Tough Puzzles at the Community Privacy Residency
"As soon as you're caught in the room, cryptography won't help you."
Most cryptographers are trained on that separation of concerns. If you're locked in a room, someone can coerce you into handing over your keys, so that part is "out of scope".
During three weeks at the Community Privacy Residency, I met a journalist from an occupied territory, and his reality threw the whole distinction out.
There were daily roadblocks, with military police doing phone inspections. If you didn't unlock your phone, you were detained and your phone confiscated. If there was an encrypted chat app on your phone, you were detained and investigated. If there was a number from the wrong area code in your call log, you could be arrested on terrorism charges. If you were a regular suspect or a journalist, they had no problem leaning on your family with threats of detention. Detention without charge, potentially for years.
So if you need to go to the shop, you can't go with Signal on your phone. Not if you want to come home.
It's based on perception, not reality. Telegram isn't end-to-end encrypted by default, and it got the same suspicion. WhatsApp is, and nobody looked twice.
Anything that looks like encryption is like "waving a flag and saying, come take me."
Plausible deniability, one of cryptography's favourite answers to coercion, made it worse. A soldier at a roadblock who knows hidden profiles might exist on a phone can never know they've seen all of them. That obliges them to keep turning up the pressure. And the more uncomfortable part that took a while to say out loud: think about what this does to someone being interrogated or tortured.
That was one puzzle. There were plenty more.
The train in
Before any of us arrived, everyone was pinging each other on Signal, working out who could ride together from Berlin to the house in Brandenburg. That's how I met the journalist, on the train platform, and it was an embarrassing start. I'd found a free bench, but it was a short train. After an hour of waiting, we only saw it as it pulled out, and we had three hours until the next one.
The village called our old farmhouse "the bunker" because after WWII its facade was redone in typical socialist concrete. About fifteen years before we arrived, a couple bought it, took the concrete off, and started restoring it. They had an ethos, and saw themselves as restoring an environment that had been designed to be adaptive and let people thrive.
High ceilings, big windows and creaky wooden floors. Downstairs, the huge kitchen opened into an even bigger common room, with a modular table long enough for thirty people. Couches ran along the walls. Thirteen bedrooms across two floors. A few tents in the big garden outside, surrounded by farms. The closest shop was in a town eight kilometres away.
We were about thirty people once you counted the mentors and guests staying overnight, and the organisers were putting final touches on the first puzzle: who slept where. A list of special requests, matched against the rooms of an old house.
Then we went round the table and introduced ourselves. I'd seen last year's projects, so I knew the people would be smart. I didn't expect to feel this out of my league. A Brazilian resident protecting activists and journalists who report on cartels. A digital rights lawyer from India, working on internet shutdowns and gender-based violence. New York protest organisers. Prisoners' rights researchers. Legal counsel for massive human rights orgs. A security director for a journalism protection association. A mathematician researching an emerging category in post-quantum cryptography. And someone who popped in a few times to help make lunch, modest but happy to talk shop, turned out to be the Mr. Wolf of TEE architecture.
A world-class cryptographer sat next to someone on the front lines of a freedom movement, and you could feel it both ways: everyone was accomplished, and everyone was a little intimidated. So we introduced ourselves through the institutions we'd passed through, the names that carry clout.
The project I applied with was a way to deliver apps without depending on centralised app stores. I'd also brought a question with me: which problems really matter now, out in the world?
Picking your teachers
On the day people settled on projects, I was tired and behind, and needed more time to read all the poster sessions taped up around the main room.
We'd spent a few days naming real problems from real communities, circulating them, and leaving them for other people to pick up. The idea was to team up around real needs rather than our pet projects. In one group session I asked, "Has anyone heard about the F-Droid problem with Google's developer ID policy?" Most of the room put their hands up, but it didn't get anyone excited.
The guy doing operational security for researchers in Latin America was standing on his own, and I went over, thinking I'd love to learn from him. Like at university: pick the teacher, not the subject. I could just work on whatever he picked. But he was still undecided. Right beside was an abandoned poster: help journalists working in occupations with phone and device inspection/confiscation. If a journalist teamed up on this, would he be interested? I knew one from the train ride. I walked over and asked. He was in too. So it started with the three of us.
There was also a question on the wall I hadn't noticed.
How do you get better forms of identity in chat apps, to keep out imposters?
I wrote a note back, half-joking:
ZK. Who are you?
That note kicked off a collab: a chat app she later named Little Homes. What if the answer wasn't better identity, in the cryptographically verifiable sense, but accepting we can't rely on it, and working from there? Ink & Switch had built something like this, Backchannel: no global key directory. Two people swap a short one-time code, their devices derive a shared key, and that key is the relationship. No global key, no global identifier. I'd been toying with the idea for Infinite Build, where I wanted everybody to have full agency over their group learning experiences. She was circling the same questions for direct action groups.
At the end of the week, we had an event in Berlin at the Casino for Social Medicine. It was packed, with people standing outside on the street looking in. From the shows-of-hands in different presentations, I picked up maybe a quarter of the room were cryptographers or deep in opsec. A huge number had made sure there was no online record of the events they go to. One of us started their presentation with a question, "If I say The Hegemonic Internet, do you know what I mean?" and the place erupted in snaps and laughter.
The barn studio
Back at the farmhouse, some people could put on headphones and work right through the noise of the main room, with the kitchen next door. Some of us needed quiet. So the hosts let us use a studio above the barn.
That's where we worked out Little Homes, on a whiteboard. Arisu, Karoi, Satoshi and Taka stood in for Alice and Bob, and every step had the cryptographic protocol, the UI and the social graph drawn side by side, to keep them congruent. We broke direct action groups down into roles: leadership, staff, super volunteers, and the general community. The horde!
My collaborator advises direct action groups, and she could tell the security needs they have from the ones they feel. They worry about infiltrators, and about adding the wrong person to a group or posting in the wrong place. Hegsething themselves. Their actual risks are around operational security, and data hanging around on insecure devices, but they usually don't see that until it's too late. Membership itself is becoming legal exposure: being in a group where others planned something is used to argue you were part of it. We wanted to address all of this.
For high-risk scenarios, we designed NFC check-ins as a countermeasure to group members being captured, coerced or losing their phones: check in with another member regularly, or you get kicked from the group and the phone auto-deletes message history.
Then we had the question that started this. Identity and impersonation. Almost every chat app gives you one username and one public key that follows you everywhere. Say you've joined your local Alcoholics Anonymous group on Signal. Then you meet someone in a professional context and join their group too. Now they can see you're in AA. On Signal, a common group is a feature. For these groups, it's doxxing. And the central user list gives rise to accidentally adding the wrong person, and a place for people to create look-alike accounts.
So in Little Homes, if you and I are both in rooms A and B, we hold different keys for each other in each. Nothing in room B tells me you're the person I know from room A. No common username, IDs or keys at the protocol level. This means every pair of people in a room needs to introduce themselves with a specific name and a unique signing key for that group.
It doesn't scale, but it doesn't have to: the groups we were designing for maxed out at twenty or thirty people.
Under this system, some things broke right away, like @mentions. The name I use for you, a petname, is mine alone, and can be meaningless (or revealing) to others in the room. What if an @mention was stripped out and turned into a private notification for that message? But then nobody else knows who the message was for, so it's really more like a DM nudge for a public message. And also, one typo can leak your name for someone.
Backchannel syncs through Automerge, a CRDT that keeps its full history forever. That's the right thing for messages and the wrong thing for room keys that are meant to be rotated and destroyed. A rotated key stored there would never really be gone. So room keys live outside it, on the device, where deleting them actually deletes them.
I brought in a problem I keep seeing in online communities. Every online group has an admin who holds the control. But in real communities, the people actually leading often aren't the admins or the staff. They get frustrated and leave, and the admins go looking for new moderators. It turns out this happens a lot in larger US direct action groups too.
So in Little Homes, rooms have no admins. A room's policy is fixed when it's created. To change it, you fork: you start a new room with the new policy, and members of the old room prove their way in. In the app interface, that can still feel like changing the room's settings and pressing Save.
As we worked through each step, my collaborator and I sometimes pulled in different directions. She wanted to protect anonymity across groups more than I did, because accidental doxxing is how these groups get hurt. I wanted something with fewer steps. When you join a room, you announce the name you'd like to go by, and so does everyone else. If you'd rather stay anonymous, you can, and tell your name only to specific people. She wanted anonymity by default, with no announcing. But then every time a room split off, you'd have to swap names with each member by hand.
Whenever we got to an issue like this, we'd stop and ask what assumptions we weren't putting on the whiteboard. Sometimes we couldn't say why we wanted a property, it was more an instinct. Then a scenario would pop up later. There! That's why! It went both ways. We trusted each others intuition and gave the other room to explore. We kept those options open.
She explored an "are you this person?" protocol. Say I'm in a new room and think I recognise you. Can I ask, "Are you Arisu?" The catch: just asking tells a possible stranger there might be an Arisu around, which is a doxxing problem. So we dropped it, but it got us somewhere I didn't expect. Members of a new room already had private one-to-one channels from the old room, so they could use those to share the new room's keys, without swapping codes from scratch. And each person joining could choose whether to introduce themselves, and to whom. Nothing was announced by default.
Week two: Couch City
I met a friend of a resident, an Afghan Canadian, in the garden when she arrived. She introduced herself as being short but not too short to need children's shoes. Her friend introduced her as working for the UN. I kidded her about how all our modern organisations are built the same way, with the same hierarchies, then fail under the same pressures. And somehow we're surprised every time. She said, "we're going to be friends."
The day after, Riley, one of the organisers, grabbed a bunch of us and cut out half of the big table. What was left of it became a coworking table, where people worked with headphones on. We filled the other half with unused couches, carrying them from the barn across the garden. We called it Couch City.
Couch City did a lot. Small teams worked there, and you could overhear and jump in. People were more willing to host a workshop, because the couches made it feel easy-going and less official. Around eleven every night there was an NYT crossword ritual on the projector, everyone shouting answers while one person typed madly.
After dinner, people drifted out to the patio. More than once I passed conversations about old jams: you like that too? Then the stories went deeper. Our parents: the Nigerians would imitate theirs, full accents and body language, and argue with each other in character. The Indians would talk about theirs, and about dealing with their approval. All the coming-out experiences too. Poetry readings. Poetry divinings. A chess board appeared with a label you could flip: black turn / white turn. I played a few turns. There was always something to connect on.
Early in week two, we had our first big meeting since forming teams. Laptops open, people half-listening to each other's updates. I felt it was a bit corporate but didn't know how to say that nicely. Our Afghan guest was asked if she'd like to share an update alongside our projects. Instead she said, "Thanks for offering me this space. I'm going to use it to share how I'm feeling." Looking around the table, she said, "Disconnected." Everyone in the room had been talking about their anti-colonial work, and she invited us to reflect on whether a boardroom table and status updates were the format we really wanted. It was a question for all of us, about habits we'd carried in from our academic and corporate lives. She knew the irony: her own organisation still calls its work "missions".
Our journalism team had grown to six or seven of us, and I was struggling to organise and facilitate. An OTF UX designer offered to run Cade Diehm's Anxiety Mapping workshop for us one evening: get every troubling scenario on paper. Then the journalist combined them into extreme corner cases, the kinds of clusterfuck he had to avoid regularly. Like, "you're detained at a roadblock during an internet shutdown during a flood."
I was like, oh come on, does this really happen? And he said, actually, yeah it has. And later he pushed back even more:
"[Security experts] are always thinking about the threat modeling top-down, like the state does. You're not looking at the human being who's actually fighting something."
My first thought was: that's a great line for the presentation. Then it hit me: I'd come to the residency partly to learn threat modeling from professionals, and here was the person I wanted to do it for, commenting on ten years of threat modeling done for him. But I’ve built products, and I know what happens when you start from the person using them. It struck me that I might have something to offer here.
From there we split off, each of us researching one of the areas he'd identified.
The same designer helped with Little Homes. She sat with us for an hour, then the next day, in about twenty minutes, she speedran ten or fifteen flows. She'd taken our group relationship map, which was never meant for the interface, and told us that was the right mental model, but too complex for a small phone screen. So we jammed on it. What about skewing it into a grid-like space? Swipe sideways between separate social groups, scroll down to the rooms connected within one.
The harder part was telling rooms apart. We'd been debating whether rooms should have petnames too, a name each member sets, or one shared name to anchor some common purpose, like regular chat apps. We never settled it. But when we got to the descriptor text on each room's card, what distinguished a room was its size, the members you know, and most of all the policy for getting in: people in this room are admitted by being in rooms D, F or J, or by invitation from these specific people. The rule for who gets in, written in social terms, turned out to be more meaningful and orienting than a name alone.
The house
Mentors and guests kept arriving. On Fridays there was a happy hour at the house, and people arrived from Berlin in waves with the train.
Some of the visitors were last year's residents. They did a lot of weaving between us, and took care of people's human needs: inviting us to open up to each other, or to look after ourselves when we were pushing too hard.
The house had never hosted a group this big, for this long. It had one fridge, and one standard oven.
From the start, someone found masking tape lying around and labelled every kitchen cupboard, so nobody had to open each one to find a pan. Within hours, other labels appeared: "frozen assets" (on the freezer), "skeletons" (on the closet), "killer robots". Nobody could ever find the recycling box, until it got a huge label: "the future hope of humanity".
Groceries could only be delivered twice a week and overflowed the fridge and cupboards, onto windowsills. One of us had set up a shelf for special-diet food, but if one or two people didn't read the label, food ended up anywhere anyway. Not everyone signed up to the cleaning/cooking rota, which strained the people who did, so someone moved it off a spreadsheet and onto a whiteboard in the kitchen, to help make it easy. But people got confused. The cooking schedule lived in two places, and one day one of our best cooks turned up to find it had changed. Each fix was partial, and the people who broke something weren't doing it on purpose. Different ideas of what's normal, how things should work, what's intuitive, colliding constantly.
The house owners wanted to design an environment where people do good work. We were all designers of digital spaces that other people live in. And here we were tripping over each other on a cleaning rota. It felt a bit like a reality TV show.
One resident had a line for it: solidarity works until someone has to do the dishes. But someone was always in the kitchen, cleaning, loading or unloading the dishwasher, whether asked or not. In the first week, he and a few others took on an evening cleaning shift that wasn't even on the rota.
I took the first cooking shift, the stress test, and when not all the ingredients arrived, an Italian mentor helped me improvise a pasta Parmigiana on barbeques on the patio. I've hosted residencies like this before, so I helped where I could, and the owners and even some residents started assuming I was one of the organisers. In the kitchen one day, I asked Janabel, a mathematician and one of the organisers, if she could express her goals for the residency in terms of group theory: what's the transformation you want here? She thought about it and said, "Our relationship graph goes to diameter 1." Everyone in direct relationship with everyone else. Now I knew where to help: making connections across the little social groups that were forming.
By the second week, some strain was showing. One evening, around the big patio table, the organisers offered an open space for feedback. We'd arrived with different expectations, some of us for the projects and some for the people. Some were juggling day jobs. Everyone spoke with understanding and gratitude, but some of the notes were sharp: hire a facilitator, hire ops people.
Mine was about the fridge. I'd been looking at the house as a system, and most of the kitchen trouble traced back to that one fridge. Only two deliveries a week meant the fridge was in constant 3D Tetris. Ingredients were always lost, making it hard to cook big lunches. Buying a fridge for someone else's house seems crazy but 500 euros would have easily saved a hundred hours across the 20 residents.
The organisers listened. They didn't defend themselves, not once, even for things that weren't on them. When we asked about budget, it came out that they had hired help, on a tight budget, and had been paying for a lot of things out of their own pockets.
It was only their second residency. They'd done it without a big funder, because they wanted something like this to exist in the world: a place for journalists' needs to be met, for protesters to find protection, and for fabulous queer technologies to find their roots. I asked how they chose us, because twenty people who'd never met clicked within days. That's really hard to do so well. They told me they spent weeks imagining different combinations of us together in a house. What would we talk about? They put in a lot of time to get that right because and understood it's about people, not rubrics.
The walks
In the evenings people went for walks. The work came along on the walks too, but more in the way you could ask about the person behind a project. One path out of the village led to an industrial cucumber farm, fifty acres under the windmills. Most of the cucumbers had overgrown to three or four kilos.
There was a whole thing between the people from agricultural places and the people from supermarket places. A lot of us, me included, were nerds about agriculture without having lived it. So there were debates. I thought, those have to be zucchinis. Others said cucumbers, just not edible now. I knew people's different takes, and I'd playfully nudge them into conversations, and watch the awkwardness evolve. It was nice to see such smart people let themselves be caught out on something trivial.
By the end, newcomers were walking out to see the giant cucumbers they'd heard about, and bringing them back for a big salad for everyone.
What people carried
We were all drawn into these causes for different reasons. Look back at that round of introductions: cartels, internet shutdowns, gender-based violence, prisoners, protests. If you work on the front lines of something like that, you've been around trauma. You shoulder the pain of real people you've watched suffer, and have probably been through some shit yourself. Put twenty of us in one house, and there were bound to be conflicts.
A trans resident talked about driver's licences being cancelled, and valid documents with an X gender marker suddenly not being accepted. And about cities and towns where the likelihood of hate crime was enough to plan your day around.
One morning over breakfast, I realised the person I was talking with had been an international athlete, and mentioned that someone else in the house was too. He explained: if you look like me, you have to be the best before anyone will treat you with respect.
There was another resident I'd been looking forward to meeting, and I didn't meet her until three or four days in. She told me about a health project she did in The Gambia, where the local team asked her to get off a bus to make room for the white people, assuming they were the only donors and the doctors. She cried while she told it, the emotion still so present.
A lot of people talked about systemic privilege but her story made it hit home. She gets recruited by companies most people would work years just to interview with, and has turned them down because the reception desk, seeing her skin colour, assumed she was there to deliver something. Taken for a gig worker once, it's a story. When it happens everywhere you go, it's a drag you carry. When it happens in the lobby of a company that wants to hire you, it's a tell about what working there would be like. And there aren't many companies at that level to choose from, so standing your ground costs you. I've read Biko, I've watched Atlanta, and I still have no idea.
She always found the good and made a point of sharing it. When her flight was cancelled, a customer service agent got her onto another one, and she told the whole residency Signal group about it, by name. Thirty of us spent the evening cheering on Julie, in a call center somewhere, who will never know any of us were beaming our appreciation to her.
The protest organisers live with police violence as part of the work. You're trained to avoid a knee on your neck when you get arrested, but you also pick a great outfit for your arrest photo.
Everyone here was carrying pain, but still bringing light.
The greenhouse
By the end of week two, a few of us took a conversation outside, to a table by the greenhouse. The others shared their stories first, and then I shared mine. It was the only time I did.
I've dealt with racist border cops more than almost anyone I know. I know how they look at my passport, pointing at something they purposefully mispronounce. I know the small room they take you to: poor ventilation, a very large government logo on a very small wall, people sat on a rows of metal chairs facing it, with toddlers playing on the floor. I've made my peace with it.
I've been attacked by skinheads and had to fight for my life.
The mixed-race people in the house had a conversation of their own, about fractured roots: looking for your heritage and never finding it in one place. Our UN friend gave me a word for it. She talked about whiteness, and she didn't mean skin colour. She meant whiteness as erasure: corporate norms and consumerist culture spreading around the world and washing out what's specific about anywhere, and anyone. It's a horror-movie force, spreading and cutting all of us off from where we come from. Nobody told me Stephen King was actually writing dystopias.
The search for roots is universal. And I finally realised why white people are always doing DNA tests and proudly announcing things like, "I'm 2.8% Irish and 1.9% Nordic!"
At the residency I learned a term for something I've lived my whole life: white-passing. If I dress a certain way, I look white. If I dress according to my ancestry, I don't. For that trip I'd only packed t-shirts and a baseball hat, and that's how I was seen.
But I was here to learn. So I tried to just keep listening.
Week three: five minutes in the kitchen
In week three, the journalist and I settled into a loop. I'd wake up with an idea, spend the morning researching and expanding it, then find him at some point during the day and see if it held water. Phone profiles died first: work profiles get checked, they're easy to spot, and they cause suspicion. What about a sneakernet, like Fidonet? A slow internet of USB drives moving around the region by car. It had been tried, and now police look for USB keys specifically at the checkpoints they use to control movement. They plug them in and if there's anything encrypted, the bus leaves without you. What about encrypted blobs, something PGP-like but not over email? Forget it. Something like that gets terrorism charges thrown at you. Most ideas ended there: been-there-done-that, or not worth it. But some of our ideas had a shred of something useful, and those became approaches worth a try, strategies that survive all the constraints at once, from network analysis to being detained and coerced into unlocking your phone.
I couldn't stop thinking about another resident's project too. He'd applied with it but hadn't put it into the team formation exercise.
The morning after our group introductions, he'd started a conversation with me about where we were from, and put me onto Langston Hughes' "Who's Passing For Who?"
So it was kinda fun that his pet project was helping workers form unions without disclosing to anyone, including each other, that they were doing it. He'd asked a few people, and they'd said the general version of the problem is considered impossible: the employer controls all the communication systems and all the records.
He wasn't a cryptographer but had come up with one of my favourite parts early on: make it a petition, not a vote. In a vote, an employer faking submissions fakes opposition and wins. In a petition, every fake signature works against whoever faked it.
If you know me, you won't be surprised to learn I thought ZK would solve it. Public and private inputs, a prover, a verifier. A Semaphore Merkle-tree could handle membership proofs. What I hadn't spotted: Semaphore gives you anonymity within a group, but the employer holds all of the employee's information, so it can act as any employee.
I kept thinking, there must be something that made this case different from the general one, one little hook that made this not impossible in this specific case. The employer controls the mail servers, the directory, the devices. Not everything though: not personal phones, not the organisers' own Signal groups, not two people meeting in person.
That was enough to build on. The petition needs every employee to have one stable identifier, so nobody can sign twice. Normally you could hash something unique like an email address. But the employer just hashes the whole staff list, runs each one on the petition system, and knows who signed (and therefore who to fire). When this came up, we paraded over to Ying Tong, one of the organisers. She was in the kitchen, in the middle of cooking us all lunch. "We have this problem. Can I get you for five minutes?" She came over, sat down, drew us a little diagram, and explained VOPRFs. A VOPRF folds in a secret the employer doesn't have, and the server holding that secret never sees the email. I thought the name was hilarious, and that the idea deserved a pronounceable acronym, so I kept calling them "VORPs". She kept correcting me which I found so kind, but also even more hilarious.
Our first version was the standard pattern: publish the list of anonymised identifiers, so anyone can verify the count. Then a cryptographer pointed at the public list. The employer controls every mailbox, so it can submit as any employee and watch the list or the response. If it grows, that person hadn't signed. If it doesn't, they had. So an employer, with an idea of who signed, could verify their suspicion and deanonymise people.
Another problem was proving the results were valid, to third parties like courts. Someone suggested a blockchain, for immutability and proof, recording encrypted records as they were added, then revealing them all at the end. I suggested a massive zero-knowledge proof instead, over the tally itself: every signature valid, nobody counted twice, the total is N. And the list never leaves our hands.
For unionising, the NFC check-in from Little Homes turned out useful: a way for organisers to attest, in person, that someone was a real colleague, folded privately into their signature. It was a cryptographically provable path that the employer couldn't see or control.
Demo day
The last few days, we were all stressing about our presentations. Then we got to Offline.Place in Berlin, and Ying Tong and crew had made a huge effort to cook home-made food for everyone. The crowd that joined us were people from the Friday happy hours and the Casino, but now familiar faces instead of strangers. It was packed again, the front rows were people sat on the floor.
The journalist team presented "Encryption considered harmful". The main thread was simple. When you design cryptographic systems for these cases, the person in the room is exactly who you design for, which means key compromise, device compromise, network observation and metadata all matter. The person caught "in the room" isn't out of scope, they're in the crosshairs. As far as an interrogator is concerned, the more plausible your deniability, the more plausible your guilt.
Another team, Garfield-Naruto, had come at it from the opposite direction. They hide messages in LLM slop: text that looks like nothing, instead of an encrypted blob that looks like something. They're candid that the prototype isn't ready for the most security-critical uses yet. I loved watching how much fun that team had the whole time, and this was the first time I saw a working demo.
I could finally see the other projects I hadn't had time to catch up on. The Gini index project was one something was going to do it anyway, just not at the residency. I'd tried to nudge it along but never managed to do anything but cheering. He explained how people on low incomes in some countries can only afford old Androids that won't get security updates. He talked about the cost of privacy beyond money, like time required and language barriers. Another project was policy work on age verification, and how easily kids get around it. Seeing it presented in research photos and findings after all our little breakfast conversations, it was suddenly tangible. And a security project for national trains: "You were really working on this the whole time?" I asked her. "Yeah, that's why you didn't see me in the mornings. I was working in my room."
I was so tired, and still, I wanted to take this all in. Everything we'd done in this short time.
Trading notes
My favourite moments were one-on-one conversations in some quiet corner of the house or the garden, lasting hours. Life, why we do what we do, the big problems. There's a melancholy in these friendships. What brought us together was our battles, and apart from those in the same cities or conference circles, we won't see each other again without real effort.
That closeness is what drove us to trade notes as travellers do: what's good, what's bad, what to avoid, what signposts to look out for.
When I got back home, that first show of hands stayed with me. About F-Droid. I'd arrived with a very technical, philosophical, and anti-Google view of my project. The political open letters on this make the case top-down, in the abstract. So I started asking about the humanitarian impact of Google's developer verification by looking for real people with real stories. That pointed me to evidence about bigger numbers. Hundreds of thousands of people. Then millions. Then billions. I spent weeks on it, constantly pulled deeper as new questions opened up. And wrote it up here: Google is taking what keeps them alive.
Engineering problems are objective: physics and math. That's what I'm used to. Most people I met at the residency are working against adversaries. Against other people. That's messier, and it brings an angry energy. Anger's useful though: with a constructive environment to direct it, it can clear a path towards something better.
I'd never thought of myself as a policy person, but some residents encouraged me to dip into the at world. I'm surprised how rare it is for the people making policy to go and find the specific cases of who's affected. I've been awarded one research grant based on this approach already.
I came looking for a way back to real people and real problems. The three organisers, who bet their own time and money on a house full of strangers, gave me exactly that.