep up with the show and listen to past episodes at talkpython.fm, and follow the show on
Twitter via at Talk Python. This episode is brought to you by Hired and SnapCI. Thank them for supporting
the show on Twitter via at Hired underscore HQ and at Snap underscore CI. Hey, everyone. I have a few
things to share with you before we talk with Pete. First, one of the listeners suggested that I put all the
episode transcripts on GitHub, and I thought, why didn't I think of that? So now you can find all
the transcripts at github.com/mikeckennedy slash talk dash python dash transcripts. And of course,
now that there are over 50 hours of interview text online, the question is, what will people do with
it? Well, almost immediately, Anthony Shaw from Sydney sprinkled some data science dust on them and
answered the burning question of peak Talk Python awesomeness. That's not which show was most awesome,
but rather, which show did I say, oh, that's awesome, the most on? You can check out his GitHub
gist and a cool graph actually showing this over time. I'll put a link in the show notes.
Now, let's talk with Pete.
Pete, welcome to the show.
Hi, thank you.
We have some really interesting stuff to talk about today. And to be honest, I'm really thrilled
to talk to you about it because you've really done some amazing work and you've helped a lot of
people. And I'm excited to dig into it.
Me too. Thank you.
Yeah, yeah.
So before we get into all the work that you've been doing, though, let's just start at the beginning.
Just tell me how you got into Python, how you got into programming. What's your story?
Yeah, I've been programming since I was probably about 16. I think I took a class in high school,
between Pascal and C++ maybe. And then a bit at the university. Maybe about 15 years ago,
somebody who's become a very close friend introduced me to Python at a job I was working at,
modeling interest rate derivatives or something, which is a long time in my past. But once I found
Python, which is probably like 2002, I just kind of never looked back. 95% of the code I've probably
written since then has been Python.
Just Python. So once you kind of got into it, you're just like, oh, wait, I found my place. This is it.
Yeah, exactly. It's just like, why would I use anything else? And I can see, I see using other
languages and I, you know, do a little bit in other things sometimes. But, you know, I've heard that
Python is the second best language for everything. In the real world, you're kind of trying to do more
than one thing. You're, you know, bringing together a web front end and a database or like a mobile app
in a search engine or whatever. When you have to start doing more than one thing, you know, or three
things or four things that having something that's the second best at all of those makes getting that
total thing you're trying to build much easier. And so, yeah, I've just always kind of stuck using
Python and I've been really happy, happy with it.
Yeah, you know, it's, you can almost pip install everything, right? You know, like, I need to do that
thing. Let me try pip install, pi that thing. Oh, look, it worked.
Exactly. The library is great. The ecosystem is great. The community is great. I've gone to PyCon
since, I don't know, 2007 or 8, whatever the last year, the second year in Dallas was. And when it was like
700 people and I want to be part of that community to kind of evolve as a language and, you know, set of
folks.
Yeah, it's cool to watch it grow, right? And this year it's in Portland and I think they have a pretty
big location. I don't know what the capacity is, but it's been sold out for a while. And sadly, people send
me messages and say, Michael, can you help me get, get a ticket? I'm like, I really don't have any
leverage. I'm sorry. I wish I could get you a ticket.
One of the things that I, I mean, like about the Python community in particular is, is the kind of
spirit of, of, of copying and, and doing things yourselves. I mean, there's like, I mean, I can't
even think probably a dozen regional conferences. Absolutely. I recently moved to Pittsburgh.
Ohio, Ohio, Texas. Yeah. Yeah. I lived in Chicago for many years and never made it to
high Ohio, but I moved to Pittsburgh recently. And I'm just like, I'm like, Oh, this is like
close, close by. And so I'm excited. I'm excited to go. I'm excited to go to Portland too, but
it's cool that like other, you know, languages, other open source things like they don't do that.
They don't kind of spawn these sort of local.
Yeah. They just have the one conference or something like that. Right. Absolutely. Yeah.
So speaking of PyCon, I think that's a good way to segue into how I got to know you. And I
watched an amazing, inspiring talk that you gave at PyCon 2015. And I'll be sure to link to that in
the show notes. It's on YouTube and it was entitled free software, free people. So give us the background
on what you were doing at that time. And maybe we can talk later about what you're doing sort of these
days.
My talk at PyCon last year was called free software, free people. And what's about my time is what's
called a hacktivist or an internet activist from probably about late 2010 through 2014.
Doing everything from organizing protests to helping people circumvent censorship and surveillance all around
the world, most often in the Middle East for the Arab Spring.
That is super inspiring. That's awesome. Long ago, when I thought about technology, I thought about how it's going to
open up the doors and make everything great. But there's sort of a there's two sides of technology. In a lot of places,
technology is used to stifle people, ideas, and so on. Right. And especially the dictators of the Middle East during the Arab
spring, for example.
Yeah. For as a technical person as I have a really sort of complicated and sort of I try to be deliberate
about how I use it. And that that ethic was certainly up on play when I was doing this work in the Middle East.
Yeah. I mean, so I worked with a group called telecomics, which was basically like an IRC network,
which is sort of people probably almost certainly familiar with Slack these days as a group chat, but Slack is modeled after
a much older chat network called IRC, which actually predates the web, goes back to 1994, and has a long history of being
source of communication support and activist communities. It was some of the first source of news out of
Moscow after the counter coup after the Soviet Union fell, also during Bosnia and Sarajevo. I learned all this stuff later. Like I was just hanging out on free
node with all the other source people for a couple years and then stumbled upon this group of what have become called
hacktivists called telecomics, who ran their own set own network, their own set of servers, mainly located in Sweden, Germany, and was a group of about 200 to 300 humans and machines.
That were sort of an active part of this IRC community. And we did everything from like kind of advocacy work, which I mean, like working to change, change and influence policy to technical hacking, like network scanning and helping people use and install tools like Tor and, you know, configure SSL to stuff I like to call media hacking, which was basically getting the
getting the mainstream press to pay attention to things that we thought, thought were important.
Censorship or surveillance or some kind of the policy, policy positions.
Well, to a lot of people, like they hear stuff about encryption or, you know, it's after the whole Snowden thing, it's way higher on people's mind. But before then, it was just like, you know what, that's like some technical mumbo jumbo.
I don't care about this stuff.
Yeah, it's technical mumbo jumbo.
But so that's a really actually important role to make people that actually have influence on politics, pay attention and they get it right. Sometimes they get it wrong. Right. We can look at a lot of examples where they get it wrong.
Yeah. The stuff we're able to do using using encryption to help people exercise free speech rights in places like Syria and Egypt, where if they got caught, they got, you know, thrown in jails and nobody heard from them and they got beat up.
Using those same kind of technologies, I think, that our politicians want to, you know, have access to is really scary. Like, because the countries that these people are in had that kind of access.
And we saw what they did with it, right?
Yeah, exactly. Exactly. And just that's a, it's not a tool like a gun. It's a tool that tells you where to point your guns. And like that can sometimes be almost more effective means to control.
Right. Or who needs to disappear tomorrow or some other terrible thing like that. Yeah.
Yeah. Yeah. And so, you know, I mean, I'm not like a cryptographer. I'm not like even really a big security or network dude. And so like there were those kind of people around telecomics, along with people who were not really technical at all. People who were artists, people who were journalists, people who were just, you know, gardeners. And, you know, like.
They just wanted to help out however they could, right?
They just want to help out. Exactly.
And so kind of putting the, you know, so like putting those skills together, we were able to just help out people.
I mean, really just people came, came to us and asked for, for help saying like, I can't get on Twitter.
Like these terrible things are happening. They're going around my neighborhood and beating people up.
Like I have some pictures and like, I can't get on Twitter. Can you put them on Twitter?
And so we're like, we have to tell the world about this.
Yeah, exactly. And just, it's, it sounds in Egypt, some of exactly actually what we did is just, you know, people found us and just, you know, they couldn't access their Twitter accounts.
And we spoke for them. We use our Twitter account to act almost like a proxy, you know, like we were human proxies the same way there were network proxies.
Yeah. Yeah.
Yeah.
A little bit of sneaker net almost to cross the air gap or whatever.
Yeah. Yeah. There were, there totally were sneaker nets in Syria. Oh my gosh. Yeah. The Syrians like had total, had lots of, some sort of crazy sneaker nets out going on. I don't want to, I didn't really know, know that much about, but you know, also.
We worked with guys a long time in Syria, like nine, 12 months, you know, and this is like in 2011 and 2012 before things got really terrible there. Like people don't need internet in Syria now. Like that's just not, I mean, it's, it's such a minor part of what it is. But, you know, back then it was like some people were getting beat up. Some people were getting shot at, you know, protests were getting shot at a little bit, but it was, it was, you know, the censorship and surveillance was much more of a problem.
And it wasn't nearly as violent.
Sure. Well, back then, just looking from the outside, it feels like there was still a public case to me be made about whether it's bad or not or how bad it is. And now everybody knows that it's bad and they just don't know what to do about it. But it's not like the fact it's bad needs to be told. Like everybody knows it's bad and we don't really know what to do about it, I guess.
Yeah. I mean, I don't, I mean, I didn't know what to do about it then either. I mean, like, I just, I didn't have any great,
political insight to what, what was going on and what should be going on in these guys. It's not my country.
People asked for help. Like, this is the thing, you know, like we have this internet and people came and we found each other, you know, in the secret back tunnels.
And I was in a position to help and that's what I did.
That's awesome.
Yeah. And sometimes, well, I mean, I guess, I don't know. Sometimes people ask for things and we're like, no, that's like not the kind of thing we want to help you with. And like, we, you know, ignored them till they went away.
Yeah. I guess you've got to, it has to match your mission, right? You can't just be doing whatever out there.
We just telecomics just did communication support. Like we did censorship and surveillance, you know, it was free. Basically, you know, free speech is kind of the driving scene of somebody, you know, people come by and they're like, Hey, can you help us make bombs? We're like, no, we can't go away.
It's not that complicated. You know, there's nobody. I'm like, I don't know how to be bothered. What are you guys doing here? Like, just like go, go find some other IRC network and bother them. Like, it's just, yeah. And so you must've gotten the reputation about that's where people to go get help from the outside or whatever. Right. And so they show up.
We had, you know, and that was just rare. I mean, it's just like, but mainly it was people asking for help.
Ah, wanted VPNs, wanted help setting up tour proxies, help publish anything. You know, I mean, you had some long-term anonymity is complicated and hands-on work. You can't just like give somebody tour and be like, have a nice day.
Like there's a lot of ways that, you know, if you have say some photos or some PDFs or whatever, somebody gave you tour and you went on and set up a Twitter account instead of an email account.
Like there's a lot of ways you can still give away who you are. It's really, it's like, it's really kind of like the one thing I kind of, I mean, just, it's, it's such a human and machines.
You know, it was, you know, like, like working together, make these things possible.
Like that's when I said, like, you know, there's like 300 humans and bots, like there's websites, there's servers.
Like the main server I found out was like a, at, like at the end of all this was a 686 or something.
It's like some old, like 16, like, like maybe like six, I don't even remember.
It was an ancient, ancient machine that was running the IRC network.
It's just, it doesn't take.
It's 16 bit.
What are you talking about?
Yeah, I just, I don't know.
It was ancient, it was something like ancient 32 bit Linux install that, you know, happened to be located at an ISP data center in Sweden.
Because those are some of the people that were like in this, this network of, of folks.
Yeah.
Somebody's like, Hey, I got a server.
Yeah, sure.
Somebody's like, sure.
I have an old server.
Like there was no money involved.
There was no mailing address.
There's no like board of directors.
Like literally it's just a bunch of people like bootstrapped an IRC network and started hanging out on it and like put up some websites and found some friends.
Yeah.
And so the appeal for me for finding that coming from working in open source communities, I was like, Oh, I get how this works.
Like I get this, how this works.
Like you want to build a project, like you just go find some people and you go do it.
And like the things that succeed, you know, like you can't, can't get any of these, whether it's like an open source project or like helping people evade censorship.
Like it takes a lot of hands, but you can't like the things that succeed or not, it's not merely just good ideas or good technology, but like there's people involved here too.
Like that's the one thing like in three years or so of doing this like full time.
And then some, I didn't have a job.
Like I had a couple of periods where I worked like, you know, 16 hours a day for like three or four weeks on end.
And like the one lesson I take away from this is just how important the people are in this.
Like, like your users, your collaborators, like just people had great ideas.
And like, I had great ideas.
I'm like, I couldn't find anybody to help me like, so those things didn't get done.
And so like I went and helped somebody else and that's just crucial.
Yeah.
I think it's easy to confuse our use and need of privacy with others.
Right.
So for example, if I want to go to Starbucks and I'd want to feel a little bit better about using the public Wi-Fi, I might fire up a VPN to go do something.
But that's not the same as like the consequence of me getting that wrong is pretty low.
Exactly.
Yeah.
Versus if I'm in somewhere where there's actual turmoil.
Yeah.
Turmoil or just police state or surveillance state or like a government that is listening, you know, to what you do on those open networks and how often they go send, you know, guys with guns and nightsticks around to your house.
If you do it wrong.
Yeah.
That's definitely a higher consequence.
Yeah.
So tell us some stories.
Sure.
There's a couple of things that you talked about in your talk that were really interesting.
One involving modems and another involving like filtering, monitoring.
Sure.
Hardware.
So I stumbled across telecomics in January of 2011, maybe about a week before the Egyptian revolution kind of got publicly rolling.
So people may remember the Jan 25 hashtag.
So I kind of stumbled on telecomics about Jan 20.
You know, so at that point, Twitter was blocked in Egypt.
We knew there was kind of various degrees of surveillance, but like things were still largely operable.
And so this, this was this period where we get people who would find our IRC network and come on and like share stories and photos with us about what was, what's happening.
And we would retweet them using our like collective telecomics Twitter account.
It's kind of acting like human proxies.
And some of those people would stick around and we would help them set up technical proxies like Tor kind of VPNs or even just basic HTTP proxies.
I got involved working on a ham radio project.
So we didn't see, foresee that the, you know, entire internet was going to go down, like, which happened basically on January 28th that the Egyptian government like turned off 95% of the routes into the country.
So we didn't see that.
I'm not going to say we foresaw that, but like just, we were throwing like a lot of, a lot of things against the wall and some of them stuck and some of them didn't.
And somebody threw out the idea of a ham radio.
So amateur, amateur, like long wave or short wave radio.
If they're going to turn off the internet, let's just go old school on them, right?
Yeah.
And so I don't, I'm not a ham.
Some of these guys, guys were, but like I had an interest just in amateur radio and pirate radio and like from a media theory and like communications history perspective.
And so I was like, okay, well, I'm new here.
Like, let me try work, like helping out with this.
And so I ran around the internet and tried to find people to help.
Like I Googled up ham forums and we tweeted about it.
And I don't try to remember what else.
Oh, I ran around, I found like other IRC networks.
Like there was like a amateur radio channel on Freenode and like Fnet and like kind of just different.
I just kind of like dug around for a couple of days and like bugged people to come help.
And like, you know, it went from five people to 130 in like three days or something like that.
Yeah.
Well, and part of it was, is just like spectacle of it.
If just, this is like, Hey, this is this cool thing we're doing.
Like if we're just like, you know, like that people are like, Oh my gosh,
they're going to use amateur radio to save Egypt.
That's so cool.
Like here, we'll write a little blog about them or write a press story about them.
Like there was value in that as well.
I mean, like it was legitimately helpful, but like, you know, that aspect in just getting like,
Hey, like, come on, get some more people.
Come help.
Like, you know, it just, right.
So like, it turned out not, not to be, not to be actually the most best way of kind of maintaining
contact in, in Egypt.
There were only probably about 130 licensed radio operators in Egypt.
They were mostly the ex-military, like that just technology just kind of wasn't, wasn't available.
This episode is brought to you by hired hired is a two-sided curated marketplace that connects
the world's knowledge workers to the best opportunities.
Each offer you receive has salary and equity presented right up front, and you can view
the offers to accept or reject them before you even talk to the company.
Typically candidates receive five or more offers within the first week, and there are no obligations
ever.
Sounds awesome.
Doesn't it?
Well, did I mention the signing bonus?
Everyone who accepts a job from hired gets a thousand dollars signing bonus.
And as Talk Python listeners, it gets way sweeter.
Use the link hired.com slash Talk Python To Me and hired will double the signing bonus to $2,000.
Opportunity's knocking.
Visit hired.com slash Talk Python To Me and answer the call.
Yeah, a whole bunch of like cool other stuff spun out of it.
People working on all sorts of different projects.
We sent a lot of fax spam.
These were cool.
So like, you know, both before.
So basically, they cut off the fiber.
And so, you know, there's no cell.
There's no internet.
There's no text messaging.
The only thing they left out that was working was landline phones, which in Egypt isn't like
actually a lot of the rest of the world are like core infrastructure for everything for
the military to keeping power plants running and just like, yeah, like copper line phones,
like just turning that off like actually breaks totally everything.
So yeah, we did things like Googled up the numbers of fax machines at like hospitals and universities and like coffee and copy shops, put a list, list of these things together and put together a PDF in English and Arabic, like explaining who we were, and that we were here to help.
And, you know, instructions for like, you know, like, you know, like, you know, like, you know,
getting, you know, getting shot with tear gas and, and put this PDF out there with a list and basically got volunteers to go through on free international faxing services and like upload the thing and click accept, you know, and send it, send it to all of these places.
Yeah.
I mean, just kind of using whatever, whatever technology we had had at hand, those things worked well.
We ran, oh, about 500 dial-up modem lines.
So again, the only thing working was, I mean, this was crazy to me.
So this is like 2011.
Half of Egypt was on dial-up modems.
Like it was about, yeah, about a quarter, a quarter was on like wired ethernet.
About a quarter was wifi.
About half was on dial-up modems.
The other strange thing was that the local ISPs didn't peer with each other.
So there were like three or four ISPs in, in Egypt and they didn't actually exchange packets in Egypt.
They sent their packets like up to, to like Cyprus or whatever, like where the, the, there was a data center where they're, you know, the fiber cable and they crossed.
And then they came back to Egypt and went to the other ISP.
So when they turned off the like two or three pieces of fiber, the ISPs were isolated from each other within Egypt because they didn't exchange, exchange traffic.
Right.
So it wasn't just getting out to the world.
It was even communicating within the country still.
Internal communications.
Right.
And like, we have this idea that the internet is like this redundant thing and it's kind of like, you know, right.
It was designed to survive nuclear strikes or whatever.
And like, you go start poking around the networks of some of, some of the other places in the world.
And you just go like, what the heck is this?
This is just like both built from components and routers and stuff that we just would go like, where'd they get this eBay?
And yes.
And the answer is yes.
They bought an eBay, like just random, whatever random old stuff they can afford and get to get their hands on.
That is also architected with just kind of totally different, really like political objectives built into the network, like built into the infrastructure of the network, that these networks are built, built centralized so they can be monitored and surveilled and censored and turned off, like and turned on.
Yeah.
A political network topology.
Yeah.
And that's just such a different approach and attitude than we think the internet should be built.
And in some places, more or less is.
Wow.
That's pretty wild.
So speaking of, you know, controlling stuff and looking at it, there's some really interesting stuff that came out with some network surveillance hardware.
Yeah.
From a company.
Was that in the U.S., that company?
Yeah.
So in Syria, we started working in Syria in the summer of 2011, maybe about three months in July, maybe about three months after the protests started.
And the first thing we started doing was NMAPing the networks.
So basically, like NMAP is a network scanner.
So basically, like it pings all the ports and all the, you know, you give it some list of IP address, range of IP addresses, and it pings all the ports.
And it, like, tries to fingerprint what's there and tells you, like, oh, hey, here's a web server.
Here's a printer.
Here's an FTP server.
Here's another printer.
Here's a webcam.
Like, you know, and so basically, you can go get what IP blocks are assigned to Syria.
Like, that's kind of just public information from the registries.
Yeah.
And so we scanned the whole country over the course of, like, I think it was about six weeks.
It's like maybe about.
Wow.
So you built, like, a network map of all of Syria, basically.
Yeah.
With kind of, like, follow-on probing.
Like, so you go, NMAP is a kind of, like, pretty coarse tool.
So this is maybe, like, a dozen people over the course of about four or six weeks with, mainly with NMAP and some other kind of tools and kind of some manual probing.
And that's, like, now there's tools out there now that you could do this, like, by yourself from a single machine in EC2 in, like, three days.
Wow.
Like, the tooling is five years later and the tooling has just gotten, like, sure, you can scan, like, that much space, like, so much more efficiently just because the software's gotten better.
Yeah.
And the cloud and the network speeds and all that, right?
Yeah.
I mean, these guys had, like, data center class network speeds, but just the software, like, there's things called ZMAP and MassScan now that do the same thing that NMAP does.
But, like, same hardware.
It's just the software.
Like, it's just way better to do this, which is crazy to me.
But we found a whole bunch of interesting things, a whole lot of cable modems.
Cable modems with the default password.
Admin username and password, password.
One of the things the guys did was change the DNS settings on these cable modems.
This was done with curl scripts, actually.
I didn't write this.
I don't write any curl, but, like, these guys did it with curl scripts.
So they changed the DNS settings so that when people in Syria would go, on their cable modems, would go to Google.com or Facebook or whatever, they would get sent instead to a network of 19 web servers that the telecomics guys put up that had a page in Arabic and English that said,
your connection is being monitored.
You're under surveillance.
Here are some tools, like, to help and an explanation.
And so, yeah, and, like, they flipped this on and, like, took, like, I don't know, 40 or 60% of the web traffic in Syria for the, you know, two days or whatever they had this thing going.
Yeah, and it's just, this was the kind of stuff we could do.
Like, this was the kind of stuff we could do because we didn't have anybody, money.
Like, who do you, who do you, it's just kind of right at the border of legal and not a lot and, like, legitimate.
Like, and, like, we were able to kind of skirt that border because we didn't, we didn't do certain other things like take money.
Gone are the days of tweaking your server, merging your code, and just hoping it works in your production environment.
With SnapCI's cloud-based, hosted, continuous delivery tool, you simply do a get push and they auto-detect and run all the necessary tests through their multi-stage pipelines.
Something fails, you can even debug it directly in the browser.
With a one-click deployment that you can do from your desk or from 30,000 feet in the air, Snap offers flexibility and ease of mind.
Imagine all the time you'll save.
Thanks, SnapCI for sponsoring this episode by trying them for free at snap.ci slash talkpython.
And so when I talked about earlier about sort of being very technical, like, like, this was really deliberate.
Like, there's a lot of thought and a lot of discussion about how to do this safely.
Should we do this at all?
Like, from a technical level, from an ethical level that I feel like, you know, characterizes, yeah, some of the, some of the, you know, I feel like there's, there's reasons I talked about it at the PyCon community.
Like, that, that there has been an interest in broader kind of social issues and political issues in the Python community and the PyCon talks for a long time.
And I, I entirely admit that I probably pushed that further than, than anybody else.
And I'm grateful for that, that opportunity.
And people seem to appreciate it.
But I feel like that the Python community is far more thoughtful about those sort of issues than any other technical community I've participated in.
I think there's a down-to-earth-ness of those, those folks.
It's awesome.
Do you want to tell the story about the, the network monitoring stuff with BlueCode?
Sure.
One of the other things we found, while poking around inside the Syrian networks were a dozen unsecured FTP servers that were basically like the file storage engine on these network traffic monitoring and shaping devices called, by a company, made a manufacturer by a company called BlueCode.
She was based in California.
And so you can think of these, so these things could, like ran at the speed of the fiber.
So these, these were actually Windows machines, but they had like a custom ASIC, like a custom chip in hardware to process some like 200 different kinds of traffic.
So HTTP traffics, Skype traffic, Windows file sharing traffic, like you name it, like, and sort of analyze what was happening.
And then either both control the bandwidth.
So in their marketing docs, they talked about like, don't just outright block YouTube and Facebook games because then your employees, because they're made for mainly corporate use.
Right.
These are like enterprise devices to keep people.
And they're right.
These are totally like enterprise firewall, firewall grade stuff.
And so you don't outright block YouTube because then your employees get pissed, but you just like really degrade the bandwidth.
And so they get, you know, or same thing with games, like, you don't make them, you just make them like really painful to play.
So they just get frustrated and go back to work.
Whereas if you outright block it, like they get upset.
And so, I mean, this is kind of, you know, this is in the corporate environment, but I think it's kind of gives you a sense of the sort of censorship of which these things are capable.
Put these in the hands of a dictator and turn the knobs differently, right?
Exactly.
And so we found about a dozen of these machines with their log files just sitting on open, unpassworded FTP server.
And so these were basically like web logs for like all of the web traffic for Syria for like a week.
A week was like 64 gigs raw of web.
And so it basically has the source IP, has the URL they're trying to visit, cookies, accept or deny whether the proxy like blocked it or let the traffic through, things like that.
For like the whole country, like the whole country.
We found these things.
And, you know, in digging through them, we found things like the words like Israel or proxy were blocked.
Specific page, Facebook pages that were specific to Syrian like activists and like justice groups were blocked.
There's a whole lot of porn that was actually allowed through.
And so we have this idea of the media.
No, I mean, we have this idea of this Mideast as sort of very sort of uniformly conservative and censored.
It's not like that at all.
And like sort of what's accessible on the Syrian Internet is really different than what's accessible on the Saudi Arabian Internet or on the Iranian Internet or on the Turkish Internet.
Both in terms of local political issues, you know, specific to that country, like more regional issues, as well as like sex and violence and, you know, all the other kind of crazy things that are on the Internet.
Yeah.
And so Syria had had a long reputation being actually quite liberal for porn.
But, you know, there were a whole bunch of kind of political stuff that was specifically blocked.
Yeah.
It was more about protecting the government.
They didn't really care what you did or something like this.
Yeah.
I just don't agree.
Right.
And so it's like I said, it's different in different countries.
Yeah.
And so these eventually got leaked that some of the other telecomics agents had like done some analysis on these things and just like splashed them out on the Internet.
And so I wrote a story for Slashdot.
I have been a proud reader of Slashdot since probably like 1997.
You know, back when I started like playing around with Linux in college.
And so I thought this was cool.
And so I wrote a post for Slashdot.
And so this is the kind of like media hacking that we did.
And this got picked up by, I don't even remember, the Washington Post, eventually the Wall Street Journal.
And so like I wrote this story for Slashdot and said like, hey, look, here's this like digital evidence that these companies hardware was being used by the Syrian government to censor and survey the net.
Like there's export controls on Syria.
Like there was an embargo.
You can't sell anything, anything to the Syrian government.
Right.
Absolutely.
Somehow these devices that were built and built in California have wound up their way in Syria.
Like what has happened?
And so the company like first denies to Slashdot that there's like any evidence that this is their equipment at all.
And we're like, it says like right in the header of the log, like it's well-known format, like blue code.
And here's like the device ID.
You know, we sent.
Here's its serial number.
Yeah.
Like we sent, like we sent, we had the telecomics agents, like the Syrians send traffic.
Like out to servers we controlled.
And like we could basically see like how, what the headers get injected, you know, like by, by the log, the box itself.
Like we had like, you know, from these IP addresses, you know, like we'd see this, the, the, all the traffic series being force routed through, through these proxies.
And this is, and so they're denying this is this, it gets picked up by the, the Washington post.
And then maybe about two week and a half later, I'm at a human rights conference and I get a call from a reporter at the wall street journal.
And she says, I've been on the phone with blue coat for the last week, alternately yelling at them and begging them to stop lying to me.
Do you have anything you would like to add?
I was like, sure, sure.
And so it kind of explained much, much of it explained to, to you, like kind of what these things were and we found them and what, what they're capable of.
So, you know, blue coat advertised itself as being capable of distinguishing between updates to your Facebook wall and Farmville.
It's a pretty fine, like, this is not just like, oh, it's HTTP traffic to this host name.
Right.
It's, it's looking inside the packets in some ways and things like this.
Yeah, exactly.
And the stream inside the stream of packets and doing contextual analysis.
And so what we also found out was that these machines were phoning home to the company headquarters, not only for like monitoring services.
So like they had a built in heartbeat monitor, but also for collaborative filtering.
So like when they saw some traffic that the local proxy couldn't classify, it would send it off to the, the, the headquarters run some like other algorithms on it and give us rules back in like, like 300 milliseconds.
It's like pretty low, low latency.
Yeah.
But so the kicker of this is, is that blue coat, had they been paying attention to their internal logs, would have clearly seen these boxes where it's Syria.
And so, right.
Like, because they're getting traffic, like to their internal services coming from these, these machines.
And so they just have this incentive not to look because they're the export controls saying no economic activity.
And so, you know, if it's known that they block things from these countries, like there's less resale market, there's less black market, like they're providing this service.
They're not supposed to be doing that.
And so like, they just don't even want to look.
They just don't even want to know, you know, where, where these things are.
Well, it's kind of like, gosh, what the Italian group was, was that hacking team?
Hacking team.
Yeah.
When it comes unglued, it's a serious PR nightmare, right?
Like this can't be good for them.
Right.
So.
And so this was right.
Exactly.
And so there's eventually this, this story in, in the front page of the Wall Street Journal and the company admits, yes, this is our stuff.
And like, we're so we should have known.
And like the machines were actually destined for the government of Iraq.
I don't know why that's better for them to use for, for, for, this is 20, 2011.
I don't know what for them to use for censorship.
Okay.
Whatever.
Some of the, the other telecomics agents worked in Brussels in the headquarters of the European Union.
They were like legislative age in the European parliament.
And they lobbied to have the EU pass technology export controls for Syria so that, you know, this couldn't, this stuff couldn't get right.
You know, like you mentioned, hacking team and Italian companies.
So that this kind of equipment couldn't be sold by EU members to, to Syria.
December of, of that year, they passed that.
And that was the first time the EU has ever passed this kind of technology export controls.
That's awesome that you guys made that kind of difference, right?
Yeah.
And so like, yeah, I mean, and so there's kind of this like loose chain of maybe like 50 people from, you know, over the course of six months, like that nobody really like intended to do this.
We all did wrong and like sort of picked up the parts we were found interesting.
Like the folks in Brussels, like they're not, they don't run NMAPs, you know, like, like they lobby legislatures to great effect.
And it's, you know, we're able to change international law, this kind of like sketchy group of hackers with no money.
This ragtag group of folks that just organized an IRC, right?
That's awesome.
So the U.S.
Like it's like a year and a half later in like 2014, finally levied some fines on the reseller.
There was some company and some dudes in Dubai who supposedly bought these for Bluecoat and, you know, illicitly shipped them on.
And these dudes paid like a fine.
And the company like gets, gets a pass.
Yeah, but the PR still has to sting, right?
So it's not a full pass.
Yeah, yeah.
They got sold.
They got bought by some like private equity fund.
And like, you know, it's been, they, they, people have found their stuff like all over the world now.
And it's, it's really been helpful to raise attention of this kind of before this all before Snowden, all, all this stuff before Snowden.
Right.
So do you think this is a good example of the type of ways that what the U.S. government's trying to pull gets out of control and has like unintended consequences?
Like, oh, we just need a backdoor for us.
Oh, yeah.
There is no such thing as a backdoor just for us.
There's no, there's no such thing as a backdoor just for us.
But we'll keep the key really safe.
The FBI mandated that Google build them a backdoor in like 2010.
It's called Project Aurora.
And the Chinese hacked it and used it to go after their own people.
Google has better security engineers than the FBI does.
Oh, my gosh.
Like, yeah, there's no, and you know, and they still get, get hacked by the Chinese.
Like these things are not, there's no backdoor just for you.
There's no backdoor just for you.
One thing to build a safe wall, it's another thing to build a safe door, right?
These are like different levels of hard, I guess.
Yeah.
It's like, you know, it's so funny.
It's so funny.
Like, I went to a hardware store.
My mother was visiting actually, and she wanted to buy, I had just bought a house, which is an experience for me.
But we went to the hardware store, and she wanted me to buy a new lock for my door.
I was like, okay, that seems like a reasonable thing.
I bought a new house.
Like, I don't know who has keys to the old, old house.
I bought a new lock.
Yeah, I did that when I got a house.
Yeah, sure.
And so we go, and we talk to salesmen.
He's like, okay, well, this is, you know, really like the good lock that we recommend.
And I was like, oh, I picked that.
I was at Hope.
It's like a hacker convention in New York, and they have a little lockpicking station.
I was like, and I mean, I've done this maybe three or four times.
I was like, oh, yeah, I picked that lock.
I was like, all right, cool.
But I mean, I bought it anyway, right?
Like, I mean, it's just, you know, it's different levels of security.
But just, you know, like, it's the door to my house.
It's not a door to, like, everybody's private information.
Like, what does that mean?
Like, your medical information, your financial information, the letters you wrote to your spouse.
Yeah, well, the thing is, you...
It's just everything.
Yeah, yeah.
We have these sort of concepts that we map up into the digital world, I think, as at least
you're speaking and trying to speak for the non-technical politician types and law enforcement
and so on.
And you think, I can get access to your lock on your door.
So why can't I just have a lock on this other thing?
But the problem is, if you hack that, you hack everybody in the world.
You don't break into one house.
You don't break into every house in the world when you break into it, right?
Yeah.
It's crazy.
The NSA had a dual mandate.
They had a mandate for both cyber surveillance and cybersecurity.
And they have entirely neglected the latter, you know?
I mean, they have hired...
I mean, I've sat in classes with dudes, you know, like Python, high-level, you know, advanced
Python pun trainings with guys who worked for contractors in Maryland and weren't allowed
to tell the rest of us what they did.
Yeah.
And, you know, by hiring those guys and putting them on offense, like, they have both starved
the market in terms of, like, knowledgeable people, but also, like, they had a mandate
to play defense.
All these problems and these bugs, they're finding, like, they should be closing them.
They should have been fixing those.
They should have been...
Instead, they want to rule the world.
Instead, they want access to everything.
And as a result, now everybody has access to everything.
I totally agree with you that that is a serious problem.
And I think the U.S. and Western Europe, but especially the U.S., has more to lose than they
have to gain by being able to access stuff.
So if the U.S. can break into other people's things and those people break into the U.S.'s
things, like, there's more IP and technical stuff that we have to lose than we're ever going
to gain from getting other places, I think.
Yeah.
I don't think it really makes sense, but, you know.
I think these are people who grew up the political children of the people who, you know, came up with
mad.
I don't know how old you are.
Remember, like, mutually assured destruction?
Like, these...
Yeah.
Like, these...
I think that whoever came up with what passes for cyber surveillance and security policy,
like, I think, I think, like, that stuff didn't make any sense either.
Yeah.
Like, like, wait, so we're all going to die?
That's better.
And I feel like, like, I feel like that this is somehow, like, that these people are, like,
the digital version, like, children of that.
Yeah.
That craziness.
Like...
You're giving me, like, flashbacks.
It makes me really sad, you know?
As, like, somebody who loves the internet and loves what we do with the internet, like,
it makes me so sad that people just treat it as something to be ravaged and pillaged and,
like, controlled.
You know, like, I feel like one of the lessons from telecomics is, like, that we can use this
technology to, like, like, get together and make cool stuff and do beautiful things and,
like, like, actually make a difference in the physical world and in the lives of people like
ourselves and each other and the people who need help, like, that just in a way that is
very rewarding.
I mean, it's just, it's very, it's very direct to have been able to put these skills
that I've cultivated for such a long time, like, in direct service of what, what I believe
when, you know, like, I felt just kind of so politically impotent or just, like, disconnected.
Like, I just didn't care.
Like, I just didn't, like, pay attention to what happened in, in mainstream politics and,
like, just to be able to do stuff.
I mean, that's the same ethic that's drawn me to, to working on open source.
It's just that, like, we can go out and actually build stuff and things get better.
Like, that's such a different, it's so rare we get to have that experience.
It's a very different life view, right?
Like, just to think that that can be a thing, right?
Like, your view of the world is so different if that is your view of the world, right?
Yeah, exactly.
Exactly.
And, like, just that's, you know, at the end of the day, like, I just, I don't, I don't do
this activism stuff anymore.
Like, it just kind of, like, it took over my life.
I just, like, it took all my money.
It, like, did bad things for relationships and my health.
And, like, it's just doing this, like, as a full-time and then some job, you know, like,
that much, it's just not sustainable.
Right.
And I feel okay about that.
I feel like I had, like, this, this, like, like, the world and my, my, my, you know, the
world's needs and my interests and abilities kind of, like, aligned and then they sort of
passed on.
And, like, I'm grateful for that.
That's awesome.
That have had that opportunity.
It sounds a little like people go into the Peace Corps to, like, take a few years and, like,
dedicate themselves to something.
This is kind of a, sounds a little like an unofficial version of that in the technical world.
A little bit, maybe.
Something like that.
You know, I look back on, on that and just how the Middle East, you know, what has happened
there since.
It just, yeah, I mean, I don't think anybody saw what was, this was going to look like.
And if I did, like, I mean, it just, you know, like I said, people just ask, ask for help.
And, like, when I think about the lasting impact, like, I still get, like, emails from people
who, like, see, like, documentaries I was in or, like, find all new articles.
And they're like, oh, teach me to be the greatest hacker in the world.
I'm going to break into everything.
I'm like, I'm not that kind of hacker.
And, you know, I also get, like, more.
I just connect people, man.
Leave me alone.
This is not me.
Yeah, exactly.
I do.
That's all I do.
To people who are more, have more kind of interest and skills kind of more, more aligned with my
own, and my own methods.
And just to have, inspire people to do cool stuff.
Like, you don't have to let it take over your life.
And you don't have to, like, do things that are big and dramatic.
Like I said, I moved to Pittsburgh pretty recently.
And I'm involved in starting a pedestrian activism group here.
Yeah.
So why don't, we're getting near the end of the show.
Maybe just take a moment or two and tell people, like, what you're up to these days.
Yeah, sure.
So I moved to Pittsburgh and I'm starting this pedestrian activism group, which is, like,
way less earth-shaking and daunting and kind of more close to my heart.
But, like, I set them up a website.
I set them up a Twitter.
I helped them set them up.
Email at, you know, ourdomain.org.
And just, this is just, you know, like, to help facilitate things, what would otherwise
be a Facebook group.
Just kind of, like, most of the people I'm listening, you'd probably go set up a domain and set up
email routing.
To be able to go out and do that for some, like, local neighborhood.
We're not, like, a non-profit.
We're just, like, there's, like, four of us and we meet once a month or every other month
and we take a walk.
Just to be able to go do that basic technical work is so helpful.
That's awesome.
Yeah.
Yeah, that's really cool.
It sounds like you find people and charities that are trying to make a difference and you
give them a bigger lever.
Yeah.
Than they would otherwise have, right?
Yeah.
And I just, you know, I'm totally, I'll totally admit it.
Like, I lever the things that I care about and I think I can be useful about.
You can't lever everything, but that doesn't mean you shouldn't do something.
And there's a real difference between, like, being that lever and doing that work and, like,
donating is not a substitute for that.
Donating is good and, like, organizations like the EFF do, like, really good work and they
need, and the Tor Project, like, need money for that.
But, like, I just personally feel like that we have an individual responsibility to actually
do things as well.
Yeah, that's awesome.
And you've definitely lived up to that.
Thanks.
Some of the stuff you've done.
So that's very cool.
Thank you.
Very cool.
All right, Pete.
I normally ask people two questions on the way out the door, but, so I'll go ahead and
throw them out your way.
Sure.
Sure, that's great.
They seem a little anticlimactic compared to the awesome stuff we've covered.
So you must have a unique view into the Python world, and there's over 80,000 packages on
PyPI now.
So what one do you know?
I know it's incredible.
It's like 300 a day or every few days.
Not updates, but new, right?
Yeah.
So are there ones that maybe you think are not well-known that you should tell people?
Like, what's awesome?
Working as a freelance developer, I will straight up say Django pays my bills, and I'm really
grateful for that.
stuff that is fun for me these days is PySpark.
Okay.
Yeah.
Some big data stuff.
Very cool.
Yeah.
Which is, you know, that's, that's my background is that, but you know, when you, when you work
as a freelancer, you build a lot of websites and I get to do some of the other, the other
big data stuff as well.
But yeah.
Yeah.
Awesome.
And then if, when you edit your code, your Python code, what editor do you use?
I have two.
I use a wing IDE.
Okay.
Yeah.
And have been for a number of years.
It's kind of a little such character, but has some of the best kind of code.
navigation and completion specifically for Python.
Yeah.
I've heard that about it.
Yeah.
It's just, it's just awesome.
And in the shell, Nano.
I like Nano a lot.
Really.
I actually like Nano too.
Yeah.
People laugh at, people laugh at me.
They're like, you must use Emacs.
You must use, yeah.
And I'm like, no, I like Nano.
Cause like, I just want to get stuff done.
And I just, when editing things in the shell, it's just because I, it's small and I just need
to be quick and get it done and get it fixed with.
And I don't want to have to think about how to quit my editor.
I wanted to say right at the bottom, here's how you quit.
Like, yeah.
So, Nano.
Okay, cool.
Well, you know, thank you so much for taking the time to share these stories.
Hopefully it's inspired people to do some stuff because it's very cool what you did.
And it sounds like you made a real difference.
Thank you so much.
It means a lot.
You bet.
Yeah.
See you later.
All right.
Take care.
This has been another episode of Talk Python to Me.
Today's guest was Pete Fine.
And this episode has been sponsored by Hired and SnapCI.
Thank you both for supporting the show.
Hired wants to help you find your next big thing.
Visit Hired.com slash Talk Python to Me to get five or more offers with salary and equity
presented right up front and a special listener signing bonus of $2,000.
SnapCI is modern, continuous integration and delivery.
Build, test, and deploy your code directly from GitHub.
All in your browser with debugging, Docker, and parallels included.
Try them for free at snap.ci slash Talk Python.
Are you or a colleague trying to learn Python?
Have you tried books and videos that left you bored by just covering topics point by point?
Well, check out my online course, Python Jumpstart by Building 10 Apps at
talkpython.fm/course to experience a more engaging way to learn Python.
You can find the links from today's show at
talkpython.fm/episodes slash show slash 61.
Be sure to subscribe to the show.
Open your favorite podcatcher and search for Python.
We should be right at the top.
You can also find the iTunes feed at /itunes,
Google Play feed at /play,
and direct RSS feed at /rss on talkpython.fm.
Our theme music is Developers, Developers, Developers by Corey Smith, who goes by Smix.
You can hear the entire song at talkpython.fm/music.
This is your host, Michael Kennedy.
Thanks so much for listening.
I really appreciate it.
Smix, let's get out of here.
Staying with my voice.
There's no norm that I can fill within.
Haven't been sleeping.
I've been using lots of rest.
I'll pass the mic back to who rocked it best.
Developers, Developers, Developers, Developers, Developers, Developers, Developers, Developers,