Sunday, November 22, 2020

#SecurityStories: Summing Up

Just like I did since 2017, I've committed to a personal challenge for this year as well: telling #SecurityStories. A few months into it, it was starting to take shape. I had completed four different experiments in the area of security and was working on the fifth one:

I believe that working on Juice Shop challenges, alone or with a pair, will result in increased confidence in my own skills.
I know I'll have succeeded when I've solved all challenges below 5 stars.

So I started from scratch again with the latest version of OWASP Juice Shop, solved challenge after challenge, finished all the ones marked with one or two stars. I paired with Gil Zilberfeld and Simon Berner. I realized some of the three star challenges were trickier than expected. Many times I thought I had found the solution yet my approach didn't work. Frustration kicked in, yet also the eagerness to figure out this challenge, gain the required knowledge to do so. I had managed to solve 10 of the 22 three star challenges, completed overall 33% of all challenges - and then life happened. Priorities changed.

The killing of George Floyd and so many other Black people left a big impact on me. I decided to pause my personal challenge and focus instead on learning about systems of oppression, and racism in specifics. Also this time, I shared what I learned within three months in my post I Am white. This is a lifelong learning journey, however, and I'm continuing the work.

Coming back to the #SecurityStories, I'm now closing this personal challenge with this post. This is an experiment for which I couldn't evaluate the underlying hypothesis as the exit criteria I had defined kicked in first: I faced a more important challenge, and my timebox until October 31st expired as well. Personally, I did learn a lot from working on this challenge. Four persons confirmed with me they learned from it as well; if I reached any more people with it is unclear.

Looking back, I realized a few things about this specific challenge and how I framed it.

  • I find it hard to tell real stories, not just write mere reports.
  • No one confirmed they learned something from me unless I asked them directly; and of course they said yes then.
  • It's hard to explain complicated terms in simple ways.

The base challenge which made me come up with the #SecurityStories remains: raising my awareness and skills around security and sharing my insights while always taking care of myself. I've not finished learning more in the area of security, by far not! I will just do this on the side given I have the energy and capacity for it. It's still a super important topic for me, and I still have so many ideas on my list of things to try and learn more about, so it'll be easy to be picked up again any time. Also, I'm still having monthly pairing sessions on security with Peter Kofler anyways.

What I did a lot better than the last years, was taking care of myself. Once again I had integrated self-care into my personal challenge, forcing myself to prioritize health. I only failed two times, just before and after DDD Europe, and noted that as being okay. The rest of the year I did make time to do things that are good for my body and soul.

For now, I'm de-cluttering my life. I'm finishing off a few things I started some time ago, finally getting a few things done that were overdue. Eventually, I'm trying not commit to a lot of things at the same time anymore, whether at work, in private life, or for my personal development. Next year will come, a new challenge will come (already have one in mind), there will be more things I'd like to work on. I want to grant myself the freedom to say no or not now, and to stay more flexible in my commitments. In the end it boils down to regaining focus and keeping balance.

Sunday, November 15, 2020

Agile Testing Days 2020 - Recharging My Batteries

Joining the Agile Testing Days at the end of the year was always a blast and a real energy booster for me. This year, the conference was forced to go online, and I wondered how it would be. I might have shared it before, I'm rather skeptical regarding online conferences. While I love the fact that remote makes attending conferences a lot more accessible, I personally feel online events drain my energy more while I'm not getting the same benefits from them as if they would be on-site. I really miss the hallway tracks, the informal casual conversations, having food together, the social hours after the official program ended, maybe even going sightseeing together. From all these informal situations I learned so much, drew a lot of inspiration, and gained wonderful friends and a lot of connections in the community. The only online conference so far that made me feel re-connected with the community was TestBash Home earlier this year; shout-out to the wonderful people at Ministry of Testing!

This was a very unusual and rough year. It had and still has a toll on everyone, on many people dis-proportionally higher than on me due to my high level of privilege. If I already feel it and go through a (rather smooth) roller-coaster ride, how must it be for those with less privileges? Here's where I learn so much from stories told by other people, especially those systemically underrepresented. Even in my lived experience, I felt in need of refueling my energy.

Back to the Agile Testing Days 2020 online edition. First of all: many thanks to the wonderful organizers to make it happen at all, many thanks for putting so much effort and mindfulness into making it happen, and many thanks for making it a great experience despite all the issues that only surface when you bring a product to production. You did a great job to solve or work around them quickly. Cheers to you! Super grateful.


The Highlights: Community Magic

The first day had me starting quite tired, yet eager to see if the magical Agile Testing Days community spirit would be alive and kicking also virtually. And it worked! Seeing so many people in the talk chats and all the tweets flowing on Twitter really drew me into the zone. All this crowned by the announcement of the Most Influential Agile Testing Professional Person (MIATPP) 2020, the wonderful and ever inspiring Angie Jones!!! So glad this community award finally went to Angie after her being on the top voted list for years. Well, I might be biased here as I repeatedly voted for her myself - yet I'm convinced I'm not the only one thinking this was overdue. Here's what I wrote to nominate her. Angie, in case you're reading this: thank you once again for everything.

Angie did so much for our testing community. She's sharing her wisdom every day with us, on Twitter, her blog, touring the world and more. She's an amazing presenter and wonderful workshop instructor. She continuously promotes the importance of automation and testing and how to do it well.

Angie has been super influential for a long time already. Last year, she took it to the next level, advocating for all of us when she brought Test Automation University to life. This was a stroke of genius! She got so many world class instructors on board and really engaged the community to learn and go beyond. 

There are so many more reasons why Angie should finally get the MIATPP award, yet one thing deserves emphasis on top of all this. Angie was key to me waking up to what's happening in the world. To not only see the systems of oppression, systemic racism in specifics, but also to act on what I see and start dismantling it. What she shared, her own lived experiences as well as those of many others, triggered me to move; to go ahead on my lifelong journey of learning more and doing better. It's clearly up to me now, yet still: Angie, I cannot thank you enough.

Right after the award "ceremony" (what a pity we couldn't really celebrate Angie all together on-site as she would have deserved it!) it was bar chat night. Alex Schladebeck hosted one of them which draw me right in. It was lovely hanging out with people even just virtually, seeing known and new faces and hearing about their lives and experiences. This strengthened the re-connection to the community and got me looking forward to the next days even more.

Yet my absolute community highlight was the evening of the second day. Party time for some, PowerPoint karaoke and pub quiz for others. I chose to again hang out informally with people, looking for new connections or strengthening old ones. For this purpose, the conference organizers did not offer a usual conference call setting, yet used a Gather town instead. I haven't come across this tool before and was delighted to discover it! Entering the town, you get a tiny avatar and are placed on an isometric world map looking a lot like a retro game. You can wander around the map and as you meet other people, our video feeds get active and we can talk with each other. If you wander off too far away, you cannot overhear conversations anymore. Mimicking the real world situation! Bonus point: it's free for groups up to 25 people.

At first I found myself in the need of exploring the tool, I was not ready for interaction yet. Yet then some familiar faces popped in and we started to explore the tool together which was a lot of fun.

More and more people joined and we figured this was coming as close to the real conference on-site feeling as it could! Groups formed and dissolved quite naturally, conversations evolved on one topic and moved on to others. We figured if we start our own map we could enable the builder mode and customize our map, even add interactive tools like whiteboards or games. We ended up with playing the game Set online with each other and had great fun! Really, I haven't had so much fun in the virtual for a long time. And the evening wasn't over yet. I had to leave the group for about an hour due to a dry run for my workshop the next morning, yet just like on an on-site conference, I came back and looked whether there would be still people around and up for a conversation. I actually found them! Thanks to my dear friend João Proença for sticking around and inviting me over to the late nighters talk. Also here, once more I felt the spirit of Agile Testing Days. I knew I had to call it a night to be reasonable, yet I simply didn't want to leave the conversation just yet. So I stayed up way longer than intended and had to pay for that the days afterwards. Still don't regret it a bit.
The only sad thing: not too many people from our power learning group could attend this year. They were deeply missed, especially my learning partner Toyer Mamoojee. With those who could join, we didn't find enough time to connect. Well, we will have a dedicated call in a few weeks and re-live Agile Testing Days just for us.

The Program: A Mix of Everything

This year I chose to stick with my own commitment of being kind to myself and not creating sketchnotes for online talks. Although I do like creating sketchnotes and sharing them, I feel they only help me in real life settings. When I'm in front of a computer anyways, I take digital notes. Also, this decision allowed me to keep up with Twitter more in time so I didn't need follow that urge at the end of the day when I'm already exhausted. Still, if you'd like to see sketchnotes, check out the ones created by Ekaterina Budnikov, Eveline Moolenaars, Katja Piroué and Konners Brai.

When at on-site conferences, I tend to attend workshops whenever I can and hope they will be really hands-on and full of interactive exercises. I learn a lot by engaging and experiencing things myself. I feel these are the situations I cannot just replay as I can do with talk recordings. That being said, of course hearing a talk live together with other people is a huge difference compared to watching a recording alone. Still, I wanted to make time for workshops as much as I could also for the online edition of Agile Testing Days. Here are the sessions I ended up attending live.

Day 1:

  • Keynote: It's Always About You by José Díaz. José ended up jumping in with a backup keynote as Daniël Maslyn who was scheduled for the opening keynote faced connection issues. In hindsight, I really loved this happening, it was amazing! This was a very personal and vulnerable story showing how José became the person he is today. It was the perfect keynote to open the conference; no matter if it was a backup or not. Really triggered lots of thoughts. Super inspiring, setting the tone for the conference.
  • Testing Tour: My journey of Pairing and Learning by Parveen Khan. I just love that Parveen is sharing the story of her testing tour, pairing up with people and learning a lot together. From what I observed she inspired a lot more people to step outside their comfort zones on their journeys. Just awesome!
  • Being a tester after trying almost everything else by João Proença. Loved it! So many lessons learned in different positions over the years, there's lots of wisdom to draw from. Great reminder that everything we learn can help us with testing. By the way, did you know João is an amazing musician? Check out Marty Was Right (also available on Spotify)!
  • Keynote: Automation Addiction by Huib Schoots and Paul Holland. What is automation, really? How did this fixation on test automation evolve and how to see the symptoms? Great keynote on why we cannot automate everything and we shouldn't. Automation can do a lot for us, yet automating too much, automating the wrong things, or maintaining ineffective automation hurts. We need a comprehensive strategy supported by the whole team.
  • Workshop: Security Games by Marianne Rady, Claudius Link and Matthias Altmann. I learned new ways of engaging participants using a Miro board. I got to know about a security game I wasn't aware of yet: OWASP Cornucopia. I could get my toes wet with the Elevation of Privilege (EoP) Threat Modeling Card Game. Besides that, I learned about the difficulties to make security accessible to a wide variety of people.
  • Keynote: Level Up: Playing the Automation Game by Angie Jones. A-ma-zing. As always. Thank you Angie for sharing your wisdom! Really dropped gems here, once again. This time, transferring what she learned from game design to automation. Also: loved the video of young Angie playing city bingo!
Day 2:
  • Keynote: Testing is not the goal! by Rob Meaney. So much wisdom condensed in one talk. And the messages cannot be emphasized enough: "life is too short to build software that does not matter and too short to inflict harm on people", "build organizations and teams obsessed with learning", "design systems together that can be safely adapted based on what we learned", "optimize for a great whole team experience to get happy productive teams working in successful, innovative businesses delivering valuable software to satisfied customers". Definitely check out all the great work Rob does! Especially when in need of mental models, Rob has a real knack for them.
  • Workshop: Put testing on the map by Wouter Lagerweij. Wouter prepared great visualizations to help us have meaningful conversations on different kinds of tests and how they fit to different parts of our system, process or pipeline. He pointed out to make sure to have a shared definition on the terminology used for tests, no matter which one.
  • Keynote: 8 Bit Pro - A gamer's guide to testing by Dan Billing. I had listened to this talk last year already, and loved the latest version even better. Besides showing how any product needs to provide value using the example of games, Dan even had the whole audience playing Lemmings with him! Really energizing and fun. Also, I really appreciate his plead for increased diversity and inclusion right after his talk.
  • Workshop: TDD with You, You, You, and Me by Zeb Ford-Reitz and Mira Kottmann. This was an amazing workshop, really grateful for the experience. I loved the theory part, they made it really easy to follow by providing very clear and helpful explanations. I especially loved the workshop part which was really hands-on! It's just great working in an ensemble, learning and practicing together. Big kudos for Mira and Zeb for being really kind and mindful. I felt very welcome.
  • Dear Mrs Aquafresh: Bottling this girl’s confidence by Clare Norman. Wonderful story, and especially wonderful storytelling! Incredible job for a first-time speaker. Clare shared a very personal story on how she re-built lost confidence as an adult while she had a lot of confidence as a child. She reminded us to be - us. Not cool or normal, the weird us that we are. To let our inner child out in while. To decide ourselves where to spend our courage on, to put our own stamp on everything we do, and to celebrate that. From my observations many people saw themselves in her story. I really hope more people get the chance to learn from her experiences, they'd be in for a treat.
  • Keynote: bAd-gile: The Online Gameshow by Huib SchootsAlex Schladebeck and Bart Knaack. What a great idea! Didn't know what to expect from this keynote but I loved it. They had two teams playing impossible games before the keynote, recorded the outcomes and shared their observations. Then it was time for the audience to do the same! They even asked them on stage to share their own moments when agile had gone completely wrong or misunderstood. This was entertaining, engaging, fun - and also inspirational. Have to try out those game ideas back at work!
Day 3:
  • Keynote: Beyond the bugs by Rick Tracy. Interesting look at how testers are perceived by different people and how they see themselves. The one thing in common: they find bugs. Yet there's a lot more what testers do and how they provide value. Rick went so far to even calculate their impact in concrete money value. Impressive.
  • Keynote: Let it go by Nicola Sedgwick. What a wonderful personal story to close Agile Testing Days. Nicole learned lots of lessons about testing and quality on her way. She encouraged testers to let go: of testing as a role, of defining themselves by the quality of their systems, of perfection, of the defensiveness that if they're not testing they're not contributing. Let's embrace the coaching aspect, learning new skills and experimentation. Very relatable story, inspiring us for the future.
I had planned to attend another workshop on the third day on accessibility testing yet found myself too exhausted after my own session so I decided to take a break instead.

From what I've seen on Twitter, there had been several talks that looked very insightful: personal mental health stories, talks on effectivity and productivity, and important aspects like biases and ethnics in testing. Good to know the recordings are there for me to catch up!

The Excitement: Our Own Sessions

This time I facilitated two sessions. Lucky me - I was not alone for either of them! I paired on creating a pairing workshop, I ensembled on creating ensemble workshops. Just in the spirit of what we wanted to have our participants experience. Also, these had been first-timers for me as I did pair on workshops before, I did remote workshops before, yet I never had both combined. Also, both session concepts were brand-new, world premiers so to say. Experiments in themselves and to be incrementally refined as we go, as we definitely aim to give those sessions at further conferences in the future.

The "Extreme Pairing" workshop that I had the honor to prepare and facilitate together with the wonderful Simon Berner was something I had on my ideas list for a longer time. Thanks so much Simon for making this happen together with me! We started scheming this since May when the conference was still planned as on-site conference yet we knew this could change any time. Just as it did; first to a hybrid for a small on-site crowd and a virtual audience, now as completely online conference. Looking back, it was a great decision that Simon and I decided very early on to make our workshop feasible to do remotely from the start. Our rationale was that for a pairing workshop, even the on-site setting would require people to sit far from each other with their own screens in front of them. In the end that decision served us well. It was clear we opted in for giving this workshop remotely and we don't regret it. It was a blast! So honored and happy that the twenty people joining us stayed with us the whole time for a 2.5 hours online workshop. Really happy about the feedback received and looking forward to improving the session further. For the limited time we had we couldn't go as "extreme" as we would have liked to, yet the way we designed the workshop we could easily scale it up to a longer session and adapt it to different audiences.

The other workshops where both Simon and I were involved in were the "Daily Ensemble Sessions" with our wonderful conspirators Elizabeth Zagroba and Joep Schuurkes who initiated the whole idea. Each day we offered a different session with different facilitators, introducing ensembling in a different way, offering a different topic to work on, and having different participants working together. This was a great experiment and a great experience with a lot to learn from! We would have loved to offer this on-site on a bit bigger scale, yet making the scope smaller for online worked really well to test out the concept. Once again it was clear that the ensemble approach combined with a safe learning space can enable a group of strangers working together successfully and learning a lot on the way. Also, it's teaching valuable lessons how to communicate and collaborate better with people in general. I hosted the third of these sessions together with Joep Schuurkes and I learned a lot about facilitating again, what helps setting the stage for an easier start and what helps making the space safer for everyone. 

On a personal note: it might not have been the smartest idea to facilitate two workshops on the last day of the conference, knowing I will have my energy depleted after the first one. Still, I'm really happy we made this happen. I learned a lot, it was great working together with my fellow facilitators, and it was a pleasure having our lovely participants.

Next Up

Well - that's it for my conference year 2020! Next year? Originally, I had planned a lot of things already including conferences I've already agreed to. However, no one can tell how the world situation might look like then, so let's wait and see.
Regarding Agile Testing Days 2021, I do hope that some of the planned conferences can take place in any kind of form. Agile Testing Days USA, the newly announced AgileTD Open Air, and of course the usual Agile Testing Days again end of the year. Let's see what comes, I'm eager to feel this wonderful community spirit again. Until then, I could recharge my batteries to full once again this year. Thank you everyone.

Thursday, September 3, 2020

I Am white


⚠️ Content warning: racism, sexism, death


I am white, I am privileged, I am biased, and I want to do better, for a better world for everyone. Taking action was long overdue. This time I finally got moving.

Disclaimers:
  1. This post is targeted at white people as we share this part of our experience. I hope that by reading this you gain one new insight, one topic to research further, and one thing to do yourself. Input for your own learning journey on racism and how to dismantle it, and for helping others learn more. It always starts with ourselves.
  2. I am no expert in racism and will never be. I don't have first-hand experience. Therefore, I am not qualified to write on racism as such. I cannot write about the lived experience of anyone else. I can only write about my own journey learning about racism. Yet there's a problem: even though I write this post from my perspective it's not about me - and all about me at the same time. I tried to strike a balance here, speaking about my own experience without centering my own experience. I really need to learn how to do this better. Still: I felt that not even trying would be worse.
  3. I do harm, and feedback is a gift. It's not about intentions, it's about the impact. We can mean well as much as we want, and people still get hurt; especially the most vulnerable. I know I will do harm, as much as I don't want to cause harm. Also, I don't want to make anyone a target by what I'm writing.
    1. If you are Black, brown, or in another way have a different racial experience compared to me, and you decide to spend the energy of reading this, then I am grateful. If you in addition decide to share your thoughts with me, then I owe you a lot. I offer to pay this debt back or pay it forward - double, in any kind of form you prefer, you tell me. I know it's on me and only me to educate myself. It's completely up to you if you decide to give me a push in a better direction, so please know that I don't take this for granted.
    2. If you are white like me and you see anything written here that potentially could cause harm, I really appreciate it if you let me know.
If you only read this far, then here's the gist: Listen to more stories and learn about the lived experiences of people who are not like you. Listen, don't judge, no need to understand. Just listen, then listen some more. Share these stories, amplify these voices. Most importantly, act: actively work on tearing systems of oppression down, therefore improving life for everyone. We can always learn and do better.
Still reading? Welcome to the full thing. This is the most important blog post I've ever written and maybe will ever write. I took my time with it, and now it's time to share it. Learning about a topic so deeply ingrained in everything we do that it influences us every day, if we want to or not.

It's a rabbit hole. One that invites to a journey. A journey long overdue. A journey that has me looking forward, backward, sideways, down, up, through time, right here, everywhere. That opened my eyes and ears and senses further. A journey of many stories, stories waiting to be told, stories long told yet never listened to, stories evolving, stories of the past. An emotional ride that is moving. It is moving me. It didn't start now and it won't end here. Yet I really needed to get moving.
I needed me to be finally speaking about this publicly. Loudly. Following the footsteps of so many great people out there who did that long before me. Acting on what I learn, actually driving change. Hoping to pave further ways for more people to follow. We need to dismantle racism, together.

Why Now

You might have guessed it. The events of the past months in the USA triggered me to move again. I won't list them here, if you haven't heard what happened, then there's homework for you. The blatant injustice and obvious oppression. The countless deaths that still seek justice. All this didn't just happen now. It was there for a very long time already. I could have seen it. I could have taken it seriously. There's no excuse why I didn't act on this before. 

There are various systems of oppression. Yes, systems, because they are indeed systemic. They are designed by humans to be systemic. I did not create them, yet I inherited them. I've learned a bit about them over the last years, so I cannot say I was not aware of them - the hard truth is I didn't prioritize learning more about them. It was more of a side thing, picking up pieces here and there shared by others. And yet, we do need to become more aware of these systems to enable us to change them. Especially as we are always whole humans with many identities that makes it so crucial to consider intersectionality in everything we do.

Right now, I feel the focus needs to be on racism. Systemic, institutionalized racism that's omnipresent in my everyday experience and behavior. It's so blatantly obvious it's a wonder people still believe that we were past that. And with "people", I mean myself in front row. After all, I grew up in Germany. Believe me, the irony is not lost on me. Let me be clear that this focus on racism does not invalidate any other system of oppression. According to my current understanding, racism is the most burning topic and it's essentially underlying everything. In addition, I'm part of the oppression, the dominant group - not the majority, bear the difference.
I stopped many things I was working on before. Personal challenges and other opportunities I've committed to. They felt just not as important anymore, and they aren't. I might pick them up again some time. Three months ago, I finally started a learning and growing path that was long overdue. I wanted to become more aware of what racism really is and how it works. I wanted to act on this increasing awareness. I did not want to share before I acted. I felt it was not the time to talk about doing things, it was time to actually do things.
Well, I did share this journey and my intention to write this blog post with a few selected people. One of them was surprised I changed my usual approach to tackle challenges: set my goal, design an experiment, announce it publicly to keep myself accountable, at best coupled with having a learning partner. This is how I approached all my big personal challenges of the past years and it worked really well for me. This time, though, I felt I needed a different approach. Of course, these are only a few steps on a lifelong journey, not the end of the story or legwork to do. Still, I wanted to share my experiences - actual experiences, not something I planned to do.

Now, when I write above that the events in the USA moved me to act, I find it sad that this was the trigger to open my eyes a bit further and stop postponing this topic. Let me be clear: it's tragic what happened and is still happening every day. It's tragic that I was aware of systemic racism for some time, also in my own country. It's tragic that I kept putting all the recommendations on resources I received on my list of things I still need to look at, and then always gave something else the priority over it.

What I Did to Learn More

Just doing what I did to gain more perspectives already got me changing my behavior, tiny step by tiny step. There's still a long, long lifelong way ahead of me, yet this moved me a lot more further than idling on the topic like I did the past years. Let's also be clear these are just the things that I decided to do and did already. Your list can look completely different. The important part is the actual doing and continuing with it.

I'm eternally grateful to all those people out there doing the hard work of recommending resources as well as creating these resources. All these helped me massively grow my own understanding. There's a whole lot more out there, I'm just starting out and will add more on my journey.
  • Diversified my Twitter stream further, especially the subset I'm following on a more daily basis. I want to learn from experiences that differ from my own. I want to amplify voices that need to be heard and aren't heard enough yet. I'm aware that this is a bubble and will continue to be my personal bubble, yet I still can deliberately make it bigger and include more people to learn about their lived experiences. I started to follow a whole lot of people I didn't know before, especially a lot more Black people. As tech is my context and the context I'm using Twitter for, these are mostly Black people in tech. I have to say, such a simple thing as this had a huge impact on me. So much food for thought - and for action. Diversifying my stream is continuous effort that's so much worth it. Want to get started yourself and you're also interested in tech? Then discovering people using the hashtag #BlackTechTwitter is a great starting point. Personally, I'm really grateful for the work of all the Black and brown people who spend the energy to share their thoughts on all kinds of topics. There are so many more so you better do your own homework, yet here are some of the wonderful people I'm learning from.
  • Read the book "So you want to talk about race" by Ijeoma Oluo. I have to admit many people in my bubble had recommended that book ever since it came out, and I've put it on my reading list back then. Shame on me: more books got added to that reading list. And always some other book got my priority over this one. Better late than never, I finally read it. This book is very insightful and us white people should educate ourselves by learning how racism is systemic in nature, how it manifests in our everyday lives, how it impacts us very unequally. Some parts I was aware of, many other parts not yet, and the stories shared helped opening my eyes further. If you haven't read this book yet - stop what you're doing and get to it. Too busy? For me that was a mere excuse. Think about it: can you afford ten minutes per day? I cannot know your lived experience, yet for me that question led to my resolution to finally do it.
  • Checking my own privilege regularly. Ever since I started attending international conferences, I started learning about my own privileges, becoming more and more aware of them. I'm still learning a lot about them every day. Reading Ijeoma Oluo's book now finally triggered me to write them down, review them on a weekly basis, and keep that list living. Wow. This exercise is mind-blowing. I thought I knew a lot about my own privileges. Already on the first day I listed 47 ways how I am privileged and which impact that has. Within three months after I started this exercise on June 8th, I've now documented 107 more, which sums up to a total of 154. 154 distinct ways how I am privileged that I am aware of today! I'm at 154, and still counting. I'm very clear I'll discover many more on my journey. With any further resource I came across, or any casual conversation overheard, I realized more privileges. Now let's be clear - being privileged does not mean I automatically have it easy or I am not suffering or hurting or anything. It simply means I get a headstart by benefiting from unearned advantages that I didn't do anything for to get them, while less privileged people are actively hindered by the same which represent themselves as unearned disadvantages. While I'm not actively hindered by the system, it's made a lot harder for them. Remember: 154+ ways life is easier for me. Every single day. Also: this is not a competition about who got more privileges. It's about learning how much more we need to become aware of. I considered sharing this list publicly to provide an example, yet these points contain lots of sensitive information about me. However, there are lots of examples out there, an internet search will reveal a great starting point for your own list. As soon as I started writing my privileges down, I noticed I listened more to the realities of others. Whenever someone mentioned something about themselves or I read about something, I took a mental note: "Yes, yet another privilege I have. Oh, and this. Yep, put that one also on the list." When it comes to my achievements, I definitely put in a lot of effort myself. But the thing is, I did nothing to deserve my starting point that sets me at a huge advantage compared to others. Opportunities, access, sponsorship, mental and financial support - I had so much of it. I can only hope paying this forward - in an anti-racist way. For example, by sponsoring people with less privilege, shining a light on them and getting out of their way. Feel you should check your own privilege? Besides Ijeoma Oluo's book, here are more great resources to help you get started.
  • Listened to the podcast series "Seeing White" by Scene on Radio. This was recommended by Kim Crayton as required history lesson when it comes to race and racism. I cannot recommend it highly enough. Each episode of this podcast series enlightened in a different way, allowing to see things in a different light and from a different perspective. It was so good I also listened to all other seasons of Scene on Radio as well, they're amazing pieces of education. This is the only podcast I've listened to all episodes, ever, and the one I learned from most.
  • Talking about systems of oppression, especially racism, with people I know. My circle of influence. This was and is still scary for me, although I don't have much to fear. Yet doing so, step by step, is truly enlightening, too. I started with people closest to me whom I consider family. I continued with dear colleagues at work. Trying to work from a rather safe zone to increase my circle. All these conversations were worth it. Some triggered further thoughts in myself. Some triggered further thoughts in the ones I talked with, only for them to come back and us having new conversations starting from a different base. I feel this is a place to stretch myself a lot more still. Step by step, continuously.
  • Set up regular financial support for initiatives focused on increasing diversity and inclusion in tech. It took time to research all those great projects going on doing anti-racist work, so many of them worth funding and donating to. In the end I decided to go with the following: a monthly donation to Black Girls Code and Project Include as well as signing up for a membership with the Hustle Crew. I feel all their work is dearly needed for a better future.
  • [Detour: Read the book "White Fragility" by Robin DiAngelo.] This was another book I already had on my reading list for some time. It was brought to my attention again when Kim Crayton explained why she does not recommend this book for anti-racist work. It's about unconscious biases, not racism. I decided to read it with having Kim's advice in the back of my head, hoping to learn identifying these things myself better. Still, let's be clear - it was a detour. I decided to mention it here as it was recommended a lot. Yet it is not the time to focus on the white experience. If you would like to learn more about racism and anti-racist work, this book is not on the list.
  • Watched the documentary film "13th" directed by Ava DuVernay. An extremely enlightening close look at what happened during the last 150 years in US history. Why had certain political decisions been made, which language had been chosen, how the dots are connected. Not growing up in this country, my perspective is that of a foreigner with little pieces of the puzzle here and there. This film helped me fill a lot of the gaps and see the system a lot clearer. It's still very active today, just changing its shape whenever needed. Thank you Angie Jones for making me aware of this great piece, and the next one as well!
  • Watched "When They See Us" directed by Ava DuVernay. What a powerful story. A true story, lived experiences. For the first time told through the eyes of the ones who got oppressed, the victims of a system. If you haven't seen it yet, stop what you're doing and watch it right now. I don't want to spoil this powerful story telling. If you have a chance, watch the bonus session included where Ava as well as both actors and the real humans they're embodying get a voice in the Oprah Winfrey show. Be sure you're in a good place when you watch this or not watch this alone. It's moving to the bones.
  • Took the course "Introduction to Being an Antiracist" by Kim Crayton. Kim offered (and still offers!) anti-racist training for all kind of time zones around the world. I definitely wanted to learn from her and listen to what she has to share, so I registered. Unfortunately, I couldn't make the live event, so I watched the recording and it was still so much worth it. So many things needed to be heard. More pieces falling into their places! So I registered for her next training "Being an Antiracist at Home" and am once again learning a lot from it. Very insightful and thought-provoking. Made me register for the third part in the series as well: "Being an Antiracist at Work". I'm very much at the start, yet I want to keep moving.
  • Read the book "Was weiße Menschen nicht über Rassismus hören wollen: aber wissen sollten" by Alice Hasters (German). After educating myself about racism and history of other countries, especially the USA, I felt it was way past time to learn more about racism in my own country: Germany. At school we do learn a lot about the times of national socialism, a still very recent and crucial part of our history, and I'm thankful for that education (more than I was as a pupil). Yet these history lessons, as everything taught at school, were heavily biased and did not really include many perspectives. What about politics today in my country? Well, things could be a lot worse, yet it's not all shiny at all. I felt I was missing out on a lot more perspectives and really wondered: what about racism in my own country? How is it to be Black in Germany, today? That question alone is telling enough. There's a lot more than I am aware of. So I did my research and picked Alice Hasters' as my first book out of many. Once more my eyes opened further. Wow. Things that I already got aware of, told by a different human, and so many things I wasn't aware of at all.
  • Joined Hustle Crew's webinar "How to navigate race discussions in your role". Signing up for membership also provided me access to lots of great resources, advice and a monthly member workshop. I took this first one and was glad I did! It was great, having a close look at our implicit biases from yet another perspective. I joined a second session and signed up for more. These people are wonderful and I have so much to learn from them.
  • Took one of Project Implicit's implicit bias tests. This university research initiative was recommended by Hustle Crew as a way to figure out our own biases and how bad they really are, no matter how much we try to act against them. I was eager to give it a try and did a first one of many available to see how they work. I've started with the "Skin-tone test" and was confronted with the result: "Your responses suggested a moderate automatic preference for Light Skinned People over Dark Skinned People." I know this is rooted deep inside me and I grew up internalizing this system - yet I really want to change this. A lot more such tests on various subjects are waiting for me, too.
  • Read the book "Sprache und Sein" by Kübra Gümüsay (German). My next move to educate myself more about the reality of people in Germany who are not considered the norm and hence we find names for them to explicitly point them out and inspect them. This book elegantly shows how important language is and which impact it has. Free speech? Really free speech will still take a long time so we better make our next moves on this journey. So much food for thought in this book.
  • Started a resources page on all things inclusion. The past months I've read a lot more about the subject and had so many resources I found super valuable and helpful to open my eyes further, to find new perspectives, to see different realities. It was about time to collect the most valuable ones and make them available for everyone on my blog. We are working together with people every day. We are living together with people every day. We better learn how to include everyone better every day instead of just staying comfortable in a system convenient for us as we white people tend to do. The collection is meant to be a living one, so expect more resources to be added.
  • How I want to continue? Reading more, watching more, listening more. Decentering whiteness. And don't stop taking action.
I am struggling with not centering myself in this narrative. Guess what - I've written about my own perspective in this blog post. Yet it's not about me and my feelings or anything. It's not about me being a bad person. It's not even about me trying to do better these days. My experience is not the point here. It's about systemic oppression that we white people keep reinforcing as we benefit from it and about those people who suffer because of it.

Go out there. Look for those humans with different experiences than your own. Become aware of the system supporting it. Go inside yourself and see where you're supporting this system and keeping it alive, passively or actively. It's often in the "little" things, the casual everyday things, the things that are repeated a million times. These things can have a huge impact - if we change them to the better, then this impact can be a positive one.

People are dying because of existing systems of oppression, because of racism. People are hurting from thousands of microaggressions every day. It's so not about me or any of us white people feeling comfortable. It's about actively dismantling racism and doing anti-racist work.
One of the worst things I realized on this journey is this: for me, it's a decision to learn about racism, to feel the discomfort and stay with it, and to grow my understanding of how to do better. For most other people in the world it's not their own decision. It had been decided above their heads. It's their daily reality and lived experience. And here I am coming and "finally" deciding to face this. I am guilty and very much deservedly feel guilty. I hope my own drive to change the world for a better place adds to this guilt, and both forces make me do better. 

Am I an anti-racist? As much as I want to be, I can't. This is not something I can become or label myself with. What I can do is to continue doing the work. Anti-racist work. Every day. I do want to stop supporting the system and I need to be doing this very actively. The actions I took so far might be a start, but there's continuous work to do.

Where I'm Coming From

If you've been reading this far, thank you. I hope you got some inspiration for yourself how to educate yourself and do better. You could stop here. Yet if you also want to know where I'm coming from, my personal context when it comes to racism, then read on.

I am starting to realize further how I grew up internalizing and therefore supporting a system of racism. The picture is becoming less blurry and I feel there's a lot more to discover here. Care for some examples?
  • All those messages I soaked up during childhood from systemically racist novels or children's TV shows only telling one side of the story. I didn't realize Black kids were portrayed like this as they were meant to be "exotic", not "normal" like me. Several of my favorite children's books? "Questionable" is a euphemism for them. One of the most popular children songs of my time was about Black children dying one by one, until all are gone. Wow. One of the most popular children's games when I grew up? It's called "Wer hat Angst vorm schwarzen Mann?", literally meaning "Who's scared of the Black man?". Not joking.
  • Messages from my family who warned me about racially mixed relationships as they would be "difficult due to cultural differences" and hence not worth the trouble. They meant well, I get that, but these were the messages my parents internalized as post-war children and the ones they passed on to their own children. Remember? It's not about intentions, it's about the harm caused.
  • Messages from school, even in elementary class, where it was made very clear who was "meant to be here" and who was a migrant's child and hence foreign forever and usually troublesome from a teacher's point of view.
  • More messages from school about German history, especially the recent past. I'll be eternally feeling guilty for being German, I always wished for another nationality. Patriotism? Never felt that. Waving my country's flag? No way I'm ever going to do this. At first, I was glad that we really covered the national socialist period and World War II in large detail at school. Having this topic return every year in even more detail, I felt haunted by it so at some point I rejected learning more about it. We had nothing to do with it after all, right? Well, that's way too easy. Nowadays I'm very grateful we had that education while at the same time I know we're missing a lot of perspectives on the same time period. So, feeling proud to be a German never came to me. Only nowadays I keep learning how many benefits we have just from growing up or living here that many other people in other countries don't have. By the way, all this are social benefits. The social system here is far from good but can be a lot worse. And this once more shows how privileged I am. 
  • Messages from friends and their families, mocking me for my very light skin. Back then I desperately wanted to have darker skin; yet I'm pretty sure I wouldn't have liked to lose the advantages my skin tone brings with it. Being made fun of that I am so light-skinned that I glow in the dark was not fun for me at all. Yet I was still part of the dominant group here and therefore inherently safe; I will never be able to fully comprehend the lived experience of people being mocked for their skin tone when they're not part of the dominant group; how much this hurts. Only these days I'm starting to gain better understanding what privilege my light skin brought and still is bringing with it.
  • Growing up as a teenager during the 90s, I received lots of messages about Black people from music, TV shows and movies. Going into just this area alone does reveal so much. I won't go deeper here, but there's a lot to uncover.
  • Let's jump to my time at university. Many people know I studied sinology as it's part of my speaker bio. Nearly no one knows I also had two minor subjects: computer science and - here it comes - intercultural communication. Back then I felt that this subject indeed was the most valuable and hands-on one of my subjects. I learned about concepts like "positive racism" (this is an oxymoron, racism can never be positive), transgender people, and more. This all opened my eyes to misconceptions I've held before. Yet as all these messages were deeply biased themselves, and even outdated at that time - and they probably fostered so, so many more biases. Today I'm quite scared to open the most famous study book from back then. One day I will.
  • First job after university. I was finally "one of the guys"! And loudly telling everyone my belief that we've solved the gender issue in Germany. Discrimination didn't happen to me, didn't it? So surely, it's solved for everyone. Oh my. I was the only woman working in our small start-up's development team. And there was discrimination indeed - yet truth be told, I often benefited from it. This wasn't so bad, right? All good! Well - nope.
  • My first conferences. Attending international conferences was one of my biggest eye openers. I had been working in very multinational and multilingual companies before and was always proud to be in such a "diverse" environment (well it was indeed a lot better than many other places all my friends told me about). Yet at these conferences, I've finally learned about different realities, sexism, and especially my own privilege in so, so, so many aspects. It took me years to come clear how much support I received throughout my life, not deserved or based on what people like to call "merit", just on mere access, chance and people who made me visible. While all the time the human that's closest to me did not share these privileges. I had it right in front of my eyes. Denial is strong.
  • Finally, I started seeing more things - and once I saw a thing I couldn't make it unseen. With every insight I learned from people who already saw more than I did, with every realization how people get systemically hurt, every racist joke I heard people laugh at, every more "guys" shouted by company leaders, every casual slur about "political correctness" - I felt I needed to speak up. With all my privilege I was - I am! - in the best position to do so. How not to stay that coward that I was so many times? How to become someone who people can truly rely on as an ally? How to fight for a better world? How to do what's simply right? For a long time, I wanted to be someone else. Badly. The more "exotic" the better (sigh, I cringe when thinking about this). Someone special, someone to talk about. Someone who's a cool kid. Someone who is brave. Someone from foreign countries, someone from my fiction books, someone saving the world. Now I know I can only be a better version of myself, and that's all I want these days.
These are just examples. I knew that racism is systemic for quite a while. It's way too important to ignore, and I'm not proud that I've postponed and de-prioritized this for way too long. Yet enough is enough, it's due time to become really uncomfortable.

Closing Thoughts

I got socialized into a racist system. It's institutionalized, systemic, everywhere. We can't run away from it or deny it. 

This post is composed of my own reality together with what I learned from dear people kind enough to share their own stories or recommend valuable resources. I am fully aware that what I wrote might be - most probably is - flawed and can harm someone. In the end I grew up in a racist system, a system constructed by white people like me, a system I supported and benefited from (still do), a system that kills people and needs to be torn down. I want to use my own privilege and speak up. Continue learning how to do anti-racist work every day and grow from supporting this system to actively dismantling it. Attempting to change the world and start with myself for the better of everyone. I will continue learning.

This is for everyone. It's on me to do better.

Sunday, May 17, 2020

#SecurityStories: Using OWASP Juice Shop for Teaching

Have you heard of OWASP Juice Shop? It's a project that's very dear to me and helped me massively over the last years.

Johannes Seitz was the first one who introduced me to this intentionally vulnerable application used to practice security testing hands-on. He facilitated an open space session at TestBash Munich 2017 with it, and I got hooked. Dan Billing also used this great application in his tutorial at Agile Testing Days 2018. I personally used Juice Shop for security testing workshops at my own company since beginning of 2019.

What I like about Juice Shop is that it's a full-blown application. It's working, and it's vulnerable. We can safely practice lots of techniques, whether manually or having automation support us. You're also not alone, it offers guidance in case you need it. What I love most of all: it's based on gamification, offering many challenges on various difficulty levels. The first challenge itself is to find the score board to get an overview on which tasks are there and what's your progress! Although I know that attackers would approach a productive application differently, the gamification approach is very appealing to me. It's simply fun and draws me further from one challenge to the next.

This kind of gamification also worked well for the people I've had in my workshops, introducing them to security testing. Challenges can be taking time and be quite frustrating - yet when you finally solve them, the moment of epiphany and heureka is invaluable and very memorable. In these workshops, I've also seen people learn how to make more use of tools when testing, like the browser's developer tools or REST clients. Despite them having used these tools before, Juice Shop triggered them to discover more possibilities and features they weren't aware of yet. Also, people shared lots of knowledge on how applications are built, which assumptions we make, which approaches we take.

My personal challenge this year is to tell #SecurityStories, so I thought of using Juice Shop again for teaching. Parveen Khan is currently on a testing tour and asked me to join her for a session. She knew about my #SecurityStories challenge, so we thought it's a great match to pair on security testing. Once more, Juice Shop it was.
I believe that pairing on Juice Shop challenges (or the like) will result in deepening my own understanding by sharing the concepts and approaches I've learned.
I know I'll have succeeded when my pair learned 3 new things from me.
Just around that time, a new shiny Juice Shop version got released! Perfect. In our pairing session, I helped Parveen set everything up and we also tackled the first challenges together. As I already knew the solutions, I held back with my knowledge not to spoil the experience for her. Instead, I led her through only nudging in certain directions, waiting for her to ask for hints. It worked! The first challenge was the hardest - it's a whole new application to get to know after all. Once getting the grips with Juice Shop, Parveen solved the second chosen challenge a lot faster. It was really fun doing this together with her! At the end, Parveen shared with me what she learned from this experience hat was completely new to her.
  • She knew how to look at information in the browser's developer tools, yet now she learned that she can also do something with it and how powerful these tools really are.
  • She always thought that security testing needs a hacker mindset and JavaScript knowledge and therefore concluded that she can't do that. Now she saw she can take first steps into security testing herself indeed and solve challenges to learn more.
  • She shared she never had much interest to learn about security, despite knowing that it's important. After having fun with Juice Shop, she's now open to learn more.
  • She learned that she could do security testing together with another person to have more eyes on the problem which makes things easier and more interesting.
  • She realized she forced herself to think in a different way, and she will always remember that. It was great to get through the experience without me giving away too much.
So I'd say, my experiment worked out well! This experience taught me once more how useful Juice Shop and security testing in general is to teach knowledge that also helps us in everyday testing life: understanding how applications work, what we need to check for under the hood of a shiny interface, which tools can help us, and more. Security testing is combining so much knowledge, learning about it is super useful for anyone involved in product development. This fit very nicely to my findings from doing security testing workshops at my company.
I could have stopped there when it comes to Juice Shop. However, there's something that bugged me. Despite knowing Juice Shop for quite a while, and frequently using it for teaching purpose, I haven't solved nearly as many challenges myself as I would like to. I decided that now's the time to change this. So here's my next experiment.
I believe that working on Juice Shop challenges, alone or with a pair, will result in increased confidence in my own skills.
I know I'll have succeeded when I've solved all challenges below 5 stars.
This fits well to what I learned during the AppSecDays: I need more hands-on practice. Off to new frontiers! Want to pair with me on this one? Feel free to reach out