The Terminal is the App: Privacy-First Software over SSH
2026-06-05 , Hall 1 / Sala 1

The browser won the app platform war, and with it came fingerprinting, ad tech, session replay, and an ever-growing attack surface we've quietly accepted as the cost of doing business. This talk argues for a different path — distributing apps over SSH, rendered as TUIs — and backs it up with a working example: a cryptocurrency exchange where your SSH key is your account, swap history lives against your public key, and there is no web frontend to compromise. I'll cover the architecture in Go using charmbracelet's Wish, Bubble Tea, and Lip Gloss; the threat model compared to a typical web deployment; and the UX tradeoffs that come with asking users to connect over ssh instead of using a browser. By the end, you'll have a template you can adapt for any app.

Irem Kuyucu is a security engineer based in Vilnius and founder of RasterSec. She has reported vulnerabilities to companies including Ford, Revolut, Citrix, OpenAI, and Google, and holds CVE-2025-29331. A free software advocate, she is best known in the Monero community for MoneroPay, a standalone payment processor, and the Monero ATM Project. She writes mostly in Go and C.