Hi everyone,

Wow, what a road it has been.

It’s been 8 months since the first person signed up for invite codes to our Early Access launch at Metamorphic and tonight, through the rest of this month, I am sending out the first round of emails to people.

early_access_invite_email_arrival1215×338 19.7 KB

It's been quite a journey

In 2020, I had a crazy idea to make an alternative way for people to connect and share online. Inspired by becoming a father (“Dada”), my own observations and intuitions about the effects of current platforms, and culminating with Shoshana Zuboff’s latest book on surveillance capitalism, I set off to not only build Metamorphic but also learn how to build it too.

Learning to Code

Screenshot 2022-03-11 1841361200×828 76.4 KB

After Paper Space Arcade, I turned to web development to make a website for my partner-at-the-time to assist with her job applications and resume. This led to me discovering the Django framework and I began work building a job search for architects website called The Grid (wayback machine).

Switching from game development to web development was like turning the dopamine switch on high. The gap between code and “useable” shrank to almost nothing. Suddenly I could imagine turning an idea into a reality before the sun went down. It was an empowering feeling made intoxicating by its immediacy.

The Covid Age

When Covid hit, I felt both inspired and powerless to help. Day after day I’d read updates on the increasing numbers and wonder what I could do. Ultimately, not that much, but it drove me to add a search feature to The Grid that was updated with the Covid data from Johns Hopkins and enabled people to quickly and easily search by county around the world.

While The Grid failed, it was a great exercise in learning and avenue for channeling my creative energies and desire to help (it mostly just stressed people out whenever I commented on the latest numbers for their county).

Do all webs spin from Ruby?

As I immersed myself more and more in Python and Django, I inevitably discovered Ruby and Ruby on Rails. My first impression of Rails was “syntax confusion”, but I found myself charmed by the passion and philosophy of its fans and kept coming back to it.

So, I began building a portfolio site for my same partner-at-the-time using Ruby on Rails and I like to believe that it helped play a small role in landing her a job (the architects commented on how impressed they were with her site — though largely due to her design is my guess).

A transformation begins

Around the end of 2020, the idea that my company with my co-founder-at-the-time would raise money and successfully develop video games came to an end. I had also been the primary-caregiver to my incredible little one and found myself realizing how much I valued my role as such.

While I was demoralized about the end of the “video game dream”, I found myself increasingly inspired to do something that would have a positive effect on the world for my little one. That’s when I decided to commit to building another way to connect and share online — insulated against the raging surveillance economy.

Early versions

Since Ruby was the latest language I had been working in, I embarked to build Metamorphic with Ruby and Ruby on Rails. It’s hard to imagine or even remember these early versions, but I do recall consistently bumping up against the need to do so much more with so much less.

While I was stumbling over the same development hurdles with Ruby and Rails, I learned about Elixir and Phoenix from that similarly momentous Chris McCord Twitter clone.

However, I was initially turned away again from my first impression of the syntax and feeling my brain explode every time I saw symbols moving through other symbols:

# From Chris McCord's demo
def inc_likes(%Post{id: id}) do
  from(p in Post, where: p.id == ^id, select: p)
  |> Repo.update_all(inc: [likes_count: 1])
end

But, destiny beckoned, and I sat down one night and followed along — throwing out any attempt to understand and just going along for the ride.

And what a ride it was. When I played with the finished demo on my own laptop it was like hitting reset on the dopamine switch. I didn’t know much of anything about Elixir and Phoenix, but I knew I had found the tools that would give me the best shot I had at making Metamorphic come true.

Today

And now, nearly 2 years later, I am finally “ready” (ohhh boy…) to start sending out the first round of Early Access invites. I had no idea that it would take me this long when I first set out to make it.

My naivete was a blessing because I probably wouldn’t have attempted Metamorphic if I had realized what I would go through along the way. I still don’t know.

The community around Elixir is simply phenomenal. Whether it’s a podcast or this forum, people are compassionate, kind, and inspiring (not to mention brilliant and skilled — seriously, wow). And it goes without saying, but I’ll keep saying it, that Metamorphic wouldn’t be possible without the community.

With luck and work, I’ll be able to keep contributing and giving back to the community even more (so far that Ecto guide and simple HaveIBeenPwned? alt-library).

A final personal note around Early Access

I mentioned I’ve been going through a challenging time outside of Metamorphic, which had delayed my original launch plans.

And it’s true, as a father and primary-caregiver going through a… nightmare of a divorce… going through all sorts of court/legal fights (family and criminal)… being isolated with the little one from our family and support network on the other end of a large country… while moving in our first blizzard… I’ve had to handle more than I ever thought I was capable of.

So, I cross my fingers that Early Access members will be patient and understanding with any hiccups or “bugs” as I work to make Metamorphic as awesome as it can be for everyone, while also working to make sure my little one’s life is as awesome as it can be for them too.

I’ve been so fortunate to have such incredible support in my personal life and in this community, and so from the bottom of my heart, thank you to everyone.

I’m so excited to welcome people on this crazy journey with me.

To a better future together,

Mark

Thank you, that’s so awesome to hear. I don’t know if it helps you, but things that have helped me, and continue to, are:

• this forum (reading posts from others)
• Dashbit’s blog and DockYard’s blog
• listening to Elixir podcasts like Thinking Elixir
• services/tutorials like full stack phoenix, elixircasts.io, pragmatic studio, poeticoding and elixir school
• studying open sourced repositories like Bytepack and Livebook
• and then books (so many PragProg books)
• trial and error (lots of trial and error, preferably in a safe environment)

Wishing you the best and excited to see what you make!

@shd42 Before the question: you worked with Sea Shepard? I think that’s so awesome. I just watched the documentary not too long ago on the founder. So many questions but so impressed you went out and did it.

Great question. It’s probably not clear because I haven’t yet put a section up explaining how it all works. So sorry about that and I’ve add that to my to do list. It’s just me making it all and my little one isn’t yet in daycare, so I work in nap breaks and after bed time if I’m not too exhausted (translation: takes me a longer than I’d like to check things off my list).

To answer: currently your data like images (for memories, avatars, other features) are hosted with Amazon S3.

I wasn’t stoked about this as there could well be a future where I’m paying them a significant amount of money, but it currently was within my ability to get it up and working.

I’ve looked at decentralized options like Storj, and I’m considering transition to Storj in the future (it has an S3 adapter — part of my reason for S3 was that I can more easily move services). When you sign in to your session and pull your images down from S3, they’re stored temporarily in ETS until you log out, then they’re cleared (currently that’s how the temp ETS is working).

Other non-object data like name, email, stripe_id, pseudonym, etc is stored with our hosting provider which is currently Render.

Oh! Just remembered: also when you delete your data, like a memory let’s say, the encrypted blob is also deleted from S3.

On Amazon
Now, S3 claims that they don’t do anything with the data in your buckets. I’ve read their policies a couple times and it actually sounds like that’s the case (I choose to not actually trust them—so what’s hosted is the asymmetrically encrypted object blob—even the file name, just not the extension—cause that made it much harder for how i then decrypt and show you the image temporarily in the browser without storing anything other than the decrypted binary temporarily on ets).

However, I do presume that their AI systems are involved in similar practices to scan public (and possibly private) images to train and build up their image recognition training sets. I presume this because that’s standard industry practice for the economic model.

So that’s when I realized I had to asymmetrically encrypt (with your password-derived key) because I didn’t want to “trust” that they wouldn’t do that with peoples data.

This also allows me to keep the buckets public but restricted with their CORS policy etc—which allows the frequent and hard to predict pulling of images for people (although as I write I realize I think I can update this now again to be private with presigned urls because the binary now gets stored in ets)—because the data is totally encrypted with the NaCl/libsodium libraries that the authors suggest not even the NSA can break (again all i can do is use my judgement and then decide to trust or not—I decided to trust them because they made a note on how NIST recommends algorithms and bit sizes that are strong for everyone but the NSA, hence 256 over 512 for SHA, which was my hunch, so that helped me feel like the library had similar hunches and I could count on it—it’s also recommended by the Practical Security book on prag prog). But you can forever go down the rabbit hole on wondering.

I encourage anyone to test and see if they can pull down any encrypted blobs from Metamorphics buckets (staging or otherwise and verify that the encrypted data is useless). Ive searched for them on grayhatwarfare but they don’t show up (although I don’t have a premium account so that may be why). They are currently named like: metamorphic-memories, metamorphic-avatars, and (I think) staging-metamorphic-memories (on my phone) etc.

On Render
The founder of Render comes from Stripe. And I felt Stripe is probably the most trustworthy with your data in the payments space. That inclined me to believe that @anuragg would bring similar if not better data and privacy practices. Again, I just have to trust at this point.

They also have temporary logging by default of only 7 days, which made me, again, feel that they had a similar respect for operational functionality and people’s data. And they encrypt their databases, use tls 1.3/1.2, I believe, when it’s supported.

However, I take a similar step as with Amazon and asymmetrically encrypt that data too before it hits the database with them (then I use amazon’s own symmetric encryption to encrypt that blob at rest).

Additionally with Render, the asymmetric encrypted data is then symmetrically encrypted by me with the Cloak/cloak_ecto library and I don’t store any logs outside of Render’s temp 7 day logs. Also, the logs are the base server error/warning logs.

Symmetric not asymmetric
Things not asymmetrically encrypted include the stripe_id. I added a section to the privacy policy on how a government may be able to get metadata by court ordering stripe and metamorphic’s databases (https://metamorphic.com/privacy), but it’s pretty trivial. Metamorphic is about protecting you and your data from surveillance capitalism and those AI systems, rather than making you 100% invisible/anonymous. It’s probably possible to do on Metamorphic but I don’t offer any guidance for that cause it’s next to impossible in the digital space.

Not encrypted
Things not encrypted explicitly by me but by my hosting provider only, are things like Boolean data that indicates really nothing sensitive or personal at all.

Okay this is probably straying off topic, sorry!