Back to Building - A Quiet Fight and a Challenging Review

At the beginning of the year, I started another personal challenge. Same as I've done in many years. This year, however, turned out to be a challenge on its own. Truth be told, I really wouldn't have needed an extra one, yet here we are. Since beginning of the year, I've been quietly fighting my way through everything that's been happening. Now at least I've made it to the end of my intended personal challenge of the year. 

 

What was the idea?

As described in the initial blog post (that turned out to be the only post about the challenge in the end), the core idea was to get back to building software and solving real problems. Back then I wrote "We can't get out of touch with reality of building software. I've been in the trenches for many years, and I don't want to lose those building skills." And as with every skill you don't want to lose, it requires deliberate practice to hone that skill. I even wrote this: "We need to be okay with doing something badly in order to do it at all. Anything worth doing is worth doing badly - as long as it's not causing harm." 

My hypothesis was the following:

I believe that consistently investing time in building software will hone my skills to make problems smaller. I've proven this hypothesis when I've made at least 3 real-life problems smaller through building within 300 days. 

To prove or disprove the hypothesis, I designed an experiment that I called #Challenge321. 

For 3x100 days (aka 300), I dedicate at least 21 minutes of time each day into a specific topic, to build up momentum and a habit of spending time deliberately on what's important to me. That's why I call it my #Challenge321.  

The three topics were #100DaysOfBuilding (building software to make problems smaller), #100DaysOfMovement (literally getting that movement in for health and fitness), and #100DaysOfGames (playing computer games for pure joy and mental health).

Now let's see how things turned out for real. 

What happened?

For the first two months, I had momentum on all three topics. For building, I chose what to explore and tackle first, I made steady progress. I loved having the time and focus space each day to just dive into something, learn a tiny bit more and gain further understanding every day. Movement was covered through regular exercise, and I really enjoyed my frequent short gaming sessions.

Then life happened. Or shall I say conferences and community commitments? The first two months were already packed with session proposals to write and review, papers to submit, things to clarify with organizers. Then first submission approvals came in and suddenly everything became even more hectic. The problem: I had taken too many bets on too many things I really, really wanted to do. And then they came back positive. Most of them. And all had tight schedules and due dates attached. Plus, and that was my biggest mistake, all of this required me to create way too many brand-new conference sessions in very short time. One of these sessions was a paired talk, one that I would not have missed doing - yet it was a very close call for both of us to make this happen with very short preparation time. We rocked that stage, and at the same time it did cost us dearly. Besides that, I'm not even going to mention the countless other community commitments I made. No matter how often I had declined requests and opportunities this year or told people I could not make something happen or had to keep them waiting - the number of commitments I tried to make happen was simply too big overall.

Short of two months into my personal challenge, I had to make the hard call to stop it completely. I simply did not have any capacity left; I barely made it happen without the challenge. The only thing I kept on going rather steadily was movement. I had made that mistake before and I promised myself not to repeat this one ever again. Yet the other two topics for building software and playing games, they had to pause.

One thing kept coming after the other, the hamster wheel kept turning and I was just running, trying not to fall and keeping all balls in the air. One commitment followed the other. There was never a real break to catch my breath. Don't get me wrong, these were all endeavors I absolutely wanted to do. I knew the price and I was willing to pay it. And at the same time, it's been clearly too much. Plus, we may not forget everything else I had said yes to. Where I didn't want to disappoint people. Where I gave more energy than I had, for too long.

I took notes whenever I achieved another step on any of those three topics so I can see how things progressed over the months. For the building part, I stopped at the end of February and only picked it up mid of July again. Same goes for the games. But I decided to indeed continue the challenge instead of dropping everything. I had to put in a lot of effort, yet I did crack the 100 days for all three topics, curiously all on the same date: October 18th.

 

What's the result for each topic? 

For #100DaysOfBuilding, I started out by taking my time to set up a new project, making my decisions on what to build, why and how, and then building things from scratch. I quickly discovered that for a change, I wasn't focusing too much on getting results quickly and pragmatically, but instead for truly understanding what I built, the options I had, what they meant and what good practices to apply. And to my surprise, with the world going super fast with building stuff these days, I really enjoyed taking my time for once to really understand the underlying concepts, patterns and practices. Going super slow. Looking up anything I’m not familiar with. Building actual understanding and enjoying how it grew. Truly taking my time, not pressuring myself or rushing. And that continued until the very end. I didn't build much software this way. I did build my understanding. It's been an intentional tradeoff and I both like and dislike it. 

What did work out well for me was that I wrote a coding journal again, it really helped me formulate my intentions, track open questions, document resources and insightful finds. It also helped with being intentional with my decisions. Going through the journal again, I realized I had already forgotten a lot of the insights gained, yet at least they are there, I can look things up and recall them this way. I anyway have to do activities many times to fully grasp and internalize them. At times, I also did allow myself to follow rabbit holes before I led myself back on track. Slowly but steadily.

I had a bunch of initial building ideas, both for personal and work-related stuff. And yet, I stuck with only one pet project. Considering 100x21min (or more) I truly did not get far regarding the actual project. It would help to do those 100 days in a row for sure, not with such a big gap in between, and yet I still wouldn't have gotten much further. But learning the intricacies of a language through building and solving an actual use case is a great way for me to learn it through instantly applying concepts in practice.

Another realization is that tooling truly makes a difference for me. I tried to use a less familiar IDE in the beginning to learn more about it and see how it deals with the chosen tech stack. For the last 40 of the 100 days, I finally gave up and switched to another, more familiar IDE. And that made such a difference in how relatively easy things suddenly became. Good IDEs truly matter.

Finally, I'm glad I did this without outside pressure - I had way too much pressure this year to face that one on top as well. Would I have achieved more with that external public accountability? Probably. Also, I would have probably stuck closer to my original idea. Yet I wouldn't have managed that level of visibility along with everything else this year.

My #100DaysOfMovement was probably the most successful of the three topics. I indeed could recover a bigger range of movement, fix some of my issues that held me back from starting actual strength training and already gain a tiny bit more strength again. There are always fluctuations involved, yet I had clear signals throughout the year I'm going in the right direction. And I feel so much better as well.

When it comes to my #100DaysOfGames, I truly enjoyed those dives into the amazing worlds, gameplay and storytelling the games I had chosen offered. Especially in stressful times, just starting a short session helped calm my brain through focusing it on a challenging but solvable task and experience a story aside from reality. I draw a lot of energy from escapism, and it simply gives my brain a well needed active timeout. I just wish I wouldn't have had to pause playing games as much as I did - it was the same gap as for building, around 4.5 months. Once I picked up playing again, guess what, I was still under pressure but feeling a lot better again.

 

The conclusion? 

The hypothesis I had was clearly disproved by my experiment. Sad, yet that's the truth. It just didn't work out the way I hoped for. I did not make at least three real-life problems smaller through building within 300 days. I didn't do that for even one of them. This clearly didn't work out in the way I hoped for.

It didn't help solve actual problems. I built something to solve a non-issue. Did it help with keeping the builder mindset upfront at work? Doubtful. It only solved the actual problem of not knowing enough about a specific programming language and framework. Learning, yes. But I'm far away from solving the actual problem I based this idea on. 

Continuing like this as a side thing running over years would help in some ways. Yet it doesn't help solve my problems in the short term. For that I would have needed to choose a different mindset - a "raw and bad but good enough for today and instantly using my own thing" mindset. Instead, I chose a more theoretical learning journey. Through hands-on building, and yet. 

At the same time, it was nice to keep building and learning, and I can make use of those insights gained at work. Could I have sped up my learning? Maybe. Probably. Yet given the time constraints and my very limited headspace throughout the year? Not really. My learning works through actual sifting through everything, getting through frustrating periods, processing all the feelings doing so, finally reaching those aha moments of understanding, and repeating this over and over. And it works best when I'm calm.

The 100 days worked out in the end, yet they were not satisfactory. It just proved again that I am a creature of practice and I need to spend hours over hours with something to be able to make use of things. No shortcut, no way around it. Alternatively, I can choose to stay on the "user" or "reviewer" side of things, but that's a totally different approach to take.

The other two side elements of movement and games were the best part of the challenge. I really need to keep those going as they will help me keep my health and sanity.

I hereby conclude my Back to Building - Make Problems Smaller challenge. I might or might not continue this path, yet not in the same way. I won't decide that now when I'm still under high load but first tackle my other outstanding commitments and then take as much of a break as I can. Whatever comes afterwards, comes afterwards.

Back to Building - Make Problems Smaller

New year, new challenge! Wait, yet another one? To be frank, I did consider not doing a personal challenge this year and go with the flow instead. Things are challenging as they are, especially given the state of the world, and I'd rather focus on joy to counter-balance things while preparing for those very things getting worse. This thought popped up and vanished again. Because on the other hand, why not? I have too many things I want to do, and my yearly challenges help me focus on upskilling on specific topics. Therefore, I continued collecting ideas for themes during the last year and noted them down as they came to see how my thinking evolved. Here they are, as raw as they come with a few redactions. I've tried lots of different variations - read them at your own wish to get a glimpse into my head.

Well - likely it’s going to be preparing for any useful security certification. Or activism. Not sure if there’s going to be anything in between.

What I’ll keep up is conference speaking and organizing osco. Not sure if anything else, I need time and space also for newer things.

Last years had a social and a mental challenge - it's time again for a technical one!

Hack the Box (HTB) Academy, sharing publicly

Study security, would also give more content for sessions

Private challenge: art. Or fitness challenge, now that my body should be fine enough by then.

The year after it could be all around creation: build & art. Building with code mostly.

Other things I might focus on: read fiction, play games.

Build. Tools, code, that app and BFF and backend I wanted for so long. No need to share or talk prematurely. Just build and make errors and learn. Also: build my fitness. Maybe also: build my knowledge (e.g. HTB Academy). Could even be the osco community, it's on the radar as well. Maybe it's the theme that matters. Build it up.

Hypothesis: put in the time, regularly. And it will grow.

Not daring enough?

Maybe a fitness challenge indeed then. Definitely daring. Or gaming. Both. Don't know.

Study, get fit, prepare - 1 public, 1 personal, 1 private challenge

Activate. Re-activate.

Build a program per day.

Build. Build insecurely. Build securely.

Scaling. Finding ways to do things with less effort, higher impact.

Scaling slack. Both (scaling and slack) is super scary and I learned to avoid it. Both apply to both work and personal time, even sports. For security, private hobbies, even social impact.

Personal challenge: tech only. ONLY! Only hands-on. ONLY. No excuses.

Build mobile Android app with Node TS BFF and .NET backend service. Just that. Publish it. Like really ship, often. Then iterate.

That's it. No excuses. In general. Regarding tech. Exercising. Drawing. Games. Anything. No excuses.

Variant of bigger test app for all kinds of purposes (including actual usage in production): Android app with Node TS BFF and .NET backend service with SQL database and another Kotlin backend with MongoDB - for practicing different frameworks and also simulate microservices more realistically. Just that. Publish it. Like really ship, often. Then iterate.

Scaling might mean to use scary new tools and constrain them. Have a tool to extend my reach and speed myself up. Become not afraid to use tools and know what to look for and what to secure.

Have a scrapbook for my own learning. Have it visual for scaling goals and things to learn and certifications to do, etc.

Do it now challenge. Not postpone it further. Whatever it is. No matter if it makes sense or not.

Allowing myself to fail. And hence even try, no matter if I fail. I'll learn.

A new allower message: It’s okay to be behind and go at my own pace.

Only experience can give me experience.

Go at your own pace but keep on keeping on moving.

This speaks to me: https://mastodon.sdf.org/@Lichtenbergian/115673218133345093 making the way into the calm space to create in, through all the tasks around us 

It's not about what I do. It's what others do because of my actions. It's not about me, it's about the bigger picture.

Optimize for slack; to think, ideate, experiment, fail, learn, and scale.

Looking at all these notes, this year, there are many themes and none really stands out. For work, the theme of the year will be indeed scaling. For my personal challenge, here are many themes - with scaling overlapping with work:

• Scaling (impact)
• Slack
• Building
• Fail at my own pace and gain experience
• Certificate / trainings
• Societal change & activism
• Fitness
• Art
• Games

Scaling goes both ways - it's not always up, sometimes we need to go smaller. Especially for experiments and failure safety.

Interesting article: Do Things that Don't Scale

One challenge for me, for work, for society? Constraints: 3x sports per week, 2h games. Reading fiction and art as well or as options?

I'm usually falling back to busyness instead of doing the thing. Because being busy and having no time is familiar, comfortable, cozy. And that thing would require energy and is scary and I could fail.

No excuses. Do the thing. #DoTheThing

I see theirs and what they do and I feel jealous. Instead of also doing stuff myself. Especially bad when they say I inspired them to do x, and they outrun me with ease on the very topic. For many years, I defaulted to doing things together, to trick my brain to make time for things - yet then didn't do anything outside these times, and didn't dare much on my own anymore, feeling I needed the others anyways. Sharing frustration felt better than getting stuck on my own feeling, like it's me (and it was me indeed). Only very slightly and slowly recovered a bit this year (aka 2025). 

The main personal development goal: build the actual real-life use case app for both personal use and demonstration purposes I always dreamt of, tried two times and never fully dared to go all in. Would support the scaling through building scheme where I'm weakest (through community and education I've done already, building only super small). Would be hands-on, tech, development and security. On my own, as much as possible. Constraints: find time to play games, read fiction, meditative drawing every week. To have slack, give my brain space and joy for new thoughts.

My private personal goal is on fitness. Have a concrete target for strength, mobility, running, coordination - ask my coach what's feasible and makes sense for me. So here I would invest in movement, health, nutrition, sleep, everything. Also, it's been a long time since I've had a sports goal, it's about time again.

Both are just do the thing, no excuses goals.

CTFs would still be on the side without pressure, as I go - to learn. Or maybe even during work time. But not the one and only, as getting back closer to development is even more crucial for me. The testing one is nice for exploits though and demonstration. So this is just a supporting activity, not the main content. Maybe in 2027 I'll go for formal education and a certification then.

#BuildItUp #DoTheThing #NoExcuses #Scale4Slack #BuildTheScale #BuildToScale

The last one triggers an image: a stairway as a scale, to scale a mountain or wall, building it up to literally reach higher ground or more people for more growth and more impact

Fitness goal: stay pain-free & gain mobility needed for starting weight lifting (chest, wrists, ankles, etc.)

The joy of building :) tools, stuff, community, muscle, coordination, anything :) detracting the hardship or hurdles to even start

#ShowUp #BuildTheThing #JustBuild

Well now. What to make of all this? In the end, I believe I have a few most prominent challenges in these notes, yet they fit different spaces or parts of my life.

So I figured I first draw out what else is coming in 2026 for me.

• Speaking at conferences. I'm not going to stop any time soon. It's time to draft and propose new sessions, and if they get accepted, create them. This takes a considerable amount of time and is pretty public. If I do paired sessions, there's also collaboration efforts to consider.
• Organizing the third edition of the Open Security Conference. This is a collaborative endeavor by design, and very public indeed. I already know it'll take me some time during the first half of the year, and a lot of time during the second.
• Evolving the security card deck game. Fortunately, this is a low-pressure, deliberately slow-going leisure project. It's still collaborative, and it'll need time and care, yet this is one of the most sustainable endeavors I do.
• Practicing with my CTF team. Collaborative as well, yet nicely paced and spread out. As long as I don't overdo by adding an enormous amount of private practice, it's very combinable with the other endeavors.
• Communing with community folks. As every year, there'll be remote sessions with various people I got to know over the years. Some to check in, some to share advice or exchange experiences, some to work on something together. These happen all year long and they do take focus and energy, yet they are invaluable and they also tend to be pretty controllable as long as I spread them out enough.

Besides those personal development and community initiatives, there's work with its own challenges and measures. Mostly around scaling through education, building tools, and a security champion program (can't wait for it to start!). 

There's also a fitness and physical health challenge to reach: to increase my body control and mobility range so I can pick up barbell training again (and this will help volleyball and running of course as well). As long as old and potential new injuries don't stop or slow me down of course. 

Mentally, I need to keep slack in the system not to overwhelm myself once again, but to stay able to think and enjoy all the things. Play some games just for fun. Stuff like that. Yet something else would really help me move forward and get across a bump I'm facing again and again.

 

The Challenge

Keeping all of the above in mind, let's talk about the scary thing I want to tackle. I want to finally do the thing that I tried a few times but never gave the attention it would have needed. The thing that I started, then usually postponed, and finally dropped again in favor of other things. I want to get back to building software.

For a very long time, I wanted to build my own application. To use it myself and solve a real problem. To use it for demonstration purposes. Just to practice. I've tried with my #CodeConfident challenge. I tried together with others on the SnackShop during my Contributing in New Ways challenge. I tried countless attempts to get something started on my own, and dropped them all.

There's more to it. Every time there's a problem to solve, I come up with a solution and try it out manually. Now if it works, instead of building a helper tool, I tend to keep doing the thing manually - to be fair, which is often the fastest and pretty fine as long as I don't overdo. Only when I see there are aspects involved that make manual execution very unfortunate, like too much data to go through, or repeating a task too often, or it becomes too error-prone, I start building and automating. Usually with as little effort as possible to achieve my goal, e.g. writing a small shell script to just do the job. Trying to avoid overengineering where I can.

The problem here is not the smart use of time or experimenting with what would solve the problem (e.g. rather changing a process than making a faulty one faster). It's taking away opportunities from myself to learn. It's keeping me hesitating to just create throw-away scripts that solve one problem one time. To build a small service that serves one purpose. That might not be polished, and yet good enough for now. It takes away building up experience in building. Because sometimes the best answer is indeed to build. 

This is becoming even more of a problem now that I'm in a central enabler team where we do not develop a product ourselves - now there's no feature to implement myself or bug to fix to keep honing my building skills. We're only starting out on building tools and there's so much other (valuable) work to do that easily eats up all my capacity. It's also becoming more relevant now that I'm in my new role as security engineer, focusing on application security. We can't get out of touch with reality of building software. I've been in the trenches for many years, and I don't want to lose those building skills. (I'm aware there are lots of other building skills I'm still exercising, like building teams or communities or cultural systems. Yet software development is still core.)

So, back to building it is. That being said, what I cannot take this time is too much pressure and too much collaboration effort. I have both already covered with my other endeavors. For this challenge, I will choose to build on my own and in private as much as possible, yet build. I'll probably again take notes in my own coding journal - privately. I might choose to publish things, or maybe not. It's not the point this time. The point is to show up for myself. To build. To do the thing. No excuses. To keep building even if I throw things away or not use them more than once, or even at all. To just build, and build up the respective skills.

But is it scary, you ask? Shouldn't these personal challenges... actually challenge me? Oh hell it is. It means I don't have excuses anymore (as I keep repeating myself). It means I know I have all the means, nothing's stopping me - besides me, myself and I. And my fear of being judged. By others, and especially by myself. And that's scary, even though I've worked on calming my inner critic. Yet that critic also understood pretty well when I'm not knowing enough yet. That I need to get back to the basics, the foundational building blocks, and put them together myself. Building programs, tools, actual products. Building further understanding as I go. I'm scared of failing and learning, even though I preach such a growth mindset in various ways for many years.

Well. No excuses. Do the thing and get into the habit of just doing the thing. Or rather: Build humbly but build. I need to set myself up for success as well, not for failure by expecting overly huge things and results or instantly getting disappointed or frustrated with myself that I'm - surprise - still lacking the practice. Managing expectations will be huge. Yet I really want to hone the skill I never had much opportunity to hone at work and when I had, too often chose not to. Now that I do have lots of opportunity to practice security at work, building up my builder skills is what I can focus on in my private time. 

These days, I was reminded that learning is not a constant straight line but comes in waves. Trying something new (or even familiar on a bad day) will result in worse quality, less skill. We can only evaluate our progress on longer time frames (hence these yearly challenges in the first place). We need to be okay with doing something badly in order to do it at all. Anything worth doing is worth doing badly - as long as it's not causing harm.

Enough of the pep talk. 

 

The Hypothesis 

If you would only realize how many times I've rewritten this section, how much I've kept on adding thoughts, challenging my actual challenge over and over to uncover what's really moving me that I'm still shying away from. The truth is, it's all in the process! I often need to write and rewrite and start all over in order to realize what's my most valuable hypothesis here to tackle my challenge. This time, I struggled even more and it took longer than usual. Finally, here's the leanest, simplest hypothesis I found that narrows it all down.

I believe that consistently investing time in building software will hone my skills to make problems smaller. I've proven this hypothesis when I've made at least 3 real-life problems smaller through building within 300 days.

This is why I call this challenge "Back to building - make problems smaller". The core is going back to building, as I've started out in the last years but never followed up for real. At the same time, there's no need to solve the problems completely - that's too much pressure and unrealistic. Just tackle a part of a problem so the load and pain are reduced. Basically, just make it a tad smaller problem. 

The problem itself could be scaling. It could be giving better advice from the trenches or conveying knowledge through showcases. It could be reducing repetitive manual work and making it less error-prone. It could be offloading cognitive load. It could be creating a product I'm using myself. Whatever. Just an actual problem made smaller. This way, I hope I'll not only train my building skills but also recognize more of those opportunities to reduce the problem space as I go.

The Experiment

To test the hypothesis, here's the experiment: I run my very own #Challenge321; inspired by the many #100DaysOfX, #100DayProject and #75DaysOfX challenges out there that I love following. In those challenges, there are certain strict rules - I chose to adapt them and make this my own as follows.

• For 3x100 days (aka 300), I dedicate at least 21 minutes of time each day into a specific topic, to build up momentum and a habit of spending time deliberately on what's important to me. That's why I call it my #Challenge321. 
• The three topics:
• #100DaysOfBuilding - building software to make problems smaller. From designing to developing to testing to fixing flaws to operating, this will include everything that goes into building products, helper tools, or the like. Basically, spending continuous time on this. I can use this time as I wish in the moment. I can build a full-blown product, no matter at which scale. I can build multiple pieces of software - tools, scripts, libraries, anything. I can use them or not. Keep them or throw them away. As long as I keep building.
• #100DaysOfMovement - literally getting that movement in for health and fitness. That's a rather common challenge to do. What I do doesn't matter as long as it gets me moving. Volleyball, running, even walking. Stretching, strength exercises, etc. As long as it helps me get moving it's fine - even better if it helps me move towards my fitness goal to increase my body control and mobility range so I can pick up barbell training again.
• #100DaysOfGames - playing computer games for pure joy and mental health. Casual games don't count here for once - I have so many absolutely stunning and exciting games in my library, I finally want to enjoy them to the fullest. This activity is also a perfect timeout for my head during busy days. It's only for me and no one else, and hence it's a perfect way to maintain my mental health and recharge my batteries. It's also about that "play first work later" mantra I built up in 2025 during my Calm and Steady challenge.
• I can choose to do only one of these three topics each day in 21 minutes and rotate through, or I can mix and match those three, e.g. do all of them in one day within a good hour. That's why the minimum time limit is deliberately low. I simply don't have excuses not to carve out that time per day. This is promising to work even on busy days, also considering all my other endeavors and tasks. If I continue beyond the 21 minutes on a topic, that's totally fine as well. I'll take it where my energy goes - yet the activity only counts once per day, I can't save up for future days.
• It's okay to miss days (e.g. for conferences or whatever else life has planned for me). It's also okay to have different counters on each of those three topics. The only constraint is that I have to finish all three of them within exactly 300 calendar days. That's from January 5th until October 31st (inclusive). Hence, the experiment stops at the latest on October 31st. If I finish within 100 days already, that's fine too. At the very moment I reach 100 on all three topics I can choose to evaluate my overarching challenge right away or continue and extend beyond 100 days for each topic, whatever I wish to do at that moment in time.
• I'll keep track of my progress for each challenge and the days that passed. Other x days of x challenges often require you to keep track publicly and to share your insights and experiences. I'm not mandating myself to do that each day, I might do it whenever and wherever I want to. I'm confident my track record of past personal challenges are good enough to prove it's fine to hold myself accountable.
• To enable myself to evaluate my hypothesis in the end, I'll also keep track of how many real-life problems I've solved through building during these 300 days.

I'm well aware that this experiment basically consists of three challenges to tackle a challenge to achieve an overarching challenge - and yet, bear with me. I believe it's a great way to ensure I do test out my hypothesis for real, one that keeps me going and also has liberating constraints baked in. I don't want to end up once again not investing in my own joy and health, here it's literally part of the game.

Also, I believe that not doing all of these within 100 days but choosing my own pace within 300 days makes all of them pretty sustainable and feasible, even combined with a busy life and lots of other endeavors. Every third day would already make me achieve each challenge - so if I do each of those 3 times per week I'm already doing very well. And that's very reasonable. Even for movement, that would be the default already as of now. No energy for one thing? No problem, just tackle one of the other topics! Also, two of them are energy-giving, only one is the scariest, and all are targeting different areas. It's basically #300DaysOfNoExcuses.

Usually, I keep just one hashtag or tag line in my head to refer to my personal challenges. It helps me keep my theme for the year in mind and collect my posts on them. Well, I guess this year, I have a whole bunch of fitting hashtags, a real collection - and that's okay just the way it is: #BackToBuilding #MakeProblemsSmaller #Challenge321 #100DaysOfBuilding #100DaysOfMovement #100DaysOfGames #300DaysOfNoExcuses #DoTheThing

 

Let it begin!

This time, all constraints are already baked in. So that's it. It's on. Wish me luck!

Contributing in New Ways - Finding Closure among New Opportunities

Finally, there's time and space to close my personal challenge of 2024 by looking back at what happened and what I learned from it. Setting out beginning of the year, I had the following hypothesis.

I believe that contributing to communities in new, courageous ways will add value to the communities I'm part of and grow my own knowledge and skills. I've proven the hypothesis when...

• I have contributed in three new ways,
• other people engaged with these contributions, and
• I have learned three new things from each.

Little did I know just how much this turned out to be true! Here are the new kinds of courageous community contributions I've done during the year and what I learned from them.

 

Open Security Conference (osco)

What was it about? Launch an open space security conference together with Claudius Link, Dave van Stein, Janina Nemec, and Ulrich Viefhaus. We set out to create a people-centered international gathering for everyone interested in cybersecurity, aiming to remove gatekeeping and barriers where we can to make security more accessible. The idea of the Open Security Conference (#osco) was born.

How did it go? There are so many things going into organizing a conference, let alone launching a whole new one. We had to make a few hard decisions what to do for this first instance already, and what to park only for later editions if that first one proved our concept. The biggest trouble we had, though, was a topic we didn't have on our radar at first that we completely underestimated. For a few months, the whole conference was on the edge as we had to solve the problem of handling money without having any organization (yet). This took us nearly to a halt; until we figured out a way together with our amazing venue to have all money-related topics, including sponsoring, go through them. Having made it over that big hump, we actually made the whole thing happen: the first ever Open Security Conference (#osco) took place on October 4-6 in Rückersbach, near Frankfurt/Main in Germany! We had two amazing keynotes to kick it off the event, followed by the open space as main part of the conference. We worried if things would work out with a small first group and were very relieved that people really enjoyed it. Read for yourself how the first osco went! People raised a lot of interest in an #osco25, so we can already confirm that we will have a second edition in 2025. We even found five more organizers to grow it further, we're very grateful for their trust and support. Currently, the whole organizing team is on a break to recharge energy, so our website is still on the state of 2024. Yet if you're interested, you can already save the date of 2025, October 2-5 for our second edition! Follow us on social media, Mastodon and LinkedIn, to get all latest updates once we're regrouping next year.

Which three things did I learn for myself?

1. Investing in creating an inclusive space from the start pays off. More often than not, this vision needed us to go the extra way. While we're keenly aware of what we're still lacking (plus the things we're not aware yet), we received really good feedback that the effort and positive impact was noticed and appreciated - it was so much worth it. 
   
2. It is invaluable to have a mid-sized and diverse enough group to get a big endeavor off the ground. While it wasn't always straightforward what the most effective solution to a problem right now was, we managed to play to the strengths of our different personalities and experiences in the end.
3. Having regular and frequent opportunities to reflect on how we're doing and trying out different approaches is crucial. This applies to any group you're working with. We postponed our retrospective to after the conference, while it would have really been worth doing them a lot earlier and regularly throughout the year.

 

Security Card Game

What was it about? Create a security card game together with Martin Schmidt and Philipp Zug. This idea has its origins at SoCraTes 2023 where I brought the topic of security to the conference and loved seeing lots of folks engage, like Martin and Philipp who invited me to their idea to create a game for fun and practice. 

How did it go? We have the main concept, a constantly evolving set of rules and deck of cards. Thanks to Martin, we also have a way to play the game remotely; who knows if we'll also turn it into a physical card deck at some point (it would be great, wouldn't it?). In any case, we hope to bring it to open space conferences and the world. Check out our Security Card Game Github org in case you want to follow along, and make sure to read Martin's SecCardGame post to get a first impression of the game. Having played it a few times, we were keen to present it to others at SoCraTes 2024. To be frank, we were positively overwhelmed by all the folks coming to our session, showing lots of interest, and providing concrete feedback for us. We also found a new contributor as well to evolve the game further with!

Which three things did I learn for myself?

1. Early and fast feedback is invaluable. Not a new learning in itself, and yet it turned out to be just as true in this space as well. We made it a point to try out the gameplay and different rules early on and continuously, without investing development time when it wasn't needed. This really paid off! Same as showing our rough and raw game already to the public without polishing it.
   
2. Sometimes it's just fine to contribute in one way only. For example, for this card game I've mostly focused on the content of the cards, instead of the actual implementation. It was something I could do in between everything else, and it still helped as asynchronous contribution until we met again - when we could think of all kinds of things and ideas while being together.
   
3. A little, relaxed, non-stressing, fun side-thing is a really nice side-thing. This initiative was the least stressful of all the things I've worked on throughout the year. We had set ourselves up for a great pace, continuous yet not overbearing, things moved further, not much investment was required in between, I really looked forward to our little sessions. It's nice to have things like this on the creative, energy-providing, playful side.
   

 

Project Snack Shop

What was it about? Build a full-stack open-source practice platform as an ensemble with Ben Dowen and Vernon Richards. We were taking the roles of the employees of the fictive company "Make-Believe Labs", taking on "Project Snack Shop" for a customer who wants to digitalize their well-running snack shop business by offering an online shop. This was intended as an as realistic as possible practice platform for all kinds of development activities. From our own vision, to the actual project offer and context, to the first proof of concepts, to team agreements, to design documents, to architectural decision records, exploring walking skeleton options with code, and more. 

How did it go? This had been a fascinating endeavor I really wouldn't miss. It's been both fun and challenging to mimic the described scenario and act accordingly. Sometimes taking on certain roles we knew we wanted to play on, like team dynamics and patterns we've observed. Wait, did I just commit a change without telling anyone (he-he-he)? Was that commit message omitting quite a big relevant change? And more! Not everything is publicly shared, but you can follow our main Snack Shop repository to see the latest state. I really appreciate having a project from the scratch where we can try things out, do some things properly, do some things in quick and dirty ways, leave some problems in the system intentionally while discovering others as we evolved it. We also had planned to bring this more to the public in the sense of webinars or streams, getting ourselves even more out of the comfort zone. Ben managed to get us a webinar where we could use our little project to work on specific challenges that are likely to get asked in an interview situation. This was a big driver for us to evolve it just to that stage where we could do the session. Afterwards, we all lacked the time to drive our snack shop much further, yet it'll always be there to work on as a nice practice playground which is closer to a real work situation already by its setup.

Which three things did I learn for myself?

1. Building things allows me to use skills I have, yet rarely have opportunity to hone. At the same time, doing so really boosted my confidence that I indeed can figure things out. 
2. Sometimes you have to build it yourself. There are so many practice apps out there for all kinds of purposes, it's wonderful. What we were aiming for, though, was rather unique, and I'm still not aware of any similar project. Especially doing it as an ensemble taking on different fictive roles and leaving trails and artifacts as it could be! 
3. Constraints can be really helpful to evolve a thing further. The webinar due date helped us massively to invest time for real, make tough calls on what to leave out, and have the thing shippable. While it's nice we don't have any pressure on the project anymore, now it's lying dormant. Constraints can really be liberating.
   

 

Leadership Workshops

What was it about? Offer Shiva Krishnan's and my leadership workshop series to the community. This program proved to be valuable to lots of people in the past, and it definitely helped both us grow immensely. Finally, the time had come to spread the word further and transform our workshops to an open community offer. This year we wanted to try it out with a small cohort. 

How did it go? For this first community proof of concept, we decided not to have public registrations, yet to build on our networks. We thought if this goes well, we can plan for more afterwards. We tried to think of lots of things needed to bring these existing (and continuously evolving) workshops to the broader audience, like tools, communication channels, and more. We found lots of interested people. We hosted Q&A sessions to answer most frequently asked questions right away so everyone knew what to expect and what they would sign up for, especially given that this is a series of six workshops with quite some time investment required from participants. What we didn't expect was that all of the above was quite fine for folks, yet the real struggle was hidden in our vastly incompatible schedules! It took us a very long time, staying patient and trying lots of different approaches, to figure out the slots for the first two workshops. Especially as we had to split these workshops up into smaller parts, given that it wasn't happening during working time, but in addition to work for everyone. We're really happy that we found a small cohort of four people who stayed enthusiastic and dared taking this journey with us. The first two workshops are completed, four further ones will take place next year. While we originally aimed to complete all six this year, we're glad we can still do this and learn from fresh community feedback to evolve them further and hopefully bring more value to community.

Which three things did I learn for myself?

1. It's hard to live up to your own values and leadership beliefs yet the impact of doing so matters. Especially when you give workshops on exactly this topic. Leading by example most often means not taking the easy route and finding ways that work for people while staying true to what you preach. It's been worth it big time, and I'm glad people now have a space that fits and continues to adapt to all of our needs.
2. Community editions can be different to work sessions in unexpected ways. This turned out to be very true when having people co-create the space instead of just proclaiming a date and leaving it up to people whether they can join or not. Scheduling is a hot topic also in work contexts, especially across different roles and departments at the same company. The fact that we're working for very different companies in different modes, with very different private lives and personal needs as well, made our schedules even more diverse.
3. Make the decision, especially when it's difficult. Originally, we wanted to start with a cohort of six people. Small and doable, while still viable. We had to make the tough decision to reduce the group to four folks to make it work at all, and communicate it accordingly. This was no easy decision at all, and at the same time the outcome shows us that it seems to have been the right decision in the end. We have a great group of engaged folks where the whole concept really works for everyone.
   

 

Conference Sessions on Security

What was it about? Give conference sessions on security. Ever since I've had my first pair testing sessions on security in 2018 I've been diving deeper into the area each year. I've given several sessions in company settings and at open spaces. This year it was time to extend my conference speaking to security topics and hence contribute in new ways in that space as well. 

How did it go? At the beginning of the year, I felt I could at least try to submit security-related proposals to some conferences. It would already be worth daring the mere submission and learning from it. And then it was actually working out, way more than expected! The Software Teaming Online Conference gave me rather free rein, so I made use of it and hosted an ensemble session to Capture the Flag Together: Security for Everyone, co-facilitated by Lisa Crispin. This idea was based on sessions I've given many times at various open space conferences and at work as well, so I was on familiar ground to start with. Then Agile Testing Days accepted both of the new security sessions I've dared to submit! Hence, two brand-new sessions, the workshop First Steps in Mobile Security Testing and the talk A Security Champion’s Journey - How to Make Things a Bit More Secure than Yesterday Every Day had to take place. And then SoCraTes also came and asked me to give a training again this year - maybe I could do something about security? I was so happy when I read their message, it seems all the security related sessions I gave at last year's SoCraTes had really caught their interest. So I decided to create yet another new workshop that would fit well as a foundational training: Secure Development Lifecycle Applied - How to Make Things a Bit More Secure than Yesterday Every Day. Overall, these four different security-focused sessions had been accepted by conferences, and I was very excited about these opportunities. Yet another highlight was to come. Encouraged by all this, I dared to submit my brand-new talk to my first security conference ever, BSides Munich - and it got accepted for their main stage! Speaking there was definitely one of my biggest achievements unlocked for this year. There's a recording of this inaugural talk which makes me even happier. And as it goes with speaking at a conference, it also helped me massively to get further connections in the security space.

Which three things did I learn for myself?

1. It's worth daring to share what you've already learned on your journey. A lesson I've re-learned for myself. You never know who's going to be in the committee or audience, it might just be a great fit. And you don't have to wait to be in an exact role, position, time at life, or whatnot to start sharing. It will help you gain confidence and a clearer understanding of the topic as you need to convey it in approachable and digestible means.
   
2. Sometimes, the answers are already within you. I've learned this the hard way: just because you've seen a workshop setup play out nicely, doesn't mean you can replicate it that easily. My mobile security workshop haunted me for months, not because of the content, yet due to the complex setup that I needed to break it down and make it as accessible to beginners as possible. I've asked lots of people at the conferences I've been to how they would tackle it and gained lots of good hints and tips. And yet, in the end, none of these really solved my problems. Instead, the answers were already within me, I just needed to build up the confidence to remember all the pieces of the puzzle that I've already worked with throughout my years in tech, and bring them together in a way that it solved this one. And indeed, once I had gathered further confidence, I managed to figure everything out. Even during the workshop when I still needed to debug a few things live. It worked, and I can use this to ground myself in what I actually know and trust myself more.
   
3. Putting yourself out there on stage creates so many new connections and hence opportunities. Again, not a new learning, yet a re-validated one. Especially my new talk helped a lot with this, initiating lots of interesting conversations already at the conferences and also afterwards on social media. It also led me to having a dedicated call to talk about security champion programs and how to overcome struggles with someone I unfortunately missed at the conference, yet was lovely to meet online! Connections with like-minded folks are just invaluable. This talk even helped my job search - that I wasn't even aware was needed when daring to submit the session in the first place. Lots of good came out for me so far from giving back to community.
   

 

Running out of Capacity

Obviously, there were more ideas for even further new contributions to community this year. Creating an own capture the flag (CTF) team, contributing to an existing open-source project, maybe even really start writing a book. I'm glad I held back with these. First, there are further years to come. Second, well... taking on this challenge to contribute in manifold new ways was already filling my schedule to the rim.

So, what did I learn overall? That this year was wild. It was a constant hamster wheel. Having work being very stressful as well did not help at all. Private life was okay, though not that easy to navigate either. Overall, it was wildly too much and I really need a break now. I could have chosen a break in between at any time, yet it would have meant letting a lot of people down, including myself - so there's little to no surprise that I didn't take any break. Yet looking back at a year when I neglected most of my pure self-care activities like playing computer games (only picked it up again this month), reading fiction books (lay dormant for months as well), drawing (I remember I did it once during this year for a gift and that was about it). All of these bring me a lot of joy, and that source of energy became non-existent. At least I still invested a bit in exercising, yet as I'm doing team sports it would have also meant letting others down so of course I didn't cut short in this area. Well, it really helps my own health, so I'm still happy I didn't. But the big personal lesson for me here is that for a year that I intentionally set out with "energy & joy" as my motto but that was exactly what I lacked most - is that I must not repeat this. Whatever I do next, for any challenge, I need to build in self-care once more deliberately. Otherwise, I'll trick myself, just as I did this year. 

The second big lesson? Each of these new contributions could have been a personal challenge of the year. Cramming them together in the same year meant I had less focus on each of them, and over-committed myself, hence putting artificial self-made stress on myself when life was already stressing me out enough without me adding to it on top.

One more final lesson: anything you say yes to means you have to say no to something else. I'll have to see what other endeavors that I used to do are those I have to say no to next year, as many of the above community contributions are to be continued in 2025 - they don't just simply stop now. At the same time, I need the capacity and freedom to also go new ways and have actual slack time.

 

In Conclusion

My 2024 personal challenge is hereby officially closed. Looking at all the things I've worked on this year as part of it, I can definitely confirm that I have contributed in more than three new ways this year, that other people engaged with each of these contributions, and that I have learned at least three things from each.

I'm very grateful for all my co-conspirators in all of the endeavors described above. Without you all, my pieces alone would not have completed the puzzles we were working on together. Many, many thanks to everyone! 

This year's personal challenge to contribute in new ways had been quite a heavy one for me, and yet it helped me set myself up for good things to happen in 2025 - and I'm here for it!

Contributing in New Ways - Getting over the Hump

This year, my personal challenge is to contribute in new ways - courageous community contributions I haven't dared to do before. As opportunities arose, I took on a bunch of endeavors beginning of the year, which are both very exciting and, admittedly, time-consuming. While I've been aiming to share intermediate updates from time to time, I'm grateful for my past self deliberately decoupling my challenge from any writing efforts to reduce artificial pressure. Still, it does help me to sit and write down my thoughts from time to time. It's time now.

A Lot to Celebrate

It's been a lot to juggle this year. Well, I realize I've set myself up for that. It's one of those self-inflicted situations, which might be uncomfortable yet also come with a bright side: it's totally up to me. I can reduce things at any point in time. Or shift my main focus between endeavors. Right now, this is working out sufficiently well so that I didn't have to cut anything completely yet. In addition, there's an even brighter side: no matter how the rest of the year plays out and what else will happen, there are lots of things to celebrate already.

Open Security Conference

It's happening! It's actually happening. The very first Open Security Conference (#osco) will take place from October 4th to 6th in Rückersbach, close to Frankfurt/Main in Germany. The event will be kicked off by two amazing keynotes before we then all learn together in the open space:

• "OWASP Juice Shop 10th anniversary: Is it still fresh?" by Björn Kimminich, who's well known as project leader of the OWASP Juice Shop and a co-chapter leader for the OWASP Germany Chapter
• "How to hack a company in one day or less" by Yvonne Johnson, who's an experienced red teamer and penetration tester
  

I'm so very curious about how the first osco plays out. A first event is always exciting! You're trying to set the space and constraints in ways to support your values and your goal. What of it helps and what rather hinders is something you'll only find out when you give it a go. We are starting small and learning as we go indeed. We've already gained lots of insights during the preparation so far. We can't do everything we'd like to do for the very first event, and yet it's a starting point that sticks to our principles and is based on our values. A starting point that hopefully helps establishing this new conference so we can build on it and evolve it further over the next years. Because cybersecurity is just a way too important area that's too often struck by gatekeeping and other barriers we're trying to lower and remove where we can to make it more accessible - for everyone interested.

We gained a better understanding on our individual and collective reasons for doing this in the first place, why we think there's a need and a gap to fill, what makes this conference special to set it apart from existing events in the security space. Not only for marketing osco and figuring out our target audience (which is a real challenge!) but also to make even more intentional decisions to shape it further. We'll continue to iterate on how we present the conference vision, just as we'll also continue learning to spread the concept of an open space conference format to cybersecurity which lots of folks seem not to be familiar with yet. Well, for now - we'd like to do our part in changing that!

As an organizer team, we had a tough challenge to overcome. We weren't quite clear on the direction to take on how to handle finances, which paralyzed us. Not much happened during this time besides going back and forth pondering about our options and worrying. It felt like treading water. I think it speaks for our group that we didn't break up at this point, that we indeed got over this hump and we came out stronger together. We made a feasible decision for the initial event this year and paved the way to create an underlying non-profit organization to sustain the efforts for next year.

Solving this big bump in the road meant we picked up speed again. We could finally open the registration, and we already have more registrations for this first event than we dared to hope for! There are still a few more tickets available, so if you're interested in participating in our inaugural event, go ahead and register now! And if you like what you read and want to help us spread the word on either LinkedIn or Mastodon, I would appreciate it very much.

I'm really grateful for my organizer team to be on this journey together: Claudius Link who came up with the initial idea, Janina Nemec, Ulrich Viefhaus and Dave van Stein who considered it a worthy cause to work on together. I'm also grateful to all supporters on our way. We had several initial thinking sessions, like with Tarik Kobalas, Jahmel Harris, Dan Billing and others. Several people contributed with lots of advice based on their expertise, like Mathias Verraes on organizing conferences, or Raphael Albert on the legal side of things. My thanks to all of them.

We're still learning lots of stuff and we won't get everything right from the start. We observe and listen to feedback, we adjust what we can right away, and we take note of what we can do better next year. That's what makes me hopeful that we're coming to stay.

Leadership Workshops 

Shiva Krishnan ran his series of leadership workshops many times in company settings. A few years back, I was fortunate to participate in one of his cohorts myself and got hooked - more people needed to do this program that I was drawing from so much! So I paired up with Shiva and we ran the next cohort together, until I changed companies. Thinking back, I'm still using those tools and ideas until today, and still continuing learning. Shiva and I kept in touch and thought about how we can bring this offer to community. Talks, writings, all good but not the same. How about bringing the actual cohort idea to community?

For a half-public first experimental community cohort, we reached out to our networks to find people who give us enough trust to get this started. We had first calls to present the workshop series, manage expectations transparently (it's a whole program after all and no small commitment), and answer any questions that came up. That alone already taught us quite a lot of what might be different for community cohorts compared to a company-internal offer. 

We indeed found a great cohort of six people who agreed to join us on our journey of bringing these workshops out there. We set up foundations like a shared communication channel with folks, clarified feasible lengths and frequencies for our remote sessions next to everyone's work. Everyone was eager to get started and looking forward to this endeavor. All we needed to figure out was scheduling now to run the first workshop.

Oh my. "Just" the first time slots. We knew scheduling is not the easiest task when it comes to these workshops, we've seen that in the company setting, yet always managed to find good solutions. Phew. What can I say, we really did not expect it to be that much of a struggle. We're only eight people. And yet, all our schedules differ in ways that make it really hard to find any overlaps. Like, any. Each time we thought we've now found a solution, more obstacles got in the way. And time keeps running. We brought everyone together to solve the puzzle, we made judgement calls and a few tough decisions to make this work. 

Let's see what happens with our latest option. In the end, we might need to rethink our whole approach. It's an experiment after all, and we're still learning from it even if it might not turn out what we planned it to be. But yeah, scheduling such a workshop series when you're all working at the same company, and you have the buy-in of people's managers is a lot easier. By far. We still hope there's a way that people can also benefit from the content and format of this series in the community space. In any case, we're grateful we got that far, and we definitely learned a lot which hopefully helps us in the future to bring this content and concept to a wider audience.

Security Card Game

This is probably the most relaxed of my endeavors. Martin Schmidt, Philipp Zug and I are trying ourselves, and absolutely enjoying ourselves with creating a new security-themed card game. Taking it as a deliberate practice project, we're learning a lot just thinking about it and evolving it further.

The game concept evolved quite a bit from the very first paper draft. We already played it several times with different variables and rules and gained more insights each time. We have both game engine and user interface to support our current ruleset, lots of cards already added, and it's honestly just providing us a good time. It's not balanced well yet, the game goal needs refinement, more content would help. We are currently only playing in collaborative mode all together, while having ideas for the future to simulate different company scenarios with people taking different roles to advocate for different strategies, maybe just going about their own (hidden?) agenda, or secretly sabotaging everything from the inside. Lots of potential paths - because in the end it's a game about decision making.

So, what is it about? You're employed at a fictive company. As time passes, you gain a certain number of resources available for you to invest in one way or another. Also, as time passes, more and more "oopsies" happen from a security point of view - a password got leaked, a vulnerable dependency wasn't updated, an internal website became accessible to the public. Do you close those doors to make it harder for attackers, or do you risk leaving them open for a while? At the same time, attacks are attempted by malicious actors. Sometimes they hit one of those open doors and you have to pay the price. Sometimes attackers don't find a target, or get impatient, or you just got lucky so you can counter the attack. All the while new employees need to be onboarded, security training can increase your skills, or it's just a normal day without anything bad happening. How do you make it through, will you still have resources left at the end? And how many oopsies did you leave unattended?

Well, curious? Just give it a try yourself! Get our latest release 0.5.5 and check out the current rules to get started.

Our next step is to share this game with more people at SoCraTes - we are fortunate that we can meet there again in one week's time already. It's the place where this game idea saw the light of the day in 2023, so it's going to be awesome to return a year later and play it with folks. I'm sure we'll be able to gather lots of feedback and future ideas for our game project. And hopefully people have a fun time with it, just as we do.

Snack Shop by Make-Believe Labs

Ben Dowen, Vernon Richards and I set out this year to fill a gap. We wanted to have a full-stack, open-source practice platform for all things product development. One that resembles real work scenarios close enough, with challenges people actually face so that gained skills could be applied. One that provides a safe space to hone all skills development, testing, architecture, UX, infrastructure, security, accessibility, you name it. One that offers opportunities for us to make use of it in teaching and coaching situations, e.g. for conference workshops and trainings. One that we could use to showcase collaboration dynamics, from ensembles to pairs to individual asynchronous work - both in live streams as well as through the artefact trail that we're leaving behind. When working on the project, we had good fun leaving a deliberate trail at times, sometimes showing rather commendable, sometimes less ideal behavior, so we can make use of them later.

What we're building is project "Snack Shop", a client project that the fictive company "Make-Believe Labs" took on. It's based on a brief from the owners of a bricks and mortar snack shop, who want to take their business online. Taking on various roles, we're working hard on a proof of concept system that we hope they will love.

The snack shop is composed of three services as of now:

• A web frontend for users to interact with the shop, using React, written in TypeScript
• A backend for frontend, often called BFF, to serve as single public gateway and orchestrator to various backend services - using the Nest.js framework, also written in TypeScript
• A SpringBoot Kotlin backend service connecting to a MongoDB

What we're having as of now is a so-called walking skeleton. All components are running on their own and are integrated. It’s walking, and yet it’s still a skeleton. There’s a lot of work to do, and yet we can evolve it iteratively.

The first goal was to create a typical proof of concept. We were starting out rather well, taking deliberate architectural decisions, taking time documenting them. Then we received a first due date - and the rush began! Tradeoff decisions made it in just as they would in real life. A due date works wonders in cutting corners! Okay, we did that deliberately, and yet! We see what happens. We have pull requests that were sneakily just merged without communication, we have changes that do a lot more than what they claim, we have faulty descriptions, we have long waiting times for asynchronous work, we skipped good practices like test automation, input validation, and a lot more. Well, we took on this scenario and played the roles, yet I admit I felt those feelings myself. It was both fun to see patterns play out I've seen so many times, also in myself. Indeed, a real practice project! Oh, and yes we also had lots of good behavior and great collaboration, don't you worry about that.

What caused that due date? Good thing was we had a real one, which indeed pushed our project forward in the end. All thanks to Ben who was invited to the Automation Advocates meetup, and extended that invite to us. We chose to use our own new project and work on challenges together. In front of a live audience. For the first time. Well, the right kind of scary that really lets you grow! Not everything worked out, yet we felt we still did alright for a first time, and we learned more for potential future sessions. Because we want to do more of those live sessions. By then, the project will have evolved as well.

All in all, it's really evolving, slowly, and in waves, but steadily. And it's just fun to work on, practicing deliberately.  Ben is currently preparing for his next conference workshop "Coding Challenges: Prepare for Success in Technical Interviews" for TestBash Brighton where our project will make its second public appearance. If you have the chance, check it out! Personally, I'm already curious what he'll learn from that. Overall, I'm eager to get back to our Snack Shop once I'm on top of another topic I currently focus on. I'm happy I can be flexible to follow my energies here, plus I love that I always gain energy from our ensemble sessions.

Conference Sessions on Security

It's been a while since I started speaking at conferences. At times I look back at how many speaking engagements I already had and am both speechless and grateful. It's really been a ride so far, and I wouldn't miss it! So, while speaking at conferences is not a new thing for me, speaking officially and publicly about security topics certainly is a new contribution.

I'm very pleased to share that I am giving four different conference sessions on security topics this year. All but one are brand-new as well! I'm still in awe and very excited. Already next week the next session is coming up.

• Software Teaming Online Conference - 11 April 2024: Capture the Flag Together: Security for Everyone (ensemble session, co-facilitated by Lisa Crispin)
• SoCraTes - 22 August 2024: Secure Development Lifecycle Applied - How to Make Things a Bit More Secure than Yesterday Every Day (training)
• Agile Testing Days - 20 November 2024: A Security Champion’s Journey - How to Make Things a Bit More Secure than Yesterday Every Day (talk)
• Agile Testing Days - 21 November 2024: First Steps in Mobile Security Testing (workshop)
  

Finally taking this step that I've waited for quite some time is a big thing for me. I've paved this way since my first security pair testing sessions in 2018, diving deeper every year, and I'm quite enthusiastic about it.

That being said, it's honestly quite a lot of work. It's already a huge challenge for me to create three new conference sessions in one year on any topic, and all those in this huge area... It's a real stretch. It's scary and I'll certainly grow. It'll work out in the end, as always - and yet it's making me as uncertain and nervously excited as I haven't been in a long time when speaking at conferences.

Just recently I've learned that there's even more to celebrate in this space, I got accepted for yet another speaking engagement which is not public yet. I can only share that much: a dream came true for me. I hoped it might happen next year maybe, and now it's already there. I'm still speechless it happened. And very excited!

A Lot to Reflect On

Once again, I noticed that, while I had to force myself to sit and write down all of things above, it really helps me. Having my thoughts sorted, written out, and put out there is a relief from a perceived overdue task, it provides me dearly needed clarity, and it is going to help my future me as well when looking back on what happened and what I did over the years.

Truth be told, listing all the above feels quite good, despite the effort going into making each and every point happen. But how has it been for me in the past months? I've taken some notes for myself during this time. I wish I would have taken more, yet it is what it is, and that's what I got. I still want to persist them and show the other side of it. So here are my rather raw notes, jotted down over time, to keep as a reminder to myself.

May

I came to the realization that accountability works well for me, especially when I don't want to let others down. Yet I always prefer those tasks where I feel I gave my commitment to someone else over my own endeavors, so I'll always feel guilty. And always behind. Did I set myself up for failure? Or for learning to let go and do less?

June

I got so busy that I neglected where I get my energy from: celebrating, taking breaks, games, people conversations and feedback. I dearly needed that reminder.

Now I focused deliberately on de-stressing - and it worked! I'm already feeling a lot more relaxed.

I also re-aligned with people - I really needed this and the energy gained from it. Especially rediscovering the joy. For osco it was really liberating to make that financing decision finally and get over the hump, this allowed me to also start advertising the event again more freely. It's really hard to promote something if you don't know if it's going to take place for real.

Following my energies always served me well - just do the next thing I think of and can do right now. Taking small steps. Feeling good.

My new laptop also encouraged me doing something for the current projects, making it very easy and quickly accessible. It's a great side effect to have the nice combination to have various platforms available now for testing out my projects on different setups. Also, I'm building on the energy of "this is new, I instantly want to do something with it" that I usually get from shiny new things.

Also: I'm finally writing again, journaling these notes. Well, I knew I was better at reflecting and thinking in writing! And I'm so used to write on a laptop that's similar to my working setup - very interesting insight.

Oh, and movement and games of course! I finally did something just for myself again apart from these challenges. It's been way too long.

More sources of energy to take note of: sleep, breaks, tidying up, games, movement, emotions, focus, more intentional social media time.

Due dates help unless they get overwhelming.

 

July

Ben and I set ourselves a due date: until the meetup we're going full in, setting things up - but minimal in every regard! Cutting corners and taking shortcuts, like a real team will have to do if they need to present the proof of concept. We even set ourselves a code freeze a week before (editor's note: we ignored it and did changes until the day before the meetup, obviously).

I'm so glad we did this! This really pushed me to contribute and get into coding again! All my previous jest and unit test and Angular RxJS observable knowledge came to play! Plus my new bff knowledge, all combined - very, very useful, already proofing the concept.

Today I committed lots of changes - and it only took me a couple of hours overall to figure things out I haven't done before yet, very proud of myself. The last bit to add a bff endpoint was only half an hour in the end, including everything! Probably even less.

August

Still feeling overwhelmed with all challenges although most things are more under control now - mainly the time factor is pressing on me. How to juggle all those balls I've sent into the air? I know the answer - I need to drop some and pick them up again at a later point in time. And while it doesn't feel right right now, that's okay and in hindsight it'll also feel better.

I also know I need to force myself to sit down and do things one by one. I know afterwards I will feel better. But sometimes I have to do everything else before I can actually make it happen and sit down and do the thing I'm dreading. Once I've started, it's way easier for me to keep going until things are in shape again. It's about that initial sitting down when I lack energy. Habits could help me, yet I don't have as clear ones for these in place yet. Today I had to force myself to sit down. And again, and again, as this post didn't write itself in one long session. It was still important to do.

I need to wait sometimes to have energy again. Do other things. Just watch a TV show. Dive into the Olympics. Rest as my body told me to. All while feeling that time is running, while knowing I won't get far without sufficient energy. Today I finally had enough energy to get a few things done, even though I had to push myself.

What I'm writing in my initial draft is not very coherent, yet I have to get into just writing again - I can clear things up later, even if that takes more time. First, I need to get to writing again.

Switching contexts is - surprise, surprise - draining energy. And too many tasks on different topics all having due dates drain even more. I've experienced the same here.

I originally thought of posting heavily on social media regarding updates on each single endeavor - and didn't have energy or wasn't sure as I'm not alone on any of these, and it was costing too much to align on everything. In the end I just didn't.

This year I've left out my "stop when you notice you neglect self-care" clause - and guess what? I'm not holding myself accountable. I have rarely played any games, not read much of my fiction. For physical health and strength, I often only invested rather the minimum although I wanted to get in better shape again this year. The most I did was watching TV shows as I wasn't able to do anything else anymore. Often falling asleep on the couch or over a book as well. Hard lesson learned: don't skip self-care, however it looks like for you. Ever. Life is short anyway. I need to make time for things I deeply love. Games, books, volleyball.

A Lot to Keep for Next Year

Several of my endeavors won't completely stop with my personal focus on them at the end of October 2024, they will reach into next year. And yes, I already have further ideas for challenges next year (as if I haven't learned enough from overdoing yet - I haven't). Well, I'm taking note of ideas and leave the actual decision to end of the year, as always. Only making a call once I have more information to make it a good call.

For this year, there's still more to do. I'm looking forward to getting over the next big hump as well. I'm sure I will. And I'm already curious what I'll write in my concluding wrap-up for this year's personal challenge of contributing in new ways.

Contributing in New Ways - Everything Everywhere All at Once

It's been a while since I last wrote down my thoughts about things that happened, things I've done, things that evolved. And a lot had happened since beginning of the year when I announced my personal challenge for 2024. I would have loved to share a lot more frequently about my endeavors in small social media snippets, yet the last months had been not only busy but energy-draining (due to other aspects). There simply wasn't any energy left to share what I'm doing, and I rather spent the energy available on the doing itself.

As I'm slowly getting back to a more sustainable pace, and back to the kind of busy that I personally like and that gives me energy instead of just taking it, I'm finally ready to share a few things.

So, how did I contribute in new ways in the last months?

 

New Work Contributions

At work, I completed my first backend feature. I've worked on the backend before, yet rather focusing on cleaning up legacy, adding tests, improving things, adapting existing features. Yet I simply never had the opportunity before to add a completely new feature. We currently only have one dedicated backend engineer in the team, so I'm once again filling a gap. Admittedly, a gap that I really like and am way more familiar with than with other endeavors.

I gave a bunch of company-wide learning sessions again, this time experimenting with two new formats. One on offering a dedicated public learning hour on all things security, one on sharing stories from my own team to initiate conversations how to grow the culture we want to see. Both formats were planned as a series of at least five sessions. Both had high quality (though low quantity) audiences so far, and people could take things with them after each session. I am calling that a success.

I've also learned a lot more about very domain-specific compliance topics, processes, audits, and more. These are not topics I'm keen on jumping on (especially compared to the other two), yet it's been another gap to fill and another contribution in a new way.

New Conference Contributions

Speaking at conferences is not a new thing for me anymore. What can be new, however, are new formats, new teaching styles, new session topics, new conferences, and new communities.

I decided to go for new topics and finally submitted my first security-focused conference sessions. I was thinking about this for a long time already, basically ever since I started to invest in security knowledge and skills. Yet it's an especially scary area to step into, and that accounts for conference sessions as well.

I managed to write three new proposals, two workshops and a talk. Two sessions are still waiting for the first conference to give feedback on, one is already accepted! I'll have the honor to give my brand-new "Capture the Flag Together: Security for Everyone" workshop at the free Software Teaming Online Conference 2024. And Lisa Crispin agreed to co-facilitate with me! It's going to be a lot of fun. I just love this conference, and I owe a lot to it. Fun fact, my all-time most booked workshop "Ensemble Exploratory Testing" also has its roots there. Very curious what happens to my new security workshop in the future, and in general to more security-focused sessions. At least the first step is done!

New Community Contributions

Finally, my courageous community contributions! So much to share from the very start. Right after having posted my personal challenge of the year, yet another initiative evolved. I can tell you I'm so very excited about everything. Depending on the initiative, I cannot always share everything publicly right away, yet there's enough to share already!

• Launch an open space security conference together with Claudia Bothe, Claudius Link, Dave van Stein, Janina Nemec, and Ulrich Viefhaus. The TL;DR version: it's happening for real! The Open Security Conference (#osco) will take place on 4-6 October 2024 in Rückersbach, near Frankfurt in Germany. A lot more folks joined as organizers since I last wrote about this initiative. We have further awesome supporters in the closer circle as well. Our website is public (and constant work in progress), first social media presences initiated on Mastodon and LinkedIn. Have you seen our amazing logo created by Janina Nemec? The event will be a full open space conference with the addition of two keynotes to kick it off - one amazing and well-known speaker is already confirmed. We're looking for sponsors, if you have a suggestion for us it's appreciated! Well, a lot more is coming and to be revealed as we go further. There's a ton of more work to be done, this initiative is indeed not getting boring at all. Instead, it's very exciting, and I'm really happy to have such a great organizer team to take this journey with!
  
• Create a security card game together with Martin Schmidt and Philipp Zug. This endeavor took shape as well over the last months. We already had a play session, trying out the game for the very first time. It was such a cool experience to test out the preliminary content and experiment with different game mechanics. And it instantly generated lots of more ideas to improve on. This is a really chill and fun activity and we hope to bring it to open space conferences and the world. Check out our Security Card Game Github org in case you want to follow along.
  
• Build a full-stack open-source practice platform as an ensemble with Ben Dowen and Vernon Richards. Yet another initiative I feel very hyped up about! We are taking the roles of the employees of the fictive company "Make-Believe Labs", taking on "Project Snack Shop" for a customer who wants to digitalize their well-running snack shop business by offering an online shop. For real, I just love this happening. We have an ensemble session each week, and we are all in. From our own vision, to the actual project offer and context, to the first proof of concepts, to team agreements, to design documents, to architectural decision records, exploring walking skeleton options with code, and more. This is just super awesome. We have so many ideas to build on this! We don't have an overarching Github org for this yet to follow along, but stay tuned, a lot more is brewing already.
  
• Offer Shiva Krishnan's and my leadership workshop series to the community. Ah, a longtime endeavor dear to our hearts. This series proved to be valuable to lots of people in the past, and it definitely helped both us grow immensely. Finally, the time has come to spread the word further and transform our workshops to an open community offer. This year we want to try it out with a small cohort. In the first instance, we won't have public registrations, yet will build on our networks for this first community proof of concept. If this goes well, there are plans for more afterwards! It's now really taking shape, and I'm glad to see this. Although access won't be public in the first instance, I'll see what I can share as we go along.

By the way, as if any one of the above wouldn't be enough (they clearly are), there are still further endeavors on my list that I'd love to start. I know, I know, I can't do everything at once, so I deliberately hold back for the moment, as above initiatives (as you can imagine) already fill my time very easily. They also give lots of energy! Lots of growth, too, and I'm not alone in either of them.

As I'm writing this, I'm looking back to the original hypothesis for my personal challenge. While above endeavors are indeed new contributions, quite courageous and also ambitious, I'm also very pleased to see that the hypothesis criteria will be very easy to measure indeed. I won't have any trouble to learn from these initiatives. Seems I'm on the right track, and that's providing me peace of mind already.

I am very much looking forward to see how each of these new contributions evolves over time. Truly exciting!