WEBVTT

00:00.000 --> 00:02.000
I'm gonna be out of this.

00:02.000 --> 00:04.000
I'm gonna be out of this.

00:04.000 --> 00:06.000
I'm gonna be out of this.

00:06.000 --> 00:08.000
I'm gonna be out of this.

00:08.000 --> 00:09.000
Right.

00:09.000 --> 00:10.000
Here's Orica.

00:10.000 --> 00:14.000
We're gonna be talking about open source, DNS traffic analytics.

00:14.000 --> 00:15.000
All right.

00:15.000 --> 00:17.000
We're gonna be here on the ground.

00:17.000 --> 00:18.000
We're gonna be there.

00:18.000 --> 00:19.000
We'll be too loud.

00:19.000 --> 00:20.000
We'll be too loud.

00:20.000 --> 00:21.000
We'll be right.

00:21.000 --> 00:23.000
We're just out of the middle of the race.

00:23.000 --> 00:24.000
Oh wow.

00:24.000 --> 00:27.000
Sorry, I had to...

00:28.000 --> 00:30.000
Um, hi.

00:30.000 --> 00:34.000
The world outside for STEM is full of creeps.

00:34.000 --> 00:35.000
You know.

00:35.000 --> 00:37.000
Uh, and many of them on the...

00:37.000 --> 00:39.000
Oh, well, come on.

00:39.000 --> 00:40.000
Ah.

00:40.000 --> 00:42.000
Okay, let's...

00:42.000 --> 00:44.000
It's good to get to use this one.

00:44.000 --> 00:45.000
Yeah.

00:45.000 --> 00:46.000
We're about there.

00:46.000 --> 00:47.000
Um...

00:54.000 --> 00:55.000
What do you want?

00:56.000 --> 00:57.000
Yeah.

01:05.000 --> 01:06.000
Hi.

01:06.000 --> 01:07.000
Okay.

01:13.000 --> 01:15.000
So, do you hear me?

01:15.000 --> 01:16.000
Yes.

01:16.000 --> 01:17.000
Good.

01:17.000 --> 01:20.000
So, the world outside for STEM is full of creeps.

01:20.000 --> 01:22.000
And many of them on the internet,

01:22.000 --> 01:25.000
and some of them can be observing the DNS.

01:25.000 --> 01:28.000
And that's not really true.

01:28.000 --> 01:29.000
Okay.

01:29.000 --> 01:32.000
My view of humanity is much brighter than that.

01:32.000 --> 01:34.000
I believe if we were all that bad,

01:34.000 --> 01:37.000
we would probably have been on a long time ago.

01:37.000 --> 01:38.000
Still, there is...

01:38.000 --> 01:42.000
There are a lot of creeps in the DNS.

01:42.000 --> 01:43.000
Um...

01:43.000 --> 01:46.000
And when we talk about creeps in the DNS topic,

01:46.000 --> 01:50.000
project, we're not only talking about the usual suspects,

01:50.000 --> 01:51.000
but net, et cetera.

01:51.000 --> 01:55.000
We also talk about creeps like this.

01:59.000 --> 02:03.000
That move identifyable information into DNS.

02:03.000 --> 02:06.000
With the cook-a-law and other things,

02:06.000 --> 02:11.000
more and more, both good guys or evil guys,

02:11.000 --> 02:16.000
move this kind of information into DNS.

02:16.000 --> 02:18.000
So, this is also creep activity.

02:18.000 --> 02:23.000
This is from Swedish loading a Swedish newspapers site.

02:23.000 --> 02:24.000
Um...

02:24.000 --> 02:29.000
It looks a little bit like it could identify something.

02:29.000 --> 02:31.000
So, that's also creeps.

02:31.000 --> 02:33.000
My name is Elrika.

02:33.000 --> 02:34.000
Vincent.

02:34.000 --> 02:35.000
Vincent.

02:35.000 --> 02:38.000
Like my belgo friends on sisters would...

02:38.000 --> 02:39.000
My tab said,

02:39.000 --> 02:45.000
and I've been working with the DNS topic project for about two years.

02:46.000 --> 02:47.000
Um...

02:47.000 --> 02:48.000
With analytics.

02:48.000 --> 02:52.000
And I recently picked up coding again a couple of years ago.

02:52.000 --> 02:54.000
And that was a good decision.

02:54.000 --> 02:55.000
My life got better.

02:55.000 --> 02:57.000
That's your understanding.

02:57.000 --> 03:00.000
And in the topier project,

03:00.000 --> 03:03.000
I work together with these guys.

03:03.000 --> 03:10.000
And probably some of you would recognize some of these faces, at least.

03:10.000 --> 03:13.000
And I'm here with Mikael Kulbal in the corner,

03:13.000 --> 03:17.000
who's been working with the DNS a little bit longer than me.

03:17.000 --> 03:20.000
And we will answer any questions together.

03:20.000 --> 03:23.000
And also, this guy in the hat.

03:23.000 --> 03:27.000
Oh, I think some of you know him already.

03:27.000 --> 03:30.000
And if you haven't seen the other guys,

03:30.000 --> 03:37.000
you probably will bump into them if you keep going to DNS events like this.

03:37.000 --> 03:42.000
So, what's the next up here?

03:42.000 --> 03:47.000
The next tab is an analytics platform for DNS queries.

03:47.000 --> 03:49.000
And it's open source.

03:49.000 --> 03:52.000
It's open data, we aim for open data.

03:52.000 --> 03:56.000
And it's based on local decisions on the resolver.

03:56.000 --> 04:01.000
It's run on the recursive resolver.

04:01.000 --> 04:07.000
This is probably obvious for you, but still show it anyway.

04:07.000 --> 04:14.000
So we call it topier edge and topier edge

04:14.000 --> 04:17.000
since data up to topier core.

04:17.000 --> 04:21.000
But we do it in a different way than others.

04:21.000 --> 04:26.000
And I'm going to tell you what we do differently.

04:26.000 --> 04:29.000
And why this matters.

04:29.000 --> 04:33.000
Also, the topier platform,

04:34.000 --> 04:40.000
it collects the events and aggregates from several edges.

04:40.000 --> 04:43.000
So it's a collaborative platform.

04:43.000 --> 04:53.000
Where several operators can use the same feed to get results.

04:53.000 --> 05:02.000
But the main purpose of DNS copy is really to make DNS queries.

05:02.000 --> 05:07.000
DNS query data transparent and visible for others.

05:07.000 --> 05:09.000
And do it in such a way.

05:09.000 --> 05:16.000
So there's no risk to threaten your routing behavior or your activity in DNS.

05:16.000 --> 05:22.000
We need to work with addressing the challenge of DNS query data.

05:22.000 --> 05:26.000
No one really wants to touch this if they could choose.

05:26.000 --> 05:34.000
But we do, because we want to offer an alternative to other solutions.

05:34.000 --> 05:45.000
And doing it such a way that all of you can be safe with your routing.

05:45.000 --> 05:52.000
So to make a very simple and short overview,

05:52.000 --> 05:56.000
the topier edge reads DNS top information.

05:56.000 --> 06:00.000
Data and creates events and aggregates.

06:00.000 --> 06:08.000
No DNS queries lives the result where the unique queries.

06:08.000 --> 06:11.000
It's events and aggregates are.

06:11.000 --> 06:14.000
Which are analyzed in the topier core.

06:14.000 --> 06:19.000
And observations from topier core are sent back to.

06:19.000 --> 06:22.000
And published back to the edges.

06:22.000 --> 06:26.000
And also shared with the lay to public.

06:26.000 --> 06:30.000
So this part we haven't built yet, the public part.

06:30.000 --> 06:34.000
We're looking for funding for that one.

06:34.000 --> 06:37.000
So how does the data look like?

06:37.000 --> 06:41.000
I believe most of you know, I show you anyway.

06:41.000 --> 06:48.000
This is what happens when you go to normal media sites.

06:48.000 --> 06:51.000
It's for instance Brussels times.com.

06:51.000 --> 06:58.000
It can look like this.

06:58.000 --> 07:02.000
All these queries are sent.

07:02.000 --> 07:08.000
It's pretty pretty nice, not.

07:08.000 --> 07:13.000
So I was going to show one more thing here.

07:13.000 --> 07:19.000
Also check for stem.org, of course.

07:19.000 --> 07:22.000
It is a little too.

07:22.000 --> 07:25.000
And it's not that bad.

07:25.000 --> 07:29.000
First time only Google queries are sent.

07:29.000 --> 07:31.000
And that's quite impressive.

07:31.000 --> 07:37.000
I believe that Google has managed to, for almost every site in the western world,

07:37.000 --> 07:40.000
getting a call.

07:41.000 --> 07:45.000
That's quite impressive and pretty scary.

07:45.000 --> 07:50.000
So in case you don't already have a tool like this,

07:50.000 --> 07:54.000
and if you're curious about some website,

07:54.000 --> 07:58.000
you could try this one in our repo.

07:58.000 --> 08:00.000
It's a neat little tool.

08:00.000 --> 08:04.000
So why do we want to even look at this data?

08:04.000 --> 08:09.000
What can we see?

08:09.000 --> 08:13.000
Well, the reason we look at it,

08:13.000 --> 08:21.000
or we want to look at it is to find indications of bad or malicious activity.

08:21.000 --> 08:26.000
And also find indications of the ugly ones,

08:26.000 --> 08:30.000
but I call the ugly ones the ones who leak private data in the internet.

08:30.000 --> 08:35.000
It's getting more and more common.

08:36.000 --> 08:42.000
This one is the data is toxic, so it's difficult.

08:42.000 --> 08:48.000
Here are some examples of the main.

08:48.000 --> 08:55.000
Could be malicious domains, and it's from an old data.

08:55.000 --> 09:01.000
So, well, looking at this data is a bad idea.

09:01.000 --> 09:06.000
I think you agree on that, and I still get the question every time.

09:06.000 --> 09:09.000
I meet someone who's really interesting in our project,

09:09.000 --> 09:12.000
like, why are you doing this?

09:12.000 --> 09:17.000
It's not good.

09:17.000 --> 09:24.000
But we have to, because a lot of activity is moving there,

09:24.000 --> 09:27.000
and it's kind of unseen.

09:27.000 --> 09:37.000
The solutions that are installed in some places are not as keen on preserving the privacy,

09:37.000 --> 09:39.000
as we are, I would say.

09:39.000 --> 09:46.000
So common solutions, if I understand it right from my timing in this domain,

09:46.000 --> 09:53.000
is that a lot of solutions for analytics on the queries work like this.

09:53.000 --> 09:58.000
However, it's all where the query streams go up to cloud,

09:58.000 --> 10:03.000
where a minimization is done, or save the minimization,

10:03.000 --> 10:08.000
which is such a difficult word to say, so it should just remove it.

10:08.000 --> 10:11.000
It doesn't work anyway.

10:11.000 --> 10:18.000
So, I hope this is the last time you see that word.

10:18.000 --> 10:24.000
And then the solution will make a decision, blocking decision,

10:24.000 --> 10:26.000
and that's not always bad.

10:26.000 --> 10:30.000
Sometimes you want to also say, it's not always that bad,

10:30.000 --> 10:34.000
but the transparency and insight into what has been done is very,

10:34.000 --> 10:36.000
can be very difficult.

10:36.000 --> 10:40.000
The toxic data is not longer only here.

10:40.000 --> 10:46.000
It's also in the cloud, and it becomes a target.

10:46.000 --> 10:54.000
So, there's some bad things with the solution,

10:54.000 --> 10:59.000
and that's why we want to do a different approach.

10:59.000 --> 11:03.000
Where we do minimization and anonymization at the source,

11:03.000 --> 11:04.000
at the resolver.

11:04.000 --> 11:06.000
We don't create another target.

11:06.000 --> 11:10.000
We publish events and aggregates only,

11:10.000 --> 11:18.000
no query data, which don't make tapioid doesn't make any decisions

11:18.000 --> 11:22.000
of about what's good or bad to means.

11:22.000 --> 11:28.000
We just make observations of how different the means behave.

11:34.000 --> 11:36.000
So, this is part of the difference,

11:36.000 --> 11:40.000
it's different from other solutions,

11:40.000 --> 11:44.000
it's that other are often driven by commercial interest.

11:44.000 --> 11:48.000
Nothing bad with that, I've been a business person myself,

11:48.000 --> 11:54.000
but it makes priorities tough sometimes.

11:54.000 --> 11:58.000
You need the profit to keep going.

11:58.000 --> 12:04.000
And also when you're funded only by governmental institutions,

12:04.000 --> 12:09.000
we all know that the priorities can change

12:09.000 --> 12:12.000
with the politics of the day.

12:12.000 --> 12:14.000
We see that every day.

12:14.000 --> 12:22.000
And then the data is saved in silos,

12:22.000 --> 12:26.000
because that's where the business value is.

12:26.000 --> 12:30.000
So, they don't want to share it.

12:30.000 --> 12:37.000
And tapioid, we are not an nonprofit organization.

12:37.000 --> 12:39.000
We will run for a long time,

12:39.000 --> 12:43.000
financed by different kinds of organizations.

12:43.000 --> 12:44.000
We want the balance.

12:44.000 --> 12:46.000
We want to make them happy.

12:46.000 --> 12:49.000
Not too happy, neither of them,

12:49.000 --> 12:53.000
but enough happy to keep funding us.

12:53.000 --> 12:55.000
And it's a collaboration.

12:55.000 --> 12:59.000
We want to share the data, so it's a big difference.

12:59.000 --> 13:09.000
So, the main thing is that data you don't have can't be lost.

13:09.000 --> 13:15.000
As soon as you have it, you must assume that you will be hacked or leaked.

13:15.000 --> 13:17.000
That I try to do that.

13:17.000 --> 13:22.000
So, the main thing is that data you don't have can't be lost.

13:22.000 --> 13:28.000
As soon as you have it, you must assume that you will be hacked or leaked.

13:28.000 --> 13:32.000
That I try to learn my kids that too.

13:32.000 --> 13:35.000
Your data, as soon as it will be leaked anyway.

13:35.000 --> 13:43.000
So, we can do a lot of things without storing data.

13:43.000 --> 13:46.000
We can observe the crowd, and that's what tapioid is about.

13:46.000 --> 13:51.000
We don't want to observe individuals.

13:51.000 --> 13:56.000
I want to mention one of the components,

13:56.000 --> 13:59.000
that there are many several components,

13:59.000 --> 14:02.000
and we want to go through the architecture today,

14:02.000 --> 14:06.000
but I hope it's you're interested in knowing more details,

14:06.000 --> 14:08.000
just with our task.

14:08.000 --> 14:11.000
But because you can have presentations and demos of the details,

14:11.000 --> 14:13.000
this is an overview.

14:13.000 --> 14:16.000
But I want to mention this component,

14:16.000 --> 14:20.000
policy processor, which is one that resolves at the edge.

14:20.000 --> 14:26.000
It could possibly be run as a standalone component as well.

14:26.000 --> 14:33.000
And it's the component that sets the policy.

14:33.000 --> 14:36.000
So, there is a human in the loop,

14:36.000 --> 14:40.000
who defines the policy, we will see that in a minute.

14:40.000 --> 14:44.000
How it can look like, but also integrates other sources,

14:44.000 --> 14:46.000
such as list.

14:46.000 --> 14:50.000
And then process them and outputs an RPC,

14:50.000 --> 14:56.000
that manages what the means are as soon.

14:56.000 --> 15:02.000
And another component I want to mention in this overview,

15:02.000 --> 15:06.000
is the local analytics and in, we're also looking for funding for that.

15:06.000 --> 15:08.000
We haven't developed it yet.

15:08.000 --> 15:12.000
Currently, we are discarding a lot of the means,

15:12.000 --> 15:15.000
because they are just too sensitive to unique.

15:15.000 --> 15:18.000
And with the local analyze,

15:18.000 --> 15:25.000
we will be able to look at this unique domains,

15:25.000 --> 15:28.000
categorize them, tag them,

15:28.000 --> 15:33.000
and without needing to send anything unique up to core,

15:33.000 --> 15:35.000
or publish anything unique.

15:35.000 --> 15:40.000
And we can also use it to train a bird model

15:40.000 --> 15:45.000
to be even quicker.

15:45.000 --> 15:50.000
And I said on AI word,

15:50.000 --> 15:53.000
the marketing will be happy.

15:53.000 --> 15:56.000
So, but the same thing here,

15:56.000 --> 15:59.000
if you're interested in how this work,

15:59.000 --> 16:01.000
please reach out to us,

16:01.000 --> 16:08.000
and you'll get more information.

16:08.000 --> 16:11.000
So, but the point is,

16:11.000 --> 16:14.000
identifiable browsing behavior, never ever list.

16:14.000 --> 16:17.000
So, I'm going to show you,

16:17.000 --> 16:20.000
very short demo,

16:20.000 --> 16:22.000
it's not really a demo.

16:22.000 --> 16:24.000
It's screenshots from a demo,

16:24.000 --> 16:26.000
because the recording,

16:26.000 --> 16:29.000
we had a bit too slow to show here.

16:29.000 --> 16:32.000
But I will show you some screenshots.

16:32.000 --> 16:35.000
This is the policy config,

16:35.000 --> 16:37.000
in the NSTAPI.

16:37.000 --> 16:44.000
This is actually part of the tapi celli,

16:44.000 --> 16:49.000
where you can define certain policies.

16:49.000 --> 16:51.000
And we're going to look at this policy,

16:51.000 --> 16:54.000
which is a number of tapi tags,

16:54.000 --> 16:56.000
number of tapi observations.

16:56.000 --> 16:58.000
This result will accept

16:58.000 --> 17:03.000
that tapi has published two observations.

17:04.000 --> 17:05.000
But over that,

17:05.000 --> 17:07.000
the response will be in NX domain.

17:07.000 --> 17:09.000
I'm probably in real life,

17:09.000 --> 17:12.000
the policy will look different

17:12.000 --> 17:14.000
from a real operator,

17:14.000 --> 17:16.000
but this is for demo.

17:16.000 --> 17:20.000
So, we set a website,

17:20.000 --> 17:23.000
an email website,

17:23.000 --> 17:27.000
from the computer that runs this resolver.

17:27.000 --> 17:29.000
And what happens,

17:29.000 --> 17:32.000
we can see in the tool,

17:32.000 --> 17:33.000
in the client,

17:33.000 --> 17:36.000
we can see that papyr has published

17:36.000 --> 17:37.000
an observation.

17:37.000 --> 17:38.000
And this little flag,

17:38.000 --> 17:41.000
six means that there is two observation.

17:41.000 --> 17:45.000
It's a new domain and low rank.

17:45.000 --> 17:50.000
Very intuitive.

17:50.000 --> 17:55.000
It's, you can get an explanation of that.

17:55.000 --> 17:57.000
So,

17:58.000 --> 17:59.000
and here,

17:59.000 --> 18:01.000
we can,

18:01.000 --> 18:03.000
yeah, we go to another resolver

18:03.000 --> 18:05.000
and dig the same domain.

18:05.000 --> 18:08.000
And we get the response.

18:08.000 --> 18:12.000
And then going back to first resolver,

18:12.000 --> 18:15.000
we can see that

18:15.000 --> 18:18.000
the observations have changed.

18:18.000 --> 18:21.000
So, this means actually three observations.

18:21.000 --> 18:24.000
The third one is that it's what we call

18:24.000 --> 18:25.000
multi-new.

18:25.000 --> 18:28.000
The domain has been seen for the first time

18:28.000 --> 18:30.000
in multiple developers,

18:30.000 --> 18:32.000
multiple edges.

18:32.000 --> 18:34.000
And what happens,

18:34.000 --> 18:36.000
on my first days,

18:36.000 --> 18:38.000
where I look at the same domain,

18:38.000 --> 18:40.000
I can no longer see it.

18:40.000 --> 18:41.000
It's,

18:41.000 --> 18:42.000
it's,

18:42.000 --> 18:43.000
and the next domain,

18:43.000 --> 18:46.000
we can see it will be here.

18:46.000 --> 18:47.000
So,

18:47.000 --> 18:49.000
that's,

18:49.000 --> 18:51.000
what, that's the papyr loop,

18:51.000 --> 18:52.000
really.

18:52.000 --> 18:55.000
And make a policy definition

18:55.000 --> 18:59.000
and then listening to observations

18:59.000 --> 19:02.000
and possibly together with other sources,

19:02.000 --> 19:05.000
we can make decisions,

19:05.000 --> 19:07.000
what to response.

19:07.000 --> 19:10.000
No data or an extermination.

19:10.000 --> 19:11.000
So,

19:11.000 --> 19:13.000
if you would like to,

19:13.000 --> 19:16.000
to go home and try,

19:16.000 --> 19:18.000
can you just do that?

19:18.000 --> 19:20.000
We have the report open,

19:20.000 --> 19:22.000
if you want to install and try,

19:22.000 --> 19:23.000
tap here.

19:23.000 --> 19:24.000
Currently,

19:24.000 --> 19:27.000
you need to reach out to us.

19:27.000 --> 19:28.000
Email is a good way.

19:28.000 --> 19:30.000
LinkedIn is a good way.

19:30.000 --> 19:32.000
You will find me,

19:32.000 --> 19:37.000
my contact details are just reach out to us.

19:37.000 --> 19:39.000
You need some keys,

19:39.000 --> 19:41.000
and some a little bit of hand holding

19:41.000 --> 19:44.000
to get it up and running.

19:44.000 --> 19:46.000
And that's,

19:46.000 --> 19:49.000
a report.

19:49.000 --> 19:51.000
Another thing we're doing,

19:51.000 --> 19:56.000
is to start to build a tap here community.

19:56.000 --> 19:59.000
We do have a community chat,

19:59.000 --> 20:02.000
so you're very much welcome to just join,

20:02.000 --> 20:04.000
and listen in if you're interested.

20:04.000 --> 20:05.000
In this,

20:05.000 --> 20:07.000
or want to know more,

20:07.000 --> 20:08.000
and then you can, of course,

20:08.000 --> 20:10.000
leave the chat if it's too,

20:10.000 --> 20:12.000
intimacy.

20:12.000 --> 20:15.000
And if you happen to be in Stockholm,

20:15.000 --> 20:17.000
we have a regular of the works,

20:17.000 --> 20:18.000
for welcome,

20:18.000 --> 20:21.000
and we might even adjust the date just for you.

20:21.000 --> 20:23.000
If you show up,

20:23.000 --> 20:26.000
and we're going to have,

20:26.000 --> 20:28.000
some analytics labs too,

20:28.000 --> 20:31.000
so if you're into analytics,

20:31.000 --> 20:34.000
there will be chances to contribute online,

20:34.000 --> 20:38.000
and experiment with the date.

20:38.000 --> 20:40.000
Yeah,

20:40.000 --> 20:43.000
that's about it.

20:43.000 --> 20:45.000
Quick overview over this,

20:46.000 --> 20:49.000
this important project.

20:49.000 --> 20:50.000
Thank you.

20:50.000 --> 20:51.000
Thank you.

20:51.000 --> 20:52.000
Thank you.

20:52.000 --> 20:54.000
Thank you.

20:54.000 --> 20:57.000
Thank you.

20:57.000 --> 21:00.000
Any questions or comments?

21:00.000 --> 21:01.000
Yeah.

21:01.000 --> 21:02.000
Where to start?

21:02.000 --> 21:05.000
I didn't really adopt this,

21:05.000 --> 21:06.000
you know,

21:06.000 --> 21:07.000
top here,

21:07.000 --> 21:08.000
an active report,

21:08.000 --> 21:11.000
or does it just use data from in this tap,

21:11.000 --> 21:12.000
and works for that?

21:12.000 --> 21:14.000
It used data from the DNS tap.

21:14.000 --> 21:18.000
So you currently run an on-bound,

21:18.000 --> 21:21.000
and so it's not a resolar,

21:21.000 --> 21:24.000
but you install it next to the resolar.

21:24.000 --> 21:25.000
Well,

21:25.000 --> 21:28.000
we are currently working in the media service provider.

21:28.000 --> 21:30.000
Your voice is not being recorded right now,

21:30.000 --> 21:31.000
right?

21:31.000 --> 21:32.000
Yeah.

21:32.000 --> 21:35.000
We are currently working with the mayor's service providers,

21:35.000 --> 21:36.000
and it's within,

21:36.000 --> 21:39.000
and it's all the edge within,

21:39.000 --> 21:41.000
just for testing.

21:41.000 --> 21:45.000
So we're not running the resolar itself.

21:45.000 --> 21:46.000
Exactly.

21:46.000 --> 21:47.000
Yes?

21:47.000 --> 21:50.000
So what members of the community are looking for?

21:50.000 --> 21:52.000
A primarily ask please,

21:52.000 --> 21:55.000
or I will just be in some smaller,

21:55.000 --> 21:57.000
like home,

21:57.000 --> 21:59.000
home environments,

21:59.000 --> 22:00.000
or...

22:00.000 --> 22:01.000
Yeah.

22:01.000 --> 22:02.000
So the question was,

22:02.000 --> 22:05.000
what kind of community we're looking for,

22:05.000 --> 22:06.000
and I will say,

22:06.000 --> 22:07.000
both,

22:07.000 --> 22:09.000
we have some small,

22:10.000 --> 22:12.000
small operators,

22:12.000 --> 22:15.000
but those who are small

22:15.000 --> 22:18.000
needs to be aware of certain things,

22:18.000 --> 22:21.000
you'll be able to accept certain things,

22:21.000 --> 22:23.000
because the big ones are,

22:23.000 --> 22:25.000
that's the data we're looking for.

22:25.000 --> 22:28.000
But if you want to just test and try it out,

22:28.000 --> 22:29.000
be chat with us,

22:29.000 --> 22:32.000
and also we're looking for analysts,

22:32.000 --> 22:35.000
who want to play around with the data

22:35.000 --> 22:37.000
in one way or another.

22:38.000 --> 22:39.000
That's...

22:39.000 --> 22:40.000
And...

22:40.000 --> 22:41.000
Yeah.

22:41.000 --> 22:42.000
Yeah.

22:42.000 --> 22:43.000
Your home user,

22:43.000 --> 22:47.000
with a very small amount of devices connected,

22:47.000 --> 22:49.000
the risk is really high,

22:49.000 --> 22:51.000
that even though we are anonymized

22:51.000 --> 22:53.000
and we tried to filter out,

22:53.000 --> 22:55.000
we will be able to see you.

22:55.000 --> 22:57.000
So we're looking to create

22:57.000 --> 22:59.000
some sort of aggregation solution

22:59.000 --> 23:01.000
between us and home users,

23:01.000 --> 23:03.000
because we want to see all the queries,

23:03.000 --> 23:06.000
but we also see that there's a high risk

23:06.000 --> 23:08.000
issue that we have to solve,

23:08.000 --> 23:10.000
and we haven't focused on that right now.

23:10.000 --> 23:12.000
If you want to help,

23:12.000 --> 23:14.000
please help us.

23:14.000 --> 23:15.000
Yeah.

23:15.000 --> 23:16.000
So basically,

23:16.000 --> 23:18.000
we begin the modules of the better,

23:18.000 --> 23:20.000
and...

23:20.000 --> 23:21.000
what's the...

23:21.000 --> 23:23.000
what's the treasure of my hand that uses,

23:23.000 --> 23:25.000
okay, hundred plus.

23:25.000 --> 23:26.000
Maybe me,

23:26.000 --> 23:27.000
can you answer,

23:27.000 --> 23:30.000
how many users would be,

23:30.000 --> 23:31.000
okay,

23:31.000 --> 23:33.000
why the treasure showed.

23:33.000 --> 23:35.000
So we have a high cut-off

23:35.000 --> 23:37.000
about 20 in terms of

23:37.000 --> 23:39.000
when we're using

23:39.000 --> 23:41.000
get to maintain

23:41.000 --> 23:43.000
just half of the amount.

23:43.000 --> 23:45.000
And that seems to work out,

23:45.000 --> 23:48.000
but I'd say a hundred is,

23:48.000 --> 23:49.000
okay,

23:49.000 --> 23:51.000
but we're going to be one of a hundred,

23:51.000 --> 23:52.000
right?

23:52.000 --> 23:53.000
We're going to be able

23:53.000 --> 23:55.000
to be identified as one of a hundred.

23:55.000 --> 23:56.000
Yeah.

23:56.000 --> 23:57.000
So the question was,

23:57.000 --> 23:59.000
how many clients you need to be

23:59.000 --> 24:01.000
to be drawn in the crowd?

24:01.000 --> 24:02.000
Yeah.

24:02.000 --> 24:04.000
And we have a treasure,

24:04.000 --> 24:06.000
and we need to be around 20,

24:06.000 --> 24:09.000
but that means

24:09.000 --> 24:11.000
that you will be one of 20,

24:11.000 --> 24:13.000
or in case of a hundred clients,

24:13.000 --> 24:15.000
you will be one of a hundred.

24:15.000 --> 24:18.000
So when we work with the large amounts,

24:18.000 --> 24:20.000
the larger providers,

24:20.000 --> 24:23.000
then it's strongly in the crowd.

24:23.000 --> 24:24.000
But yeah.

24:24.000 --> 24:26.000
We have a few testers,

24:26.000 --> 24:27.000
actually,

24:27.000 --> 24:29.000
but I don't want to kind of

24:29.000 --> 24:31.000
homoperate this.

24:31.000 --> 24:33.000
I just did it.

24:33.000 --> 24:34.000
Yes?

24:34.000 --> 24:35.000
Yeah.

24:35.000 --> 24:37.000
So let's say,

24:37.000 --> 24:39.000
items,

24:39.000 --> 24:41.000
ones by the answer,

24:41.000 --> 24:42.000
to be a lot.

24:42.000 --> 24:45.000
It's not a way for me to tell

24:45.000 --> 24:47.000
that my result for it's using

24:47.000 --> 24:48.000
and stuffy.

24:48.000 --> 24:49.000
Yes.

24:49.000 --> 24:50.000
Yes.

24:50.000 --> 24:52.000
So,

24:52.000 --> 24:53.000
aha.

24:53.000 --> 24:54.000
Okay.

24:54.000 --> 24:55.000
That was a good question.

24:55.000 --> 24:57.000
Please don't wait for me,

24:57.000 --> 24:59.000
as an individual,

24:59.000 --> 25:02.000
to know if the DNS is running

25:02.000 --> 25:05.000
tapir edge.

25:05.000 --> 25:07.000
And yeah, what?

25:07.000 --> 25:08.000
No.

25:08.000 --> 25:09.000
No.

25:09.000 --> 25:10.000
No.

25:10.000 --> 25:11.000
No.

25:13.000 --> 25:16.000
Actually, we've got that question,

25:16.000 --> 25:17.000
and the seminar,

25:17.000 --> 25:19.000
we had in Sweden,

25:19.000 --> 25:22.000
that can I work in my DNS

25:22.000 --> 25:24.000
that I don't want to be loved by it?

25:24.000 --> 25:25.000
And we said,

25:25.000 --> 25:26.000
yes,

25:26.000 --> 25:28.000
we would like to see you then

25:28.000 --> 25:30.000
and see what you're doing.

25:30.000 --> 25:32.000
But we won't look at you.

25:32.000 --> 25:34.000
We will look at you.

25:34.000 --> 25:35.000
Don't roll.

25:35.000 --> 25:37.000
But that's an interesting thing.

25:37.000 --> 25:39.000
We'll take it with us.

25:39.000 --> 25:41.000
There are functions,

25:41.000 --> 25:44.000
you know, doing a lot of operations.

25:44.000 --> 25:46.000
So,

25:46.000 --> 25:48.000
we are there.

25:48.000 --> 25:50.000
You don't have a mechanism,

25:51.000 --> 25:54.000
so we're dragging things to be not done.

25:54.000 --> 25:55.000
Okay.

25:55.000 --> 25:56.000
Okay.

25:56.000 --> 25:58.000
Good question.

25:58.000 --> 25:59.000
Yeah?

25:59.000 --> 26:00.000
Yes?

26:00.000 --> 26:01.000
Right.

26:01.000 --> 26:03.000
Do you have some public rest of the

26:03.000 --> 26:05.000
you could do other things?

26:05.000 --> 26:06.000
You have excluded,

26:06.000 --> 26:07.000
because they are,

26:07.000 --> 26:08.000
you know,

26:08.000 --> 26:09.000
checking,

26:09.000 --> 26:11.000
checking dialysis.

26:11.000 --> 26:12.000
Yeah.

26:12.000 --> 26:13.000
Which is what?

26:13.000 --> 26:14.000
There is some analysis,

26:14.000 --> 26:16.000
but looks like random something.

26:16.000 --> 26:17.000
Yeah.

26:17.000 --> 26:18.000
Yeah.

26:18.000 --> 26:20.000
They are used for,

26:20.000 --> 26:22.000
they could be used for tracking.

26:22.000 --> 26:24.000
We don't know if they are,

26:24.000 --> 26:26.000
but what tapidas will,

26:26.000 --> 26:27.000
it will,

26:27.000 --> 26:29.000
observe these domains.

26:29.000 --> 26:30.000
And in this case,

26:30.000 --> 26:32.000
when there are so unique,

26:32.000 --> 26:34.000
there will be a category,

26:34.000 --> 26:36.000
a tag on this.

26:36.000 --> 26:38.000
So, this tag dot dot

26:38.000 --> 26:39.000
domain dot,

26:39.000 --> 26:41.000
example dot com,

26:41.000 --> 26:44.000
could possibly be a privacy issue.

26:44.000 --> 26:46.000
And we will make an observation,

26:46.000 --> 26:47.000
publish an observation.

26:48.000 --> 26:50.000
And then the resolver operator decides

26:50.000 --> 26:52.000
what to do with the observation.

26:52.000 --> 26:53.000
Okay.

26:53.000 --> 26:54.000
So these domains

26:54.000 --> 26:57.000
could be,

26:57.000 --> 26:59.000
for privacy,

26:59.000 --> 27:01.000
extraction of private data.

27:01.000 --> 27:03.000
What should I do with them?

27:03.000 --> 27:04.000
Should I just ignore?

27:04.000 --> 27:06.000
Or should I do something or correlate

27:06.000 --> 27:09.000
with some other sources and confirm

27:09.000 --> 27:10.000
validate?

27:10.000 --> 27:11.000
Okay.

27:11.000 --> 27:12.000
This is,

27:12.000 --> 27:13.000
but okay.

27:13.000 --> 27:14.000
I will filter them.

27:14.000 --> 27:16.000
But that's up to the operator.

27:17.000 --> 27:18.000
I think that.

27:18.000 --> 27:21.000
We all know what's going on there.

27:21.000 --> 27:23.000
It's a chicken and egg problem for us.

27:23.000 --> 27:25.000
We haven't got the data yet.

27:25.000 --> 27:28.000
We know there's a lot of stuff hiding in there.

27:28.000 --> 27:30.000
As soon as we're up and running,

27:30.000 --> 27:33.000
we will not make a lot of noise

27:33.000 --> 27:36.000
about how cooked this had moved.

27:36.000 --> 27:39.000
What we can do to start with discussion

27:39.000 --> 27:41.000
what we can do to prevent and highlight this.

27:41.000 --> 27:42.000
But right now,

27:42.000 --> 27:44.000
we haven't got the data,

27:44.000 --> 27:45.000
but more than,

27:46.000 --> 27:47.000
so please follow us

27:47.000 --> 27:49.000
and help us with this stuff.

27:49.000 --> 27:50.000
Yes.

27:50.000 --> 27:51.000
I see one more question,

27:51.000 --> 27:52.000
but I have to cut this off.

27:52.000 --> 27:54.000
So please find Orica or...

27:54.000 --> 27:55.000
Yes.

27:55.000 --> 27:56.000
Thank you.

27:56.000 --> 27:57.000
Thank you.

27:57.000 --> 27:58.000
Thank you.