Dan Jenkins

The Journey to YouFibre

danjenkins — Sun, 09 Feb 2025 21:04:02 GMT

TLDR: I've just had YouFibre 8000 installed, it's great! There were many chapters to the story to get to the conclusion but I'm there now, and all is good... mostly. But it is a long tale... hence the TLDR.

I've recently had FTTP broadband from YouFibre installed but boy, has it been a journey. Heres the tale of that journey and some thoughts about things that could have gone better. Side note... it looks like their branding is "youfibre" but the company is YouFibre Limited. I'll be referring to them as YouFibre.

Back in March 2023 I replied to an ispreview.co.uk tweet, it was about another ISP adding more towns to their planned FTTP rollout. My response called out all "altnets" on how they all seemed to mostly just use Openreach's PIA product and anything more complicated didn't get looked at; specifically calling out Netomnia because of their plans in my area. Netomnia were planning to build, or were already building in the area but checks on my postcode showed they weren't coming to me.... but were coming to properties 200m up the road. Their CEO, Jeremy, replied asking for my details so he could look into it.

This was the start of 2 years worth of conversations with Jeremy and the build team at Netomnia. The reason behind my road not being "in scope" was because of the "JUP"s on my road - or Joint Utility Pole. Openreach use UK Power Network poles along my road (and many others in my village) to provide service; without any poles or ducts available via PIA, Netomnia decided to put my road on "indefinite hold". I had many conversations with Jeremy, who as CEO of both Netomnia and YouFibre really does go out of his way to talk to customers when they have issues and ultimately it looked like there may be a way to get things rolling but it wasn't to be for "reasons" - it sounded like a UKPN issue rather than a Netomnia one. I have a 15 response deep email thread with the build team trying to figure out how to get around this UKPN issue but that all came to an uphappy ending.

All was not lost though, based on Netomnia's data, they were going to deliver their network down the main road behind mine, and in direct line of sight of my house was a Openreach pole so I was pretty sure a Netomnia CBT would likely end up on top of it, I just had to wait. Fast forward to the 8th of January 2025 when I noticed a CBT being put on it.... it wasn't Openreach so I knew it was most likely Netomnia. Over the next few weeks I saw more works going on in the area and eventually what looked like an extension of the Netomnia spine fiber, with a man in a van splicing all these new CBTs into the core of the Netomnia network on the 28th of January. On Sunday February 2nd, I checked again and saw the CBT was live for orders.

Now onto the first thing that could have gone better... I emailed the Netomnia build team explaining the CBT was in my direct line of view, and was around 50m from my house and could they possibly serve me from that. I got a response the following day saying "your address is on indefinite hold", as though they hadn't even read the email. I also live chatted YouFibre and got told "we don't service your address". I wanted to give this company my money, they want to serve as many properties as possible to be able to pay off their build costs etc etc. Surely there was a way to get this thing done. Luckily, I'd entered my details on the YouFibre search against the property on the road behind me... a doctors surgery and it was classed as a business address. I got a call from the business sales team on the Monday, I explained the situation and by the end of Monday they called me back saying all was good and we could move forward; by Tuesday morning the YouFibre website was telling me my address was "live" and ready for service (I even got a knock on the door from the local YouFibre rep because the house had gone live). Imagine getting something done that quickly with Virgin Media or BT.... but I don't understand why the business sales team needed to be the ones to push it forward... I gave the build team at Netomnia the exact same pictures explaining the situation - it should have been a simple "that makes sense, lets do that"

Anyway, everything got sorted Tuesday, with a survey offered for Wednesday which I couldn't do due to prior commitments so they came on Thursday instead... The survey turned into an install and by lunchtime I had a 50m drop cable from the pole installed over to my house, an ONT connected to it and the ONT connected to my Unifi Dream Machine Pro. Fantastic. As part of the business service you get a static IPv4 address instead of YouFibre's default of CGNAT and unfortunately this was initially missed from the order but a bit of comms with YouFibre over live chat and with my business manager and that was fairly quickly resolved. However I was getting odd speed test results, this was before I enabled IPv6 on the UDM Pro... I'd get 2-3 Gbps down and 6-7 up against multiple speed test servers. I really didn't understand it. Then I went and enabled IPv6 on the UDM Pro and I got the full 8 up and 8 down.... Fantastic... but something was still wrong with IPV4 traffic....

Weird IPv4 Speedtest results

A quick note of the next small disappointment, the next day, I found the remaining unused part of the drop cable in my wheelie bin. I'm not sure how much there was but it wasn't nothing... I appreciate fiber probably isn't easily recycle-able (???) but surely if every install results in such waste, and if all this waste was collected... something could be done with it.... instead of it going to landfill or burned. It just seems like a missed opportunity.

I hadn't been given a YouFibre supplied router as part of the install, the Netomnia team didn't have one with them. And so I wondered if this odd speed was a me issue or not and so decided to wait until I could use their supplied router. Saturday came and here is the next thing that could have gone better. I had a 8am til 1pm window for an appointment.... 1pm came and still no engineer and no phone call to tell me of a delay. I both live chatted and called YouFibre. I was in a queue for 33 minutes on the phone before someone answered the call. I was waiting for an agent to be assigned to the live chat for 20 minutes before I closed the conversation because someone had picked up my call. Waiting 33 minutes for the phone to be answered, on a business service, isn't good enough, and waiting 20minutes for a live chat agent isn't really good enough for 24/7 service. It then took a further 40 minutes for "someone will come, but I can't tell you when" response. It feels like YouFibre have some things to work out in terms of support resource.

An engineer finally turned up and I eventually did some tests, I got 8 gig up and 8 gig down on both ipv4 and ipv6 being enabled... so it wasn't a network problem like I thought! A side note here.... they've just started installing "YouFibre Hub Pro" routers - in the past they've given people on the You 8000 tier an Asus AXE16000 (I think). Now they have this own branded YouFibre Hub Pro which offers 10 gig wan, 10 gig lan and 4 1 gig lan ports as well as a phone port and it looks like it supports Wifi 6E...maybe wifi 7? I'm not sure. I haven't seen anything about this router online and was told by the engineer he had only installed 1 other of these.

When you have a static IP from YouFibre their ONT gives out this static IP via DHCP but this is limited to a 1 hour lease and so moving from one router to another is a pain. I decided to clone the YouFibre router wan MAC address to the UDM Pro to remove this headache so I didn't have to wait the hour.... I did another speed test on IPv4 expecting to still see the weird speeds and instead I got 8 gig both up and down! Whether the YouFibre engineer adding the router to my account, or using the YouFibre router's MAC address made the difference, I have no idea and I really don't want to mess with it further needlessly to find the answer.

And if you came here looking for information on what the IPv6 prefix size is... its 56. The YouFibre router tells you this (because it all gets provisioned automatically), and random information out on the internet from other users tell you this.... but theres nothing on the YouFibre website - just a "we use dhcp, just plug in" in their FAQs. There are also claims on forums that business customers get a 48 sized prefix. Mine is definitely 56. It would be great to have more of this information available on their FAQs.

All in all, I used to get 1 gig down and 100 meg up with Virgin Media Business via their DOCSIS network (and a weird tunnel for static IPs), which meant 24ms pings to Cloudflare and 30ms pings to Google... now I have 8 gig up and down with 3ms pings to Cloudflare and 5ms to Google. Do I need 8 gig symmetric internet, no. Was it much more as a business to give me the flexibility to use whatever I needed up to 8 gigabit for the next 2 years, no not at all.

If you're interested in taking up YouFibre, and this was helpful, my referral link is https://aklam.io/pElnmm , you get some money and I get some money too.

There are some learnings from this journey with Netomnia and YouFibre and I hope they see them as constructive criticism - I've followed them as companies for years, long before they announced plans for my nearest town (and village) and I really want them to do well. For the first time ever, I've now got an ISP who gives me native IPv6 with proper FTTP and is future looking and that's just fantastic. They're already looking at allowing greater speeds on their network this year. Will I upgrade? Unlikely.... but its great to know you're on a network that could support it at not a ridiculous price that you'd pay for a leased line of such a speed.

One other ask for the YouFibre team would be to install a Ubiquiti Speed test server on their network alongside their Ookla Speedtest server. It would be great to be able to test directly from the UDM Pro against a YouFibre server - more information can be found at https://community.ui.com/questions/Host-your-speedtest-server/23e8e2c8-6fdb-4e08-8016-6cea98cabfdc, you can even make it so only YouFibre IP addresses get offered it!

Thanks to Jeremy and the YouFibre business team for getting it done! Here's to living in 2025 with FTTP internet with both native IPv4 and native IPv6.

Enabling native ARM64 builds with Github Actions

danjenkins — Tue, 03 May 2022 14:23:32 GMT

For a while now I've been running Broadcaster.VC's github actions on a spare machine I have in the office. Building things for both x64 and arm64 could take some time and if I let those builds happen on Github's hosted runners I ran the risk of spending money I didn't need to - I had spare compute going in the office so why not take advantage of it?

When I was running things on Github's runners - things weren't slow but they also weren't blazingly fast either and so I didn't really notice how slow things truly were. When I moved to a self hosted runner in the office, I did notice how slow things were... compiling things on an AMD Ryzen 9 5900X with 24 threads meant my X64 builds were lightning fast - taking advantage of every thread available meant those builds were super quick - I couldn't have been happier but things were a totally different story for my arm64 builds where it felt like the QEMU virtualisation Docker buildx handled for me, meant those builds were barely making any use of the 24 threads available to it.

For a while I wondered how I could make it quicker... could I add another native arm64 runner to the github actions pool? No I couldn't - because then the multi-arch docker images I was trying to create wouldn't be multi-arch at all. Ultimately the way to do it was so simple I'm annoyed it took me so long to figure out. You need an arm64 host with docker installed, and for that docker server to be available from within the same network as where you're running your self hosted runner - you might choose to run an AWS Graviton host or just run a Pi4 within the same network... that's what I did. I'd have preferred to run the Github runner on an M1 mac mini.... but that was an expense I didn't want to cover just yet.

So how do you do it? Like I said, first things first, install Docker on your arm64 host and then make it available over the network - you can follow the instructions in this gist. Once you've got that... it's as simple as adding a few lines to your Github Action yaml file.

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v1

      - name: Set up Docker Buildx
        id: builder
        uses: docker/setup-buildx-action@v1

      - name: "Append ARM buildx builder"
        uses: baschny/append-buildx-action@v1
        with:
          builder: ${{ steps.builder.outputs.name }}
          endpoint: "tcp://the-fqdn-or-ip-of-arm64-host:2375"

You've probably already got the "Set up QEMU" step and the "Set up Docker Buildx" step but there's an important addition you need in that step... adding an "id" to the buildx builder.

The next section is the important one... you want to add an arm64 host to your "buildx" setup so that it won't try and build arm64 builds in a virtualised builx builder. And that's how simple it is... you don't need to try and add more github action runners etc etc.... you just need to give that Docker Buildx environment the right kind of host where it can ask for a build.

The way things are setup today; I commit to Github, that asks my local linux X64 machine to build the project, and in turn, that x64 runner adds a local Pi 4 to it's docker buildx environment and both the Pi and the Ryzen machine build things in parallel - obviously the Ryzen machine finishes much earlier but the Pi4 is faster than letting the Ryzen emulate arm64 and build using QEMU - which feels crazy but it's definitely true.

Now I could definitely get even faster builds than the Pi4 offers... and I did wonder if setting up a "arm64" emulated host using Proxmox would be even quicker than a Pi 4. But its unlikely worth the time to investigate too much further - the biggest win would be to run on dedicated arm64 hardware that had more horsepower than a Pi4 and as far as I'm aware... the only thing that fits the bill would be an M1 Mac - I have an M1 mac but it's my laptop and won't always be available within the network and so a poor choice for builds.

Know a better way or a cheaper arm64 host I could use? Let me know over on twitter - @dan_jenkins

(Sorry for lack of links.... this was a very quick write up!)

YubiKey protected SSH Keys

danjenkins — Tue, 22 Feb 2022 09:23:15 GMT

This is something I've been meaning to try out for a while now but never found the right moment in time to just do it. Just because you have access to an SSH key on a file system, why should that mean you have the right to use it?

Firstly, if you don't know what a YubiKey is then let's catch you up. Its a small device that communicates with your computer or phone via USB/Bluetooth/NFC and enables you to handle Multi Factor Authentication. Best described as:

Authentication using two or more different factors to achieve authentication. Factors include something you know (e.g., PIN, password), something you have (e.g., cryptographic identification device, token), or something you are (e.g., biometric). See authenticator.

In typical MFA use, it's something you know and something you have - your password to a website and a physical device OR a software generated pin. If you haven't already started using MFA via an app that gives you codes (which is called TOTP auth) or via a physical device like a YubiKey then you should get started today. If your password to your favourite online bookshop got leaked through a data breach for example, that password would remain useless to an attacker because they don't have your second part of MFA - something you have - a yubikey or a code from an app. YubiKey is just a manufacturer of such devices and FIDO/U2F is an open standard which means there are other providers out there - https://solokeys.com/ for example.

My YubiKey is a 5 series and so supports U2F/FIDO2 which means I can use it to protect an SSH key generated with OpenSSH. Keys which would give me access to a client's infrastructure for example, or the key that allows me to pull and push code to GitHub - these keys are extremely powerful in what they give access to but most of us just let them reside on our machines completely open to the possibility of being copied and used maliciously. So I thought it was high time I practiced what I preached and moved my SSH key over to being protected via my YubiKey.

GitHub started supporting this back in May 2021 and honestly it couldn't be easier to start using it - just follow the instructions at https://github.blog/2021-05-10-security-keys-supported-ssh-git-operations/ - you may need to update openssh on your system before being able to do this.

The "ed25519-sk" is the special bit - specifically the "-sk" part.

Press the button on your YubiKey device and you'll get asked where you want to save the private/public keys. I already had a key at /Users/danjenkins/.ssh/id_ed25519_sk so I changed the location for this new key - and you can see a private and public key got generated.

With the resulting public key now available to upload to a SSH server, git server or whatever knows how to accept one of these "new" keys.

Upload that public SSH key to you github account and now, whenever you do a remote operation in Git, like fetching a remote, pulling or pushing you'll be asked for a physical interaction with your YubiKey - much more secure than it ever was before!

Its more annoying than before - there have been a few times where I've done a "git push origin " to wonder why a build hasn't started minutes later - realising that I hadn't complied with the new requirement of interacting with my 2FA device but I know this is just a habit that I'll replace soon enough and I know that my both my business' security along with the security of my clients is much better than before.

PS - Did you know you can get all your public keys github knows about by using the url https://github.com/.keys ? Next time someone asks for your ssh key just point them at your github .keys url :) Mine can be found at https://github.com/danjenkins.keys

PPS - You can limit what kind of key is accepted by OpenSSH Server - you can read more about that at https://cryptsus.com/blog/how-to-configure-openssh-with-yubikey-security-keys-u2f-otp-authentication-ed25519-sk-ecdsa-sk-on-ubuntu-18.04.html

PPPS - Just as I was about to publish this post, Tom Lawrence from Lawrence Systems published a video talking about exactly this so go and watch his video where I'm sure he explains things much better - https://www.youtube.com/watch?v=PjDFk8xdtGw

The Met's idea of Authentication

danjenkins — Thu, 21 Oct 2021 12:25:40 GMT

Let me first just show you the tweet from the Met Police about their solution to plain clothed officer authentication following the killing of Sarah Everard by a Met police officer.

Any lone, plain clothed police officer who engages with a woman on her own will now verify their identity through a new process.

We know we need to regain women’s trust.

We fully accept the onus is on us to verify we are who we say we are & that we are acting appropriately.
— Metropolitan Police (@metpoliceuk) October 20, 2021

Let's not take anything away from the reason this is needed in the first place, a horrific crime by someone in a position of power, within one of the world's most well known Police forces against a lone female. But the presented solution from the Met seems just a little odd. Let's take a look at what they are proposing...

Allowing women who are stopped by a plain clothes police officer to ask for verification that the person standing in-front of them is indeed a serving police officer, who is lawfully allowed to stop them. They would do this authentication using the police officer's mobile phone, video calling into the control room for a uniformed officer to confirm things.

But what are the issues with that?

a) why is this option only open to women? There are many other people who could benefit from such an authentication solution, and not just for protecting against kidnapping - it should be open to anyone wishing to authenticate the plain clothed officer.
b) the officer in question uses their phone, to video call the "control room" with a uniformed officer able to corroborate that the officer is acting lawfully.
b1) why should the person involved trust this uniformed officer? It could literally be someone dressed up as a police officer.
b2) how are these video calls going to take place? WhatsApp? MS Teams?
b3) How are these video calls going to get prioritised so they don't go unanswered?
c) The officer is in control on this situation; not the person who wants to check authenticity.
d) 2FA requires us to prove multiple things with known entities and a video call over an unknown medium, to an unknown user on the other end leads to lack of trust in the "solution"

So what can we do instead?

Ultimately I believe this to be a simple problem to solve using existing technology available to all of the Police forces across the UK - standard 2FA practices.

It all starts with the person who's been stopped being able to call a number outside of the control of the police officer standing in-front of them - maybe a new 3 digit code like we have for 999, 101, 111 and 119. This would be done from the person's phone - they're in control of the call which removes any suspicion around whether the call is legitimate or not. This would be answered by an automated system asking for the Officer's warrant card number - these are unique, every officer has one. If the phone system didn't understand or couldn't find the warrant card number then the call would get redirected over to the police 999 centre automatically.

If the warrant card number was found then this automated phone system would go and interrogate the relevant systems to find out if the Officer was on duty or not - could there be other checks done here? I don't know... but this would be a good starting point. If they were on duty an automated phone call would get initiated to their registered phone number (the Met are using phones for their solution so officers must all have one?).

The Officer would then answer their phone and be asked for an auth code - having a static auth code would be a bad idea - everyone can be socially engineered and private details stolen along with their mobile phone in order to impersonate a police officer. Instead why not make use of TOTP auth codes from authenticator apps - the Police must already be using some form of this for accessing internal systems.

So the Police Officer has an active call from the automated system, and puts in their auth code from a TOTP app and a message is played back to the person making the original call - the officer is indeed an active on duty police officer. If the wrong code was entered, again the call would be transferred over to the police 999 centre.

What if the officer is off duty?

This is the scenario Sarah Everard found herself in. The officer involved was off duty - although she didn't know that. What would happen here?

If the system came back and said the officer was off duty then the call would again immediately be transferred to the police 999 centre to be dealt with. If a call disconnected from this line without getting to the end with a successful auth then this would get reported to the police also and of course the whole call would be recorded to be used later if necessary.

The process is a simple one and ultimately could be implemented extremely quickly - there would be setup in terms of having a TOTP code available on Officer's phones as well as linking every Officer with a phone number. And what would happen if the officer had zero phone signal - well then the Met's idea wouldn't work either.

Ultimately relying on video calls to an unknown entity using goodness knows what service is a terrible terrible idea.

Trusted 2FA is a mixture of:

Something you know -- such as a password or pin number
Something you have -- such as a phone, token or other digital device
Something you are -- something unique to your physical being -- biometrics-- like a fingerprint, palm print, retina scan, or your GPS location (to verify you are logging in from the correct area)

We probably can't do the last one... but the mixture of the warrant card number and an auth code either from an app or hardware token seems like a sensible route to take. Using Open Source VoIP projects such as Asterisk or Drachtio would make implementing this something that could be done very quickly - I imagine the "is the officer on duty" check would actually take longer to implement.

Side note: I thought calls to 999 automatically shared your GPS data with operators but it seems that's only the case on Android and not on iOS and so GPS data couldn't be used in being able to send a response team in those failure scenarios. Maybe part of the initial call setup would ask for a street name etc. If the officer involved was indeed not acting lawfully then would they even allow the person to get this far into the authentication process anyway? Unlikely?

Is something better than nothing?

I get that the police are trying to build back confidence and so need to present a solution in order to be able to do that. But is something better than nothing in this case? I'm really not sure. There is just too little control given to the person being stopped by the police and all of the control given to the officer involved - no change to the scenario Sarah Everard found herself in unfortunately.

Announcing Broadcaster.VC

danjenkins — Thu, 26 Nov 2020 16:07:57 GMT

Running CommCon Virtual back in July was a real eye opener for me. I'd always been interested in the technical side of running events but I went to University, got into Coding and then started Nimble Ape - a RTC Consultancy specialising in Open Source WebRTC/VoIP and Web projects. But CommCon brought it all back - suddenly I was in the thick of "how to do remote participation at an event".

The way we did all the pre-production recordings for CommCon Virtual was with vMix using their WebRTC addition; well I say we... the AV company PSP did all the hard work. But even though we were using WebRTC to record the sessions for an RTC conference, something still tasted awful about the experience - how vMix does all the mixing - acting as an MCU which inherently means theres a delay in natural conversation between multiple people.

As the Pandemic continued, we've seen more and more conferences move online, along with national broadcasters seemingly open to publicizing a publicly traded company. All this talk of Zoom on national TV just didn't sit right with me and so I started thinking about what we in the RTC community could do about it all. Back in July my friends at Meetecho wrote about their NDI plugin for Janus and we got to work on improving it's capabilities as well as thinking about how to enable people to use it. Ultimately a demo became more of a platform and Broadcaster.vc was born.

So what is Broadcaster.vc? Ultimately it's a conferencing platform with Janus at it's heart and it's toes. This means you subscribe to Broadcaster.vc and use it as a meeting space for your participants who are involved in the publication of media - they get to talk to one another (or not if you choose that route) with millisecond latency, but with NDI feeds available for every single participant in a "room". We do that by running a docker image inside your network that magically connects to all of your "rooms" in the cloud and produces an NDI feed for every participant - no mixed audio like you get from Microsoft Teams or Skype, and video at the resolution that the sender is sending it at; meaning one of your publishers could be sending 480 and another could be sending 1080. But that's not all - you're not limited to one camera and one mic, you can screen-share and add in more cameras, and more mics as you see fit - they'll all just turn up as NDI feeds in whatever platform you're using.

Now there's still work to do, but the core of the platform is now built and I wanted to see what kind of response there would be to it, what interest it gathers so here it is. Interested in knowing more? Send me an email at dan@nimblea.pe

There's so much more to be said about the possibilities it's ridiculous - you can force your room to use the VP9 codec if you want to in order to get that better picture quality with stereo channels for production audio vs backstage audio as well as being able to selectively send specific published feeds to specific other users - imagine creating a special output mix from OBS/vMix and having that sent back to one of 5 of your publishers - the sky's the limit in what we can achieve with a platform entirely designed around Broadcasting media, rather than trying to make a conferencing service like Zoom/Teams/Skype/Whatever else fit the flows needed for running events.

We're excited about the possibilities. Let us know what you think! We'll hopefully open up registrations in the next week or so with some kind of subscription plan; but let us know if you're interested in what the platform could do for you - get in touch if you'd like a demo.

UPDATE - The self service demo/beta of the service is now available at https://broadcaster.vc with all feedback welcomed at broadcaster@nimblea.pe

Remote Working: Conferencing Services

danjenkins — Tue, 17 Mar 2020 09:13:14 GMT

Today's post was going to be about SIP over TLS and Secure media but I decided this was more important to release as soon as I could. With more and more countries locking down their borders and encouraging their citizens not to meet in person we're seeing a huge rise in popularity of conferencing services but what options do you have to stay connected with friends, colleagues, teachers and family?

WebRTC apps drive communication around the world and now more than ever before, we need freely available communications services. So here are some of the ones available to you to go and use without any setup, as well as some others you could go and setup yourselves for truly secure communication.

Hosted

Jitsi Meet

Join a WebRTC video conference powered by the Jitsi Videobridge

Jitsi Video Bridge

Whereby

Easy video meetings with no login or downloads. Video conferencing with screen sharing, recording and much more.

whereby.com

Whereby - the new name for appear.in

Free Internet communications

SIP2SIP is a real time communications service for audio, video, presence, chat, file transfers and multi-party conferencing.

SIP2SIPAG Projects

Sylk

Of course there are others that require signing up, a subscription or even downloading an app: Houseparty, Skype, Google Meet, Zoom, Matrix, Facetime and Google Duo are just a few of the available services.

Edit: Whereby requires one of the users to have an account - I've had my account for so long I hadn't realised.

However, if you can, why not remove the burden on the above services and run something yourself? The 8x8/Jitsi team have increased their available instances dramatically just to help with availability - I can't even comprehend how much effort it's taking to keep all of that running the way they are.

Well, that didn’t cut it, so running with 50x the resources now. 500+ Jitsi Videobridges at your service Italy! All systems green! 🚀🚀🚀 https://t.co/zQ5TodoQ8E
— Jitsi (@jitsinews) March 12, 2020

If you really want to use Jitsi, there are also community run instances all over the globe! You can find them on the Jitsi Meet Wiki

Self Hosted

So if you have the knowhow and can run something yourself, which projects could you go and run?

Jitsi Videobridge - scalable open source video conferencing for developers

With Jitsi Videobridge, you can build massively scalable multiparty video applications. Start building your free open-source videoconferencing today.

Jitsi

Jitsi Video Bridge

nimbleape/dana-the-stream-gatekeeper

React based front-end demo for Asterisk’s SFU. Contribute to nimbleape/dana-the-stream-gatekeeper development by creating an account on GitHub.

GitHubnimbleape

The Dana project from Nimble Ape teamed up with Asterisk

versatica/mediasoup-demo

mediasoup official demo application. Contribute to versatica/mediasoup-demo development by creating an account on GitHub.

GitHubversatica

MediaSoup

If you've got a project which is fairly easy to get setup and it's not in the list - send me a tweet at @dan_jenkins and I'll get it added. If you read this and you're not sure how to get started - feel free to tweet me, I'll do all I can to help push you in the right direction!

Be kind to one another, go and connect with friends, family and co-workers. Keep the economies moving but remain safe while doing so.

Remote Working: Get rid of your VPN and use an SBC

danjenkins — Mon, 16 Mar 2020 10:37:14 GMT

This is the first of a series of blog posts this week about remote working - come back each day for something new!

Last week Chris from Crosstalk Solutions recorded a video titled "Telecommunications 101" on his YouTube channel. If you haven't watched it already, it's a good watch for those coming to remote working in light of COVID-19 - primarily being targeted at IT Admins who will currently be inundated with requests to enable access to internal systems for remote workers. His YouTube channel is full of fantastic content so it's worth subscribing.

The main TLDR of the video that I took away with me was about enabling VPN for VoIP calling and how some phones even support VPN built into them to enable security as well as access to PBXs that live behind firewalls. Now, while I don't disagree that VPNs have a place and that not everything can be available publicly on the internet in all the different industries these technologies are used; I do think it's high time that businesses started to look at whether phone systems should be openly available to all those who need them in todays society of remote working wherever you are in the world. And it doesn't have to cost the earth either.

Open Source vs Commercial

The simplest solution here is what we call an SBC - a Session Border Controller; and we can either make our own SBC using Open Source software or buy one in from a commercial entity. What is an SBC? In short, its an entrypoint of SIP traffic onto your network - whether thats SIP over UDP, TCP or TLS as well as the associated media and ultimately deals with allowing traffic or not into your internal network - a firewall of sorts for SIP. Now, I don't have much experience with commercial SBCs other than I know they exist from the major players as well as some players you might now have heard of like Telcobridges with their ProSBC product. Do your research, or if you don't have time to do your own research I can put you in touch with the right experts who can take care of everything for you.

Open Source is King

Instead of talking commercial solutions, I wanted to talk about using the Open Source tools available to you today which allow you to open up your business PBX to the outside world; primarily Kamailio and RTPEngine. For a long time, VoIP phone systems have been kept off the public internet through fear of the unknown - there are these bad people who want to abuse your phone system and hammer it looking for vulnerabilities and you hear all about them at VoIP conferences where you hear stories of thousands of dollars worth of fraud and you decided you just wanted to take the easy route of keeping the phone system behind a firewall.

I say, its high time businesses stopped being fearful and got on with enabling employees to work freely from wherever they are in the world. There are loads of steps you can take to do that. The simplest might sound like opening up your PBX to the internet and blocking traffic using tools like APIBAN.org (an excellent tool from my friends at LOD) but going from a system where there is no complexity of "public internet" to one now having to deal with it is harder than you think.

In comes the SBC. Some may say Kamailio isn't an SBC - but I believe when teamed up with RTPEngine it is a very capable and flexible one. An SBC is a really good answer to this particular problem for many reasons - you're still protecting your PBX behind a firewall and you're not changing how it interacts with your existing phones etc. You're just enabling those users that need remote access to be able to get it without altering your current system. Unfortunately there's no plug and play Kamailio and RTPEngine system available out there on the internet for you to download and start using within an hour. A super flexible solution but one that takes some time and probably someone that truly understands how to make it work - people such as Fred, Daniel and Henning from the Kamailio project are your best port of call for a secure, flexible SBC.

If your particular choice of OpenSER fork is OpenSIPS then you can do the same with OpenSIPS and RTPProxy

COVID-19

But we need a solution today Dan I hear you cry. Then maybe your best route would be Telcobridges' FreeSBC/ProSBC system - I have huge faith in the Telcobridges technical team. ProSBC is $1/session/server/year and includes media instead of just SIP which I would say is a must. If you don't want your PBX open to the internet, keep it hidden and let something else take the battering of intrusion attempts. Of course you could firewall off large parts of the world to reduce the battering of inbound traffic but that one time one of your employees is in Russia for a legitimate reason, and can't make/receive phone calls - you'll have long forgotten about that firewall rule in place won the SBC. We live in a remote age of working - allow your users/employees to indeed be remote.

Now, another reason for using a VPN would be "my media and signaling is now encrypted by the VPN tunnel" which is correct but in my opinion an unnecessary overhead. Tomorrow I'll talk about encrypting your SIP Signaling as well as your media so that no-one can listen in on those important conversations.

Nimble Ape can help you with your needs in this space; and if we can't we'll point you in the right direction of a trusted consultant who does. Thanks to Chris from Crosstalk Solutions for all he does on his YouTube channel.

Github Sponsorships

danjenkins — Fri, 13 Mar 2020 13:45:28 GMT

I finally got word this morning that the Nimble Ape GitHub org can accept GitHub sponsorships - which is excellent news. Don't know about GitHub sponsors? Have a read over at https://github.com/sponsors.

GitHub has enabled that "Sponsor" button on repos for a while now with essentially links to third parties such as Patreon and Tidelift - that's all well and good but nothing's easier than not needing to sign up for another account and having to explain a non GitHub purchase with your accounting department.

With GitHub sponsors you can set tiers of sponsorship which are collected monthly - just like other platforms. You can see Nimble Ape's tiers at https://github.com/sponsors/nimbleape

Nimble Ape's GitHub sponsorship tiers

Now, do I truly think people are going to subscribe to give Nimble Ape $5 a month to say thanks for some code we open-sourced? Probably not. Do I think it's possible that some of the companies that use code that we open-sourced would pay us $100 a month for some continual improvements to the code they use? Absolutely - $100 is nothing for a company - especially if they're already paying for GiHub licenses etc etc.

If the options not there, people will never just give you money - make it easy for people to "reward" you for your Open Source code and they might just do that! Fancy supporting Nimble Ape with some cash every month? Go hit one of those buttons at https://github.com/sponsors/nimbleape

Powering my House & EV

danjenkins — Wed, 15 Jan 2020 14:35:14 GMT

I thought it was about to time I wrote something non work related on here. I often get asked by colleagues/friends about how I power my home. They know I have a Tesla Model S, they know I have Solar panels and they know I have "home batteries" because I like to draw as little energy from the national grid as possible. I almost gave a lightning talk at CommCon 2019 about this topic but time was running short as it was so here's what would have gone into the lightning talk. I guess whether you find it interesting or not is whether you're interested in reducing your carbon footprint going forward.

A Quick TLDR;

Ultimately the energy we use from the National Grid is greener, the energy we use in the summer is mostly self generated and I love driving an EV.

The Goal

The goal isn't really to draw as little from the grid as possible, it's to draw as little from the grid at peak times as possible most of all.

A bit of background

It all started when we moved into our current house; we had some money left over from the sale/purchase and wanted to reduce our electricity bills; I work from home and have computers running 24/7, many smart devices etc etc etc - all drawing power constantly - we have a base load of around 1kw/h. It wasn't really anything to do with "going green" at all - we had some money, spent it on reducing our costs every month and in the process got a cheque for our Solar generation/export every 4 months. Nice right?

Fast forward a few years and I got the Tesla Model S, again 100% driven by the fact I wanted a company car (not a personal one) and the only way to do that without spending a lot on personal tax to HMRC was to get electric; the only car that matched long distance and that extra bit of luxury was a Tesla. But this is where I got into trying to shift usage of the National Grid to times where it's not under high demand and therefore electric is cheaper to consume.

What gadgets do I have?

Tesla Model S - 100D
2x Tesla Powerwalls & Tesla Gateway
8kw of Solar Panels (pointed in two different directions)
MyEnergi Zappi EVSE (charger for the car), MyEnergi Hub

Tesla are by far out in front when it comes to electric cars and their home energy products - no-one comes close to the Powerwall's energy density for the price. Inside each Powerwall you get 13.5kWh of storage - we have two so that's 27kWh of storage which works out well when you have around a 1kw/h base-load in the house with occasional heaters going on and off in my outdoor office.

2x Powerwalls in a "Stack"

The MyEnergi Zappi and Hub allow us to charge the car using excess Solar during the day. Now that we have two Powerwalls this happens infrequently but when we only had the one (or back when we didn't have a Powerwall at all), it could mean any excess solar during the day could be pumped into the car instead of going back to the grid - it essentially monitors the power going back to the grid, once it gets to the right level for the car, it starts sending that exact amount to the car. Most chargers can't do this variable amount of current. Imagine having the power to put "free" miles into your car just by the power of the sun - pretty damn cool.

The How

This is better described by a picture. It's definitely a non-simple setup; but I wouldn't call it a complex one either.

OK, it looked better in my head.

Did you know electricity can flow in either direction within all of your circuits inside your home? That's how this all works. Powerwalls consume energy as well as push it out to keep up with what the house is trying to consume from the grid. The Grid can cope with us asking for energy as well as us pushing it back out to them for someone else to use. Solar panel inverters (they take the DC the panels generate and convert it into AC which is what we use in our homes) only generate electricity, just as the Model S can't push energy back into the house because the inverters in the car (yes, the energy is stored as DC in the car too) can't chuck that energy back into AC (well maybe they can in something called Vehicle To Grid charging but thats a completely separate topic.)

TLDR; We signed up to an energy supplier who could give us cheap electric at night to charge the Powerwall (and now the Powerwalls) as well as the car and we run off that stored electric all day. The image below is a pretty standard day where the Powerwalls are almost empty and we need to top the car up.

Energy drawn on the 6th January 2020

That's 55kWh of energy at 5p per kw - resulting in £2.75 to run the house and the car that day. This is in the height of winter with almost no Solar generation the day before (3.2kWh) to help top up the Powerwalls. Some may say that's still pretty expensive to run your house all day but if we take a closer look around 28 of that 54 would be energy for the car, 4 would be the normal base load for the house during that time, and around 23 is going into the Powerwalls; 23+4 = my house load that day would have cost £4.05 (if we take around 15p per kWh average for my area) just for one day - not even taking into consideration the car.

In the summer you can pretty much say that my solar generation will top the Powerwalls up close to full every day and we'll never top them up from the grid (there's a mode called Self-powered in the Tesla Gateway) meaning our only cost for energy during the summer is from topping up the car.

Energy drawn on the 14th August 2019

To be able to do all of this I rely on my energy provider - Octopus and an energy plan called Octopus Go - 4 hours of energy at 5 pence per kWh - if you're interested in using Octopus you can use my referral link and get yourself a £50 credit on your account. They're what you call a very green provider which is nice to know too.

The long and short of it all is that while reducing my carbon footprint has become more important to me (we'll soon probably replace a Land Rover 4x4 with another EV); that's not really been the primary goal through all of this - saving money by using the right tech has been, it's just that a nice byproduct is becoming more green in our energy usage. Some of you may read this and say, sure you're saving money now but you've spent X on a Model S, and Y on 2x Powerwalls and Solar panels and you're absolutely right; but ultimately that money in savings accounts really wasn't giving us much of a return and this reduces our monthly bills now and in around 9-10 years time, the Powerwalls and the solar panels would have paid for themselves - even quicker if you're in a different part of the world where you have sun all year round and electricity prices are much higher than what we have in the UK.

If you're looking at purchasing a Model S, X, 3 you can use my Tesla referral link for some free supercharging.

Let me know if this is at all interesting on twitter. I could talk about EVs, Battery tech, the in's and outs of charging curves all day but it's probably not that interesting to anyone unless they've also got a Powerwall or an EV.

I'll be at Open Source World (ITExpo)

danjenkins — Mon, 06 Jan 2020 11:29:33 GMT

I'm back to work after the Christmas break and I just wanted to say I'll be speaking at Open Source World at ITExpo 11-14 February talking about building Voice Bots with Dialogflow and Open Source Software readily available today. While the rest of ITExpo has never really interested me, the Open Source parts always have although you might find the expo halls filled with vendors and products interesting. ITExpo houses SD-WAN Expo, MSP Expo, The Blockchain Event and Channel Vision Expo.

Quite a few well known members of the Open Source Community will be there, Fred Posner, Allison Smith, Alan Percy and David Duffett to name only a few!

Let me know if you want to meet up and have a chat about how Nimble Ape can help your business.

Giving thanks to OSS

danjenkins — Fri, 20 Dec 2019 15:16:18 GMT

So 2019 is coming to a close and what a year it's been. This is the time of year to reflect on the previous 12 months; both the good and the bad. This year we're not just thinking about the past 12 months but the past decade. It got me thinking about what I had to be grateful for when it comes to what drives my business forward every day. Nimble Ape will be going into it's 6th year in January - and we've done some pretty amazing things in those 5 years - I'm incredibly proud of what we've achieved - we've got clients all over the world, work on amazing projects and have run 2 of the best RTC conferences in the world with CommCon (I may be biased). But what and who have enabled me to do all of it?

Open Source Software

Open Source Software runs the world and I believe firmly in it's capabilities, as well as the pros of using software that has it's code openly available on the internet. Something I've not been great at doing other than in conference talks is calling out the projects which enable Nimble Ape to operate and create amazing solutions for our clients. So here comes some of the projects we've used heavily in the past year.

Drachtio & RTPEngine

The Drachtio project has been a huge part of Nimble Ape's offering for the past 2 years or so. If you don't know what Drachtio is, it's a combination of a C++ SIP Server and a Node.js framework (a node.js module) that enables people like me who love writing JavaScript (and more specifically Node.js) to use the ecosystem we love to create applications that handle SIP traffic in the manner we're used to. Think of it like Kamailio with a Node.js connector and a set of APIs that are simple for me to understand. Kamailio & OpenSIPS are fantastic projects but they're very much over my head for anything more than dispatching SIP messaging to upstream Media Servers such as Asterisk or FreeSWITCH.

RTPEngine is essentially a Media Proxy - able to take media in, be it plain RTP or encrypted WebRTC Media and proxy it somewhere else, and in the process transcoding it and decrypting or encrypting it. It also has an API which allows us to pass SDP into it and have RTPEngine munge it for us into what it needs to be for RTPEngine to accept the media.

In short, Drachtio & RTPEngine are a core part of what forms the WebRTC B2BUAs we create for our clients at a fast rate of knots. I thank the SipWise team for RTPEngine and especially thank Dave Horton for Drachtio - it's completely changed how I build these kinds of applications.

Asterisk

The Asterisk project is very close to my heart having spoken at every Astricon since I joined the community 7 or 8 years ago. The Asterisk project (and more specifically Digium) is what allowed me to start Nimble Ape in the first place. Asterisk was just a PBX to me, covered up by FreePBX which was in turn covered up by Elastix. Asterisk is a now a toolbox with many capabilities at hand. Being able to build a media based application with media mixing, prompts, bringing in external media sources, forking a channels media out to an external application to handle transcription as well as creating a bot using something like Dialogflow is quite simply amazing. The Asterisk project has changed quite a bit over the past 6 years but it's all for the better. Thank you to the Asterisk team for continuing to improve a great toolkit.

WebRTC

WebRTC has been a complete game changer for many reasons but a standard that allows encrypted media with a codec that's able to handle adaptive bandwidths at high quality with packet loss within a browser (as well as natively) has been amazing. Who would have known 8 years or so ago, playing about with WebRTC for the first time and failing massively, constantly asking for help on the Asterisk IRC channel, that WebRTC would be available on billions of devices around the world with online gaming driven by servers in the cloud; I'd have told you you were bonkers. Its been a power for change and drives more and more applications every single month. Is 2020 the year we'll see it become a "proper standard"? Who knows.

React, React Native & the RTC React Native Ecosystem

The react framework (that isn't a framework) has completely changed how we write web apps over the past 2 and a half years. The open source components available to stitch together that allow me to create amazing looking (and acting) applications without any real design skills is one of the best parts of the web - that's not just a react thing but to me, writing react applications is painless (or as painless as we can get - it's completely changed how I build applications with Web Tech). Whilst React is cool, React Native is the key game changer for me - being able to build amazing iOS and Android applications with Web Tech is hands down amazing. Yes I may complain about React Native every once in a while but its usually only for an hour or two. While React Native is amazing - it would be useless to me without the modules that empower the RTC apps we create. A special mention goes to the Wazo team and Kyle Kurz for react-native-callkeep and Saúl Ibarra Corretgé for leading react-native-webrtc forward - both of the projects are vital to Nimble Ape.

CommCon Sponsors

A quick mention to the businesses that have supported CommCon for the past two years; without them the best event in RTC would never have happened. Throughout both years there's been a 4 constants within those sponsorship spots - Simwood, Teluu, LOD and Cloudonix. Simwood have been Platinum sponsors both years and its fair to say without them I wouldn't have even considered doing the event in the first place. Teluu were Gold sponsors both years and on both occasions they were the first to sign contracts and send me money. LOD and Cloudonix were Community sponsors both years - giving money without very much in return - I thank all of them. Will CommCon be back in 2020? As a physical event in the UK, no; I need a break from organising it and I need to have a think about how to make the conference cover it's own costs. Will it be back in another form? There may be plans a foot - I'll know more in the new year.

The OSS RTC Community

And finally... The OSS RTC Community - these are the people I trust in the community and talk to almost every day. They're the ones I use as soundboards when I'm trying to figure out a solution to a problem or need inspiration from. Open Source is nothing without the people around it. Yes, software may be "free" but without contributing back to the community you're just a taker. If you use any Open Source project, and you don't already contribute to the project in some way, maybe have a think over the holiday break (if you have one) about how you can contribute back in some way. That doesn't have to be code, it doesn't have to be getting up and speaking at a conference and it doesn't have to be financial either. Its remarkable how many ways there are for someone can give back to the projects that empower them; how can you help? What's your skill? I thank every member of the RTC community for helping drive all of the solutions forward. You all know who you are.

Thank you for 2019 and I'm looking forward to what's to come in 2020.

Screen-Sharing with Asterisk's SFU

danjenkins — Tue, 17 Dec 2019 15:45:15 GMT

Whilst building the Dana project I wanted to add in the ability to screen share - it's pretty much a norm in any WebRTC conferencing application nowadays. What isn't so much the norm is the ability to send both your webcam video stream and your screen-share; usually applications will swap out your webcam feed for the screen-share; I dislike this entirely. For me, I'm still explaining myself, I'm still connecting with the other people in the conference call, I'm still using hand gestures etc. But I hit a snag - it didn't seem to work with Asterisk's SFU. Why?

getDisplayMedia

Let's take a step back here; how do we go about giving plugin and extension free access to Screen Sharing in WebRTC applications? We use the navigator.mediaDevices.getDisplayMedia API in the browser with some audio and video constraints; just like we would with getUserMedia.

Getting the stream should be as simple as

stream = await navigator.mediaDevices.getDisplayMedia({
    video: {
        cursor: 'always'
    },
    audio: false
});

You can see, I've set some extra constraints in the video object so that the cursor is always captured during a screen-share. How many times have you gestured around something on screen while sharing your screen but the other users can't see what you're doing? Most WebRTC conferencing applications miss this vital addition out for some reason. You can also say yes to audio; in Chrome and Firefox (I'm not sure about other browsers off the top of my head) this will allow you to share the audio from a Tab in the browser as an audio stream. The issue with Asterisk's SFU is that it mixes all the audio streams together so you can't send audio up that you'd then get back again - causing a painful experience for all involved.

I hear you saying "but surely it wouldn't come back, just like your voice doesn't come back to you because Asterisk is careful about what it mixes to who"? Ah yes, this would be the case if Asterisk could handle multiple audio and video tracks in the uploaded stream to Asterisk - it can't and so to be able to do both webcam and screen-sharing we create an entirely new Peer Connection stating we don't want to receive any streams, and that we just want to send one.

So we create a new Peer Connection purely for streaming up a screen-share, and we have an existing Peer Connection with my webcam - woohoo, that's it and it's super simple? Unfortunately not. Asterisk has this need for audio, the very core of Asterisk wants audio and so even though Asterisk accepts this screen-share video stream, it isn't able to forward it on as it has no audio. How do we get around this? We generate silence using Web Audio.

_createSilence() {
    let ctx = new AudioContext(), oscillator = ctx.createOscillator();
    let dst = oscillator.connect(ctx.createMediaStreamDestination());
    oscillator.start();
    return Object.assign(dst.stream.getAudioTracks()[0], {enabled: false});
}

stream = await navigator.mediaDevices.getDisplayMedia({
    video: {
        cursor: 'always'
    },
    audio: false
});

let silenceTrack = _createSilence();
stream.addTrack(silenceTrack);

First we have this silenceAudio function, which creates a new Audio Context and an oscillator from that, we then create a new media stream for the silence to go to and we start the oscillator - without passing anything into it we just get silence. Pretty nice eh. We then return the Silence Audio track with the key of enabled set to true. We take that track and add it to the existing screen-share media stream. Magically, Asterisk now takes our video stream of the screen-share and forwards it on correctly.

We now have to deal with the fact we're receiving the screen-share that we're sending on the other Peer Connection but that's a trivial job of not showing it because we know it's our screen-share.

If you're interested in following along there's an active issue in Asterisk's issue tracker for the issue of having to send audio even though we don't really have any

A big thanks to Lorenzo Miniero from the Meetecho team for helping me figure this one out!

Dana & AudioServer - Transcription

danjenkins — Mon, 16 Dec 2019 13:11:24 GMT

For years now we've been asking for a new feature in Asterisk that enabled us to get a raw stream of audio out of Asterisk in a usable form that allowed us to integrate with speech to text engines, bot platforms etc and that became a possibility in version 16.6 of Asterisk (https://blogs.asterisk.org/2019/10/09/external-media-a-new-way-to-get-media-in-and-out-of-asterisk/).

Dana is built as a project to show developers how to go about building for Asterisk's SFU but I wanted to show off some other new abilities in Asterisk - namely External Media and ARI applications without Dialplan. So that's what I've done. There are now two other projects on GitHub - a speech to text engine which takes audio from Asterisk and sends it to Google's Speech to Text engine, as well as a very simple ARI application to handle creating SFU conference bridges and spying on individual channels to get each individual participant's audio transcribed.

Saúl Ibarra Corretgé, Lorenzo Miniero & Fred Posner joined me

By using MQTT to push transcriptions from the server down to the browser, we're able to get real time, word for word, transcriptions in Dana - its pretty damn cool.

For a limited time check out this version of Dana at https://dana-meet.nimbleape.xyz/ - you'll need to go into the settings and set your name. I'll keep it running for a couple of weeks but of course there are costs involved in using the transcription service from google, as well as the Vultr instance that's currently running Asterisk & the two node services (If you want to enable this demo to remain running consider using my referral link for Vultr)

Want to go run it yourself? Check out the GitHub repos - https://github.com/nimbleape/dana-tsg-rtp-stt-audioserver and https://github.com/nimbleape/dana-tsg-ari-bridge and you'll need a special branch of Dana for the time being - https://github.com/nimbleape/dana-the-stream-gatekeeper/tree/transcription-wip

All 3 of the services use MQTT to link them together (purely because MQTT has a nice Websocket interface for the browser). Input your name into the settings and use any room name at all - we're using Asterisk's new ability to not have any Dialplan listed in extensions.conf and instead, against our WebRTC user, we've set a context that's automatically created for ARI apps - so there's no dialplan extension matching string involved here - it just goes straight into our conference bridge ARI app - look at https://blogs.asterisk.org/2019/03/27/stasis-improvements-goodbye-dialplan/ if you want more detail on this.

The Audio Server is written in Node and takes data from a UDP socket, forms it into a Node.js stream and pipes it into a Google Speech to Text stream. Sounds simple doesn't it? It was far from simple due to the nature of UDP, asterisk servers outside of my network, needing to forward UDP packets over a UDP/TCP tunnel etc etc; let alone everything that George Joseph had already figured out in his implementation - https://github.com/asterisk/asterisk-external-media - the key difference between George's and mine is the ability to handle multiple streams and that's done by getting the source port of the media out of asterisk and sending it to the audio server so we can say Participant X had a source port of 12345, associate their media with Bridge Y and Participant X. I can't wait until the TCP transport (or better yet, Websockets) is added to the External Media API - that should make developing solutions far easier (if you'e OK with sending audio over TCP)

It's all been tested on Chrome only and there are still a few issues with video tracks - feel free to create issues on those GitHub repos on anything odd that you spot.

Twitter, 2FA and WebAuthn

danjenkins — Mon, 25 Nov 2019 13:51:32 GMT

TLDR; Go enable 2FA with either a security key or Authentication App on twitter today!

Twitter's had 2FA for a while - both via SMS and via an Authentication App such as Google's Authenticator or Authy. The difference to today is that you used to need to add SMS 2FA to enable the authentication app 2FA and SMS isn't the best kind of 2FA in the world - meaning someone who was able to get past your SMS 2FA could still take control of your account.

For me, 2FA of any kind was better than nothing at all - your attacker would have to do quite a bit to get past your SMS auth and so having the extra layer of security was important whether it was SMS auth or not. From Last week you can now use a new form of 2FA that uses a web standard underneath it, WebAuthn. That means you can now use your hardware security key instead of an Authentication app too.

You can choose which forms you want turned on; all 3, only 2 like I have or only 1 hardware key if you don't trust the fact your phone won't get lost (if you're using Google Authenticator) or that your Authy account won't get compromised.

While I firmly believe that a hardware security key is indeed best, there are still scenarios where I can't use mine and I believe that my Authy account is well enough protected thanks to password managers (which are in turn protected by my security key). Hardware security keys also cost money. One thing I don't understand is that if Twitter are utilising WebAuthn, why are they only allowing me to use my hardware security key and not the fingerprint reader on my phone or my macbook pro as allowed for in WebAuthn? - maybe because I'd need to add multiple security keys for each device and they haven't allowed for that yet? It would be a brilliant way for everyone to suddenly get the strongest form of 2FA - yourself - your face, your fingerprint etc etc.

Well done Twitter for joining the likes of GitHub and Dropbox implementing WebAuthn

You can buy a hardware key from Yubico for USB-A and USB-C as well as NFC and lightning connections. Or you can also buy from Google's store who have a discount on Titan security keys on the date of publication. However, do know there are differences between the devices and what they support; if you want something that will work with everything, get the Yubico one - its $50 but it'll save you a tonne of hurt in the future.

My thoughts on Google Cloud Contact Center AI

danjenkins — Mon, 25 Nov 2019 10:52:25 GMT

TLDR; it's amazing but has a key issue for users not using commercial platforms.

I've been lucky enough to have done some consulting work recently with one of the largest VoIP providers on the planet; where I got to play with the different aspects of CCAI and I can truly say it's going to be a phenomenal tool in your toolbox. So what is it? Well let me tell you what it isn't - it isn't a contact center in the cloud run by Google because thats the first thing everyone asks; it's the intelligence you want in your contact center, on every single phone call, that pair of ears listening in and ultimately being able to report on what your customers want and feel.

From my point of view it's made up of two key parts - a Virtual Agent and an Assisted Agent. The Virtual Agent, you might have guessed, is a virtual agent which is powered by a knowledge-base inside of Dialogflow. If you don't know much about Dialogflow, simply put, Dialogflow is Google's conversation API; it can be used for voice as well as text and powers Actions on Google Assistant amongst other things.

Now, "Virtual Agent" has essentially been available with Dialogflow for a while - that's essentially what Dialogflow was - you sent it audio or text and it would come back to you with some audio/text and you'd send it back to your user, rinse repeat and you have a Virtual Agent. Where Virtual Agent in CCAI is different is the ability to group the whole interaction under one "Conversation" and be able to draw context from within that conversation. However here's the really powerful part - you can now decide within your "Intents" in Dialogflow when to pass off to a human agent; essentially bringing that human agent in to an already existing conversation; you do this by having an intent that understands "I want to talk to a human" and for that action to pass you onto a human agent. Historically this is where Dialogflow's interaction with the end user might have stopped but now it remains in the conversation as an "Assisted Agent" continuing to listen in on the conversation between the agent and the customer.

This new Assisted Agent just went GA and , working in the VoIP industry, it's the thing I'm most excited about coming from Google Cloud in the past few weeks. Having an Artificial Intelligence listening in on a call, transcribing it, keeping a record of the component parts of it, suggesting prompts to the agent in order to help the customer and then being able to query that retrospectively to improve things - that's just magical and for you, the end user, and your agents; the plus is that it's fairly easy to implement too, if you fill the right check boxes that is.

CCAI explanation from Google Cloud

So what's the key issue?

The CCAI service as a a whole is limited to Google's "Contact Center Partners" which include Genesys, Avaya, Vonage, Cisco, Salesforce and Twilio amongst others. This means the complexity of handling media is left to the "Contact Center Partner" and you just deal with the logistics around the knowledge-base that informs decision making - hence making it fairly easy to get started. However, this is where I'd love to see change; I know how many Contact Centers around the world are driven in-house by Open Source software such as Asterisk and FreeSWITCH with telephone "lines" provided by a wholesale provider who doesn't care what you're doing with that call. As a proponent of being able to choose the best software/hardware for a solution without needlessly having to pay a license fee on Contact Center solutions or higher per minute fees from say Twilio or Vonage, I'd love for those businesses that decide they can do better for their business without a Contact Center Partner, to be able to deal with Google Cloud directly on this.

From purely an operational perspective within your Contact Center, Google Cloud Contact Center AI's console will give you team leads, your QAs and business insight team members visibility into every call, with text analysis of every call you'll be able to automatically score each call from a QA perspective to make sure all those "key points" were indeed raised with the customer. Think of the hours you can save and repurpose elsewhere.

Right now due to how you need to operate with one of Google Cloud's Contact Center Partner's it's up to each provider to give you your data; how they do that is up to them and so theres no code to share here unfortunately. Maybe sometime in the future :)

Now, I haven't gone into huge detail about the other aspects of CCAI; if you're interested in how to get the most from CCAI have a read of the information on Google's Contact Center AI website and if that doesn't answer your questions then feel free to email me at dan@nimblea.pe and I'll try to guide you down the right path. Nimble Ape offers consulting around RTC solutions and has first hand experience building voice bots with Dialogflow.