Friday, August 16, 2024

Contributing in New Ways - Getting over the Hump

This year, my personal challenge is to contribute in new ways - courageous community contributions I haven't dared to do before. As opportunities arose, I took on a bunch of endeavors beginning of the year, which are both very exciting and, admittedly, time-consuming. While I've been aiming to share intermediate updates from time to time, I'm grateful for my past self deliberately decoupling my challenge from any writing efforts to reduce artificial pressure. Still, it does help me to sit and write down my thoughts from time to time. It's time now.


A Lot to Celebrate

It's been a lot to juggle this year. Well, I realize I've set myself up for that. It's one of those self-inflicted situations, which might be uncomfortable yet also come with a bright side: it's totally up to me. I can reduce things at any point in time. Or shift my main focus between endeavors. Right now, this is working out sufficiently well so that I didn't have to cut anything completely yet. In addition, there's an even brighter side: no matter how the rest of the year plays out and what else will happen, there are lots of things to celebrate already.


Open Security Conference

It's happening! It's actually happening. The very first Open Security Conference (#osco) will take place from October 4th to 6th in Rückersbach, close to Frankfurt/Main in Germany. The event will be kicked off by two amazing keynotes before we then all learn together in the open space:

  • "OWASP Juice Shop 10th anniversary: Is it still fresh?" by Björn Kimminich, who's well known as project leader of the OWASP Juice Shop and a co-chapter leader for the OWASP Germany Chapter
  • "How to hack a company in one day or less" by Yvonne Johnson, who's an experienced red teamer and penetration tester

I'm so very curious about how the first osco plays out. A first event is always exciting! You're trying to set the space and constraints in ways to support your values and your goal. What of it helps and what rather hinders is something you'll only find out when you give it a go. We are starting small and learning as we go indeed. We've already gained lots of insights during the preparation so far. We can't do everything we'd like to do for the very first event, and yet it's a starting point that sticks to our principles and is based on our values. A starting point that hopefully helps establishing this new conference so we can build on it and evolve it further over the next years. Because cybersecurity is just a way too important area that's too often struck by gatekeeping and other barriers we're trying to lower and remove where we can to make it more accessible - for everyone interested.

We gained a better understanding on our individual and collective reasons for doing this in the first place, why we think there's a need and a gap to fill, what makes this conference special to set it apart from existing events in the security space. Not only for marketing osco and figuring out our target audience (which is a real challenge!) but also to make even more intentional decisions to shape it further. We'll continue to iterate on how we present the conference vision, just as we'll also continue learning to spread the concept of an open space conference format to cybersecurity which lots of folks seem not to be familiar with yet. Well, for now - we'd like to do our part in changing that!

As an organizer team, we had a tough challenge to overcome. We weren't quite clear on the direction to take on how to handle finances, which paralyzed us. Not much happened during this time besides going back and forth pondering about our options and worrying. It felt like treading water. I think it speaks for our group that we didn't break up at this point, that we indeed got over this hump and we came out stronger together. We made a feasible decision for the initial event this year and paved the way to create an underlying non-profit organization to sustain the efforts for next year.

Solving this big bump in the road meant we picked up speed again. We could finally open the registration, and we already have more registrations for this first event than we dared to hope for! There are still a few more tickets available, so if you're interested in participating in our inaugural event, go ahead and register now! And if you like what you read and want to help us spread the word on either LinkedIn or Mastodon, I would appreciate it very much.

I'm really grateful for my organizer team to be on this journey together: Claudius Link who came up with the initial idea, Janina Nemec, Ulrich Viefhaus and Dave van Stein who considered it a worthy cause to work on together. I'm also grateful to all supporters on our way. We had several initial thinking sessions, like with Tarik Kobalas, Jahmel Harris, Dan Billing and others. Several people contributed with lots of advice based on their expertise, like Mathias Verraes on organizing conferences, or Raphael Albert on the legal side of things. My thanks to all of them.

We're still learning lots of stuff and we won't get everything right from the start. We observe and listen to feedback, we adjust what we can right away, and we take note of what we can do better next year. That's what makes me hopeful that we're coming to stay.


Leadership Workshops 

Shiva Krishnan ran his series of leadership workshops many times in company settings. A few years back, I was fortunate to participate in one of his cohorts myself and got hooked - more people needed to do this program that I was drawing from so much! So I paired up with Shiva and we ran the next cohort together, until I changed companies. Thinking back, I'm still using those tools and ideas until today, and still continuing learning. Shiva and I kept in touch and thought about how we can bring this offer to community. Talks, writings, all good but not the same. How about bringing the actual cohort idea to community?

For a half-public first experimental community cohort, we reached out to our networks to find people who give us enough trust to get this started. We had first calls to present the workshop series, manage expectations transparently (it's a whole program after all and no small commitment), and answer any questions that came up. That alone already taught us quite a lot of what might be different for community cohorts compared to a company-internal offer. 

We indeed found a great cohort of six people who agreed to join us on our journey of bringing these workshops out there. We set up foundations like a shared communication channel with folks, clarified feasible lengths and frequencies for our remote sessions next to everyone's work. Everyone was eager to get started and looking forward to this endeavor. All we needed to figure out was scheduling now to run the first workshop.

Oh my. "Just" the first time slots. We knew scheduling is not the easiest task when it comes to these workshops, we've seen that in the company setting, yet always managed to find good solutions. Phew. What can I say, we really did not expect it to be that much of a struggle. We're only eight people. And yet, all our schedules differ in ways that make it really hard to find any overlaps. Like, any. Each time we thought we've now found a solution, more obstacles got in the way. And time keeps running. We brought everyone together to solve the puzzle, we made judgement calls and a few tough decisions to make this work. 

Let's see what happens with our latest option. In the end, we might need to rethink our whole approach. It's an experiment after all, and we're still learning from it even if it might not turn out what we planned it to be. But yeah, scheduling such a workshop series when you're all working at the same company, and you have the buy-in of people's managers is a lot easier. By far. We still hope there's a way that people can also benefit from the content and format of this series in the community space. In any case, we're grateful we got that far, and we definitely learned a lot which hopefully helps us in the future to bring this content and concept to a wider audience.


Security Card Game

This is probably the most relaxed of my endeavors. Martin Schmidt, Philipp Zug and I are trying ourselves, and absolutely enjoying ourselves with creating a new security-themed card game. Taking it as a deliberate practice project, we're learning a lot just thinking about it and evolving it further.

The game concept evolved quite a bit from the very first paper draft. We already played it several times with different variables and rules and gained more insights each time. We have both game engine and user interface to support our current ruleset, lots of cards already added, and it's honestly just providing us a good time. It's not balanced well yet, the game goal needs refinement, more content would help. We are currently only playing in collaborative mode all together, while having ideas for the future to simulate different company scenarios with people taking different roles to advocate for different strategies, maybe just going about their own (hidden?) agenda, or secretly sabotaging everything from the inside. Lots of potential paths - because in the end it's a game about decision making.

So, what is it about? You're employed at a fictive company. As time passes, you gain a certain number of resources available for you to invest in one way or another. Also, as time passes, more and more "oopsies" happen from a security point of view - a password got leaked, a vulnerable dependency wasn't updated, an internal website became accessible to the public. Do you close those doors to make it harder for attackers, or do you risk leaving them open for a while? At the same time, attacks are attempted by malicious actors. Sometimes they hit one of those open doors and you have to pay the price. Sometimes attackers don't find a target, or get impatient, or you just got lucky so you can counter the attack. All the while new employees need to be onboarded, security training can increase your skills, or it's just a normal day without anything bad happening. How do you make it through, will you still have resources left at the end? And how many oopsies did you leave unattended?

Well, curious? Just give it a try yourself! Get our latest release 0.5.5 and check out the current rules to get started.

Our next step is to share this game with more people at SoCraTes - we are fortunate that we can meet there again in one week's time already. It's the place where this game idea saw the light of the day in 2023, so it's going to be awesome to return a year later and play it with folks. I'm sure we'll be able to gather lots of feedback and future ideas for our game project. And hopefully people have a fun time with it, just as we do.


Snack Shop by Make-Believe Labs

Ben Dowen, Vernon Richards and I set out this year to fill a gap. We wanted to have a full-stack, open-source practice platform for all things product development. One that resembles real work scenarios close enough, with challenges people actually face so that gained skills could be applied. One that provides a safe space to hone all skills development, testing, architecture, UX, infrastructure, security, accessibility, you name it. One that offers opportunities for us to make use of it in teaching and coaching situations, e.g. for conference workshops and trainings. One that we could use to showcase collaboration dynamics, from ensembles to pairs to individual asynchronous work - both in live streams as well as through the artefact trail that we're leaving behind. When working on the project, we had good fun leaving a deliberate trail at times, sometimes showing rather commendable, sometimes less ideal behavior, so we can make use of them later.

What we're building is project "Snack Shop", a client project that the fictive company "Make-Believe Labs" took on. It's based on a brief from the owners of a bricks and mortar snack shop, who want to take their business online. Taking on various roles, we're working hard on a proof of concept system that we hope they will love.

The snack shop is composed of three services as of now:

  • A web frontend for users to interact with the shop, using React, written in TypeScript
  • A backend for frontend, often called BFF, to serve as single public gateway and orchestrator to various backend services - using the Nest.js framework, also written in TypeScript
  • A SpringBoot Kotlin backend service connecting to a MongoDB

What we're having as of now is a so-called walking skeleton. All components are running on their own and are integrated. It’s walking, and yet it’s still a skeleton. There’s a lot of work to do, and yet we can evolve it iteratively.

The first goal was to create a typical proof of concept. We were starting out rather well, taking deliberate architectural decisions, taking time documenting them. Then we received a first due date - and the rush began! Tradeoff decisions made it in just as they would in real life. A due date works wonders in cutting corners! Okay, we did that deliberately, and yet! We see what happens. We have pull requests that were sneakily just merged without communication, we have changes that do a lot more than what they claim, we have faulty descriptions, we have long waiting times for asynchronous work, we skipped good practices like test automation, input validation, and a lot more. Well, we took on this scenario and played the roles, yet I admit I felt those feelings myself. It was both fun to see patterns play out I've seen so many times, also in myself. Indeed, a real practice project! Oh, and yes we also had lots of good behavior and great collaboration, don't you worry about that.

What caused that due date? Good thing was we had a real one, which indeed pushed our project forward in the end. All thanks to Ben who was invited to the Automation Advocates meetup, and extended that invite to us. We chose to use our own new project and work on challenges together. In front of a live audience. For the first time. Well, the right kind of scary that really lets you grow! Not everything worked out, yet we felt we still did alright for a first time, and we learned more for potential future sessions. Because we want to do more of those live sessions. By then, the project will have evolved as well.

All in all, it's really evolving, slowly, and in waves, but steadily. And it's just fun to work on, practicing deliberately.  Ben is currently preparing for his next conference workshop "Coding Challenges: Prepare for Success in Technical Interviews" for TestBash Brighton where our project will make its second public appearance. If you have the chance, check it out! Personally, I'm already curious what he'll learn from that. Overall, I'm eager to get back to our Snack Shop once I'm on top of another topic I currently focus on. I'm happy I can be flexible to follow my energies here, plus I love that I always gain energy from our ensemble sessions.


Conference Sessions on Security

It's been a while since I started speaking at conferences. At times I look back at how many speaking engagements I already had and am both speechless and grateful. It's really been a ride so far, and I wouldn't miss it! So, while speaking at conferences is not a new thing for me, speaking officially and publicly about security topics certainly is a new contribution.

I'm very pleased to share that I am giving four different conference sessions on security topics this year. All but one are brand-new as well! I'm still in awe and very excited. Already next week the next session is coming up.

Finally taking this step that I've waited for quite some time is a big thing for me. I've paved this way since my first security pair testing sessions in 2018, diving deeper every year, and I'm quite enthusiastic about it.

That being said, it's honestly quite a lot of work. It's already a huge challenge for me to create three new conference sessions in one year on any topic, and all those in this huge area... It's a real stretch. It's scary and I'll certainly grow. It'll work out in the end, as always - and yet it's making me as uncertain and nervously excited as I haven't been in a long time when speaking at conferences.

Just recently I've learned that there's even more to celebrate in this space, I got accepted for yet another speaking engagement which is not public yet. I can only share that much: a dream came true for me. I hoped it might happen next year maybe, and now it's already there. I'm still speechless it happened. And very excited!


A Lot to Reflect On

Once again, I noticed that, while I had to force myself to sit and write down all of things above, it really helps me. Having my thoughts sorted, written out, and put out there is a relief from a perceived overdue task, it provides me dearly needed clarity, and it is going to help my future me as well when looking back on what happened and what I did over the years.

Truth be told, listing all the above feels quite good, despite the effort going into making each and every point happen. But how has it been for me in the past months? I've taken some notes for myself during this time. I wish I would have taken more, yet it is what it is, and that's what I got. I still want to persist them and show the other side of it. So here are my rather raw notes, jotted down over time, to keep as a reminder to myself.


May

I came to the realization that accountability works well for me, especially when I don't want to let others down. Yet I always prefer those tasks where I feel I gave my commitment to someone else over my own endeavors, so I'll always feel guilty. And always behind. Did I set myself up for failure? Or for learning to let go and do less?


June

I got so busy that I neglected where I get my energy from: celebrating, taking breaks, games, people conversations and feedback. I dearly needed that reminder.

Now I focused deliberately on de-stressing - and it worked! I'm already feeling a lot more relaxed.

I also re-aligned with people - I really needed this and the energy gained from it. Especially rediscovering the joy. For osco it was really liberating to make that financing decision finally and get over the hump, this allowed me to also start advertising the event again more freely. It's really hard to promote something if you don't know if it's going to take place for real.

Following my energies always served me well - just do the next thing I think of and can do right now. Taking small steps. Feeling good.

My new laptop also encouraged me doing something for the current projects, making it very easy and quickly accessible. It's a great side effect to have the nice combination to have various platforms available now for testing out my projects on different setups. Also, I'm building on the energy of "this is new, I instantly want to do something with it" that I usually get from shiny new things.

Also: I'm finally writing again, journaling these notes. Well, I knew I was better at reflecting and thinking in writing! And I'm so used to write on a laptop that's similar to my working setup - very interesting insight.

Oh, and movement and games of course! I finally did something just for myself again apart from these challenges. It's been way too long.

More sources of energy to take note of: sleep, breaks, tidying up, games, movement, emotions, focus, more intentional social media time.

Due dates help unless they get overwhelming.

 

July

Ben and I set ourselves a due date: until the meetup we're going full in, setting things up - but minimal in every regard! Cutting corners and taking shortcuts, like a real team will have to do if they need to present the proof of concept. We even set ourselves a code freeze a week before (editor's note: we ignored it and did changes until the day before the meetup, obviously).

I'm so glad we did this! This really pushed me to contribute and get into coding again! All my previous jest and unit test and Angular RxJS observable knowledge came to play! Plus my new bff knowledge, all combined - very, very useful, already proofing the concept.

Today I committed lots of changes - and it only took me a couple of hours overall to figure things out I haven't done before yet, very proud of myself. The last bit to add a bff endpoint was only half an hour in the end, including everything! Probably even less.


August

Still feeling overwhelmed with all challenges although most things are more under control now - mainly the time factor is pressing on me. How to juggle all those balls I've sent into the air? I know the answer - I need to drop some and pick them up again at a later point in time. And while it doesn't feel right right now, that's okay and in hindsight it'll also feel better.

I also know I need to force myself to sit down and do things one by one. I know afterwards I will feel better. But sometimes I have to do everything else before I can actually make it happen and sit down and do the thing I'm dreading. Once I've started, it's way easier for me to keep going until things are in shape again. It's about that initial sitting down when I lack energy. Habits could help me, yet I don't have as clear ones for these in place yet. Today I had to force myself to sit down. And again, and again, as this post didn't write itself in one long session. It was still important to do.

I need to wait sometimes to have energy again. Do other things. Just watch a TV show. Dive into the Olympics. Rest as my body told me to. All while feeling that time is running, while knowing I won't get far without sufficient energy. Today I finally had enough energy to get a few things done, even though I had to push myself.

What I'm writing in my initial draft is not very coherent, yet I have to get into just writing again - I can clear things up later, even if that takes more time. First, I need to get to writing again.

Switching contexts is - surprise, surprise - draining energy. And too many tasks on different topics all having due dates drain even more. I've experienced the same here.

I originally thought of posting heavily on social media regarding updates on each single endeavor - and didn't have energy or wasn't sure as I'm not alone on any of these, and it was costing too much to align on everything. In the end I just didn't.

This year I've left out my "stop when you notice you neglect self-care" clause - and guess what? I'm not holding myself accountable. I have rarely played any games, not read much of my fiction. For physical health and strength, I often only invested rather the minimum although I wanted to get in better shape again this year. The most I did was watching TV shows as I wasn't able to do anything else anymore. Often falling asleep on the couch or over a book as well. Hard lesson learned: don't skip self-care, however it looks like for you. Ever. Life is short anyway. I need to make time for things I deeply love. Games, books, volleyball.


A Lot to Keep for Next Year

Several of my endeavors won't completely stop with my personal focus on them at the end of October 2024, they will reach into next year. And yes, I already have further ideas for challenges next year (as if I haven't learned enough from overdoing yet - I haven't). Well, I'm taking note of ideas and leave the actual decision to end of the year, as always. Only making a call once I have more information to make it a good call.

For this year, there's still more to do. I'm looking forward to getting over the next big hump as well. I'm sure I will. And I'm already curious what I'll write in my concluding wrap-up for this year's personal challenge of contributing in new ways.

Posted by at
Labels: , , , , , , , ,

No comments:

Post a Comment

Subscribe to: Post Comments (Atom)