Personal Context Infrastructure is the most important evolution in personal technology since social media.

The social internet gave us a way to create online - to participate through our content. Social networking first used this power to bring connection, mapping our friends, relationships, and communities. Then social media grew to eclipse it, turning friendship into followership and connection into performance - fueling the creator economy, influencer commerce, and entire cultural movements.

Personal Context Infrastructure will bring the personal internet—the intelligent internet. It provides the missing layer that transforms software from generic tools into personalized intelligence that understands you, adapts to you, and acts on your behalf.

Today’s AI looks magical in demos but feels shallow in practice because it works with fragments of your story. You’re forced to keep prompting and retraining - repeating yourself across disconnected services. Context is gathered in pieces, yet the whole of who you are - and what you need - remains just out of reach.

The Current Fragmentation Problem

ChatGPT doesn’t know your communication style, your calendar app doesn’t understand your energy patterns, your streaming service doesn’t know what you’re working on this week.

Each service starts from zero, forcing endless onboarding processes that never quite capture who you really are. This fragmentation fundamentally limits what AI can do for you - the most powerful AI capabilities require rich context for understanding preferences, predicting needs, automating decisions, and taking autonomous actions.

The problem is that today the stitching together of all this context falls on us. We type, search, compare, and repeat. That is why online shopping feels like work instead of a red carpet experience. It’s 2025: software shouldn’t feel like filling forms.

Personal Context Infrastructure is the intelligent layer that aggregates and interprets the full picture of who you are across your digital life - under your control. Software should serve your life first, not a company’s quarterly goals.

Context is what software knows about you right now; memory is what it carries forward and refines over time. Personal Context Infrastructure connects the two, allowing software to remember you - not just respond.

It turns scattered data fragments into a portable digital identity that flows seamlessly between services on your terms. Think of it as your personal context server - a living memory that belongs to you, continuously enriched by your experiences and guided by your preferences - your LEARNINGS.md for digital life.

The Three Fronts of Change

Rethinking the Business Model

Today’s platforms build moats by hoarding your context—locking it inside walled gardens optimized for time on platform and ad yield. In the process, they fracture your memory across services. Personal Memory Patforms demand new economics: platforms that earn a share of your identity, not your time, and business models that thrive on user-permissioned context liquidity instead of lock-in. See our 2024 paper on the topic here.

Rebuilding the Technical Architecture

Personal Context Infrastructure must be user-controlled by design. Your memory lives on your turf, accessible only on your terms. The context can go where you choose. This is becoming a reality with IEEE P7012 Draft Standard for Machine Readable Personal Terms (i.e. “MyTerms”), which has been in the works since 2017 and is now on track for publication early next year.

“MyTerms are contractual agreements about personal privacy that you proffer as the first party, and the company agrees to as the second party. With MyTerms, you don’t “consent” to the company’s privacy policies. They agree to your privacy requirements, which will limit the use of tracking tech to only what you allow. You are not a mere “user” or “client.” You are an independent human being operating with full agency.”

Shelf will ensure this is true with our hybrid, local-first approach and user-set privacy policies. Individuals will be able to decide how their context is shared, and apps must adhere to those terms.

Earning the Right to Context

Context isn’t merely captured - it’s earned. It comes through interfaces that invite authentic sharing from people who trust you with their digital memory. To be the trusted personal context server, you must prove - consistently and in practice - that you serve the individual, not the system. Trust is earned when people see that their history is theirs to interpret, move, and share - and that your infrastructure protects that boundary every time.

The most powerful signals come from vertical surfaces - each with its own unique affordances. ChatGPT will never know your music taste like Spotify or your watching habits like YouTube; each platform captures a different slice of context.

You can’t build Personal Context Infrastructure in a vacuum. You must fit naturally within each person’s digital ecosystem - earning trust and becoming the home for their digital memory.

Why koodos Is Uniquely Positioned

Most companies attempting this space are missing critical pieces:

• AI companies build general-purpose interfaces that miss the high-signal context within specific verticals

• Privacy advocates often build technically sound solutions that real people don’t want to use

• Consumer apps generate engaging experiences and excel at capturing specific types of context, but each operates within its own domain

Consumer apps aren’t the problem: they’re solving real user needs and building valuable context within their verticals. The challenge is that this context remains isolated, preventing the seamless personalization users deserve across their entire digital experience. Anyone building apps today should think deeply about how their products can know the user and act on their behalf - without re-creating the infrastructure from scratch.

With Shelf, we’re building the technical core - context ingestion, inference, and permissioning - that keeps memory under user control. But we’re building more than technology; technology matters only when culture adopts it. Millions already use Shelf to connect their services and keep a digital record of their lives. Shelf isn’t just what you listened to, watched, read or consumed - it’s a portrait of you: your year, your growth, and the culture you belong to. When something appears on more than one person’s Shelf, it becomes culture. For Shelf to feel like a companion rather than inventory management, it must move at the speed of you, your community, and culture at large. We’re building a brand that not only reflects culture - it drives it.

Context Is All You Need

Context is becoming the most valuable currency of the digital age - it will decide which AI services survive in a hyper-personalized future where actions are taken for you. That power must be distributed and placed in service of the individual.

The question isn’t whether Personal Context Infrastructure will be built – it’s who will build it and whose interests it will serve.

We believe it should serve yours, enabling AI that amplifies human potential while preserving and strengthening human agency. Not by competing with the services you love, but by helping them understand you better, on your terms.

Context is all you need. Make sure it belongs to you.

FYI: still figuring out if I prefer personal context infrastructure, or personal memory platform. WDYT?

So here’s how we learned that 500 million tiny files will humble every “proper” engineering approach you can think of.

It started innocently enough. We needed to backfill our data warehouse as part of our new Ingestion Pipeline. Migrate all our historical consumption data from the old S3 bucket format to our shiny new warehouse ready structure. How hard could it be?

We had two buckets to deal with:

• datamover bucket: 50M files (11M actually had data)

• raw-consumptions bucket: 500M files across ~1.7M users

The datamover bucket was going to be our practice round. Get the approach right on 11M files, then scale it up to 500M. Classic engineering, start small, iterate, then scale.

Spoiler alert: sometimes “scale it up” breaks everything you thought you knew.

Act I: The Proper Engineering Approach

“Let’s do this right. Database indexes, sequential processing, proper state management.”

We built what any engineer would build for a data migration:

create table migration_file_index
(
    id              bigserial primary key,
    s3_key          text not null unique,
    platform        text not null,
    job_enqueued_at timestamp with time zone not null,
    file_size       bigint not null,
    processed       boolean default false,
    created_at      timestamp with time zone default now()
);

With proper indexes, of course, we are professionals:

create index idx_migration_sort
    on migration_file_index (platform, job_enqueued_at)
    where (NOT processed);

create index idx_migration_resume
    on migration_file_index (processed, id);

create index idx_migration_platform_stats
    on migration_file_index (platform, processed);

The architecture was clean:

• DatabaseIndexer: Catalog all S3 files that had data into Postgres

• SequentialProcessor: Process files in chronological order

• PartitionBuffer: Smart batching for optimal warehouse file sizes

It felt good. It felt right. This is how you handle a large-scale data migration.

Then we ran it on our practice dataset.

11 million files took one week.

For the datamover migration, a week seemed totally reasonable. Less than a sprint! Exactly what product wants to hear. “Yeah, we’ll have the historical data migrated by next Friday.” Perfect.

Let me repeat that for emphasis: 11 million files. One week.

I remember staring at the progress logs, doing the math in my head. If 11M files = 1 week, then 500M files = ... reaches for calculator ... 45 weeks.

Forty-five weeks. Almost a year. To backfill the raw-consumptions bucket historical data.

That’s when we realized that all our careful database design, our proper indexes, our sequential processing - it was all overhead. We were spending more time managing the migration state than actually migrating data.

Act II: The Cloud-Native Pivot

“Surely AWS can handle what we can’t, right?”

Time for a complete rethink. Why are we trying to manage 500M individual files when AWS has services built exactly for this kind of massive parallel processing?

Enter the Athena approach:

1. Create an external table mapping to our raw-consumptions bucket

2. Let Athena discover and process all 500M files in a single massive query

3. Output everything to a staging bucket in warehouse format

4. Do a controlled cross-bucket migration to production

The promise was beautiful:

• 2-6 hours instead of months

• ~$100-200 in Athena costs vs. massive compute bills

• Leverage cloud services for what they’re actually built for

// Instead of this:
for (const file of 500_000_000_files) {
  await processFileSequentially(file); // 🤮
}

// We’d do this:
CREATE TABLE warehouse_data AS
SELECT 
  platform,
  user_id,
  payload,
  ingested_at,
  date_partition,
  hour_partition
FROM external_consumptions_table;
// Let Athena figure it out in parallel!

We built comprehensive tooling around it:

• Quality validation (95% success rate required)

• Cross-bucket migration with configurable batch sizes

• Progress monitoring and error recovery

• Staging-to-production promotion pipeline

It was elegant. It was cloud-native. It was exactly the kind of solution you’d present at a conference lol.

And Athena choked.

Turns out even AWS services have limits when you point them at half a billion tiny files. Queries would time out consistently. Tuns out 500M files is just too many god damn files!!

The cloud-native dream tried hard, but it died.

Act III: The Big Machine Epiphany

“You know what? Let’s just use a really big machine.”

Sometimes the most sophisticated solution is admitting when sophistication isn’t working.

We spun up an i4i.metal instance:

• 128 vCPUs

• 1TB of RAM

• 30TB of NVMe storage

• 75 Gbps network

The plan was beautifully simple:

1. Download everything to local NVMe storage

2. Process it with maximum parallelism

3. Upload the results

No databases to maintain. No cloud service limits to hit. No complex state management. Just raw compute power and storage bandwidth.

Step 1: Setup the Beast

# Create RAID 0 across all NVMe drives
NVME_DEVICES=$(lsblk -nd -o NAME | grep nvme | grep -v nvme0 | sed ‘s/^/\\/dev\\//’ | tr ‘\\n’ ‘ ‘)
sudo mdadm --create /dev/md0 --level=0 --raid-devices=$NVME_COUNT $NVME_DEVICES
sudo mkfs.ext4 -F /dev/md0
sudo mount /dev/md0 /mnt/nvme

Step 2: Download Everything

# s5cmd with 4096 workers to max out the 75 Gbps network
s5cmd --numworkers 4096 cp “s3://consumptions-raw/*” /mnt/nvme/raw-data/

Enter s5cmd - if you haven’t used it, it’s like AWS CLI’s faster, more parallel cousin. While aws s3 cp might give you decent performance, s5cmd is built specifically for high-throughput S3 operations. It can spin up thousands of concurrent workers and actually saturate high-bandwidth connections.

With our 75 Gbps network and s5cmd cranked up to 4096 workers, we could download at speeds that would make your standard S3 sync weep.

Step 3: The Organize Breakthrough

This is where it got interesting. We needed to transform the data from:

platform/user123/2024-01-15T14:30:15.json
platform/user123/2024-01-15T14:45:22.json  
platform/user456/2024-01-15T14:32:18.json

To warehouse partitions:

platform=spotify/date=2024-01-15/hour=14/part1.gz

Our first approach was to process files sequentially, organizing by timestamp. Still too slow.

Then came the insight: “Wait, we have ~1.7M users here. What if we parallelize by user instead of by file?”

# Instead of processing 500M files sequentially:
for file in $(find . -name “*.json”); do
    organize_by_timestamp $file  # Still 500M operations!
done

# Process ~1.7M users in parallel:
find raw-data/ -maxdepth 2 -type d -name “user_*” | \\
    parallel -j 128 ./[organize-single-user.sh](<http://organize-single-user.sh>) {} /mnt/nvme/partitions

Each worker would:

1. Take a user directory

2. Parse all their timestamp.json files

3. Route each file to the correct date/hour partition

4. Coordinate at the partition level to merge everything

This reframed the problem completely. Instead of “how do we process 500M files?” it became “how do we process 1.7M users in parallel?”

One is hard. The other is Tuesday.

Step 4: Process Partitions

Now each partition could be processed independently:

# Each partition just worries about:
# 1. Collecting all files for that date/hour
# 2. Gzipping them efficiently
# 3. Creating warehouse-format records
find /mnt/nvme/partitions -name “file_list.txt” | \\
    parallel -j 128 --progress ./[process-single-partition.sh](<http://process-single-partition.sh>)

Step 5: Upload and Snowpipe Magic

# Upload to partitioned S3 structure
s5cmd --numworkers 4096 cp /mnt/nvme/output/* s3://raw-extractions-prod/data/

And here’s the beautiful part: once the files land in S3 with the correct partitioned structure (platform=spotify/date=2024-01-15/hour=14/), S3 notifications automatically trigger Snowpipe to ingest them into our data warehouse. No manual intervention. No complex orchestration. Just files appearing in the right place, and the rest happens automatically.

It worked. Fast.

And here’s the kicker: the entire 500M file migration took about a week. The same time it took our initial database approach to handle 11M files.

Let that sink in for a moment. We went from processing 11M files in a week to processing 500M files in a week. That’s a 45x improvement in efficiency, not just from throwing more hardware at the problem, but from completely reframing how we thought about it.

What We Actually Learned

About Scale

500 million files isn’t just “a lot of files.” It’s a scalability problem that broke our initial assumptions and iterations.

The overhead of “doing it right” - indexes, state management, proper abstractions - can exceed the actual work when you hit extreme scale. Sometimes the most elegant solution is the one that avoids the problem entirely.

About Problem Reframing

The breakthrough wasn’t better algorithms or more sophisticated architecture. It was changing the unit of work:

• ❌ “How do we process 500M files efficiently?”

• ✅ “How do we process 1.7M users in parallel?”

Sometimes the bottleneck isn’t compute power, it’s how you think about the problem.

About Cloud Services

AWS services are incredibly powerful, but they have limits. You just have to test them!

“Cloud-native” isn’t automatically better than “local processing with a big machine.” The right tool depends on your specific constraints and scale.

About Engineering Pragmatism

The best architecture is the one that ships. There’s real elegance in recognizing when your careful abstractions are getting in the way and just solving the actual problem.

Sometimes “just use a bigger machine” isn’t lazy engineering, sometimes it’s the sophisticated approach.

The Real Lesson

This isn’t a story about finding the “right” solution. It’s about recognizing when your assumptions break down and being willing to completely change approaches.

• Approach 1 failed because we tried to apply normal database patterns to abnormal scale

• Approach 2 failed because we assumed cloud services could handle anything

• Approach 3 succeeded because we stopped trying to be clever and just solved the problem

The most elegant engineering isn’t always in the architecture - sometimes it’s in knowing when to stop being architectural.

Now our data warehouse hums along, ingesting new files automatically via Snowpipe, and our 500 million historical files are exactly where they need to be. Sometimes brute force is the sophisticated solution.

Want to work on problems like this? We’re hiring widely at Koodos. If this kind of scale, reframing, and pragmatism excites you, drop us a line at team@koodos.com.

As we hurtle toward the development of Artificial General Intelligence (AGI), a system capable of understanding, learning, and performing many of the intellectual and creative tasks a human can, questions of agency become even more pressing.

The Evolving Concept of Agency

In the social sciences, "agency" refers to the locus of action — where power to act resides (Denzin, 2014). Whether it's within individuals, organizations, or even machines, the definition of agency varies across disciplines. Some, like Foucault (1970), argue that agency emerges through discursive practices, while others suggest that machines are merely “objectifications” of human intent (Knoblauch, 2020).

But today, this debate has evolved into something more complex. Can machines possess their own agency, or are they just tools that reflect human will? Social phenomenology suggests that humans often perceive machines as intentional, even though machines merely act based on algorithms and data patterns. This creates an interesting paradox: while we build machines to serve us, they often seem to act autonomously, influencing our behavior in subtle ways (Gunkel, 2020).

“Agency […] is not inherent; it is permitted”

— Henrickson, 2018: 7

As AGI looms closer, this paradox intensifies. If machines gain the ability to perform tasks across a vast array of domains, indistinguishable from human thought, how do we negotiate control? Is AGI simply an extension of our own capabilities, or does it represent a new form of agency, independent from us?

A New Kind of Agency: The Rise of Hybrid Control

Scholars like Latour (2007) and Gunkel (2020) have suggested that agency doesn’t belong solely to humans or machines, but is distributed between them. In this view, agency emerges in the “in-between” — in the relationships and interactions between people and the technology they use. This hybrid agency redefines our understanding of power dynamics, complicating simplistic notions of who (or what) is in control.

Take the rise of AI agents, for example. They’re meant to assist us with various tasks, from scheduling meetings to helping us file our taxes. But while they simplify our lives, they also raise questions about the hidden power dynamics at play. Who really has the agency here? The user? The machine? Or the company that designs and controls the technology?

As AGI progresses, these relationships will only become more entangled. An AGI system that can process immense amounts of personal data, perform complex tasks, and even make independent decisions will redefine the boundaries of agency, forcing us to rethink the roles of humans, machines, and the corporations behind them.

Access Control as a Lever

Consistent and pervasive access controls, embedded in nearly every digital experience, mean that we never truly access content in isolation. Each interaction — whether browsing social media, sharing a photo, or interacting with AI agents — is mediated by layers of authorization and authentication.

These layers create ongoing, often invisible, relationships not just with the digital environments we engage with, but also with the entities that manage, own, and profit from them. This is something we’re tackling head-on at koodos with DataMover and Shelf.

The Privacy Paradox

We often hear that people are concerned about their online privacy — but the truth is that most people don’t.

A part of the reason is that the average person, when faced with the complexity of protecting their data, is overwhelmed. Setting up and managing personal data stores — systems designed to help individuals control and protect their digital information — requires technical know-how. Users must import their data, assign permissions, and continuously monitor for security risks. For most, this process feels like a burden, creating a barrier to entry. This is something we’re exploring more deeply as part of our joint residency with IDEO.

Because of this, consumer value propositions focused purely on ownership and control of personal data struggle to gain traction. While the need for privacy is acknowledged, it lacks the urgency in practice unless it’s tied to a clear utility that impacts daily life.

Utility-Driven Agency

To move beyond the privacy paradox, we need to rethink the role of agency over personal data. Instead of framing it as an abstract right or responsibility, agency must be tied to direct utility — to something that makes life simpler, more enjoyable, or more efficient. When the value of controlling data is tied to real-world benefits, users are more likely to engage.

A great example of this shift is seen in design patterns that focus on user-friendly, intuitive data control. Apple’s approach to data permissioning, for instance, exemplifies this trend. When a user connects a new app to their photo library, they aren’t forced into an all-or-nothing decision. Instead, they can selectively grant access to portions of their library, and they are regularly reminded of this permission, with the option to revoke or adjust it later.

At koodos, we’ve built Shelf — a platform that lets individuals track their digital consumption and curate a public showcase of their taste. By using Shelf, users can aggregate their consumption data in one accessible place. We have been studying the technological shifts around personal data storage and compute — from local-first approaches to private cloud compute — but the challenge isn’t just technical. It's about enabling meaningful engagement with that data, empowering users to reflect on and share their tastes as a means to re-aggregate users’ data in a personal data store that they can control access to over time.

We intend to offer a balance of control and utility that empowers users in meaningful ways, rather than simply overwhelming them with abstract concepts of privacy.

Reclaiming Agency in a Datafied Society

The rapid rise of AI agents, which need access to our private data to perform tasks on our behalf, only amplifies the need for individuals to have centralized control over their data. These AI-driven systems demand a level of access that raises new questions about agency — not just who owns the data, but who has the power to act on it.

Yet, as much as we talk about giving users control, the truth is that even the most sophisticated AI agents don’t function in isolation. They are still shaped and constrained by the companies that build them and the ecosystems in which they operate. As consumers, we are simultaneously actors and acted upon, entangled in a web of relationships that we rarely perceive in full.

As machines become more autonomous, we must grapple with the reality that agency is not a binary, but a spectrum. It’s not simply a question of whether humans or machines are in control; it’s about how we share that control in an increasingly intertwined relationship.

The real challenge, then, is not just about designing systems that give individuals control over their data. It’s about recognizing and navigating the hidden layers of agency that exist between humans, machines, and the corporations that mediate these interactions. The future of agency lies not in choosing between human or machine control, but in understanding how these forces intersect and interact in our everyday lives.

In a world where the lines between human and machine agency are increasingly blurred, we intend to be pioneers in helping users navigate the complexities of a datafied society with tools designed for real utility, control, and empowerment. This is the future we are building — one where agency isn’t just reclaimed, but redefined. We’re excited to be publishing a collaborative paper that discusses the future of the data economy soon.

• Van Dijck, J. (2014). Datafication, Dataism, and Dataveillance: Big Data between Scientific Paradigm and Ideology. Surveillance & Society, 12(2), 197-208.

• Abiteboul, S., & Dowek, G. (2020). The Algorithmic Society: Technology, Power, and Knowledge. Cambridge University Press.

• Hallinan, D., & Striphas, T. (2016). Algorithmic Cultures: Essays on Meaning, Performance, and New Technologies. Routledge.

• Schuilenburg, M., & Peeters, R. (2021). The Algorithmic Society: Power, Knowledge, and the Future of Governance. Routledge.

• Foucault, M. (1970). The Order of Things: An Archaeology of the Human Sciences. Routledge.

• Giddens, A. (1984). The Constitution of Society: Outline of the Theory of Structuration. University of California Press.

• Ricaurte, P. (2022). Algorithmic Cultures and Datafication: A Critical Reflection. New Media & Society, 24(4), 732-748.

• Knoblauch, H. (2020). Communicative Constructions of Reality: Semiotic Mediation and Society. Springer.

• Latour, B. (2007). Reassembling the Social: An Introduction to Actor-Network Theory. Oxford University Press.

• Gunkel, D. J. (2020). The Machine Question: Critical Perspectives on AI, Robots, and Ethics. MIT Press.

• Henrickson, L. (2018). The Entanglements of Agency: Philosophical Reflections on AI, Autonomy, and Human-Machine Relations. The Journal of AI Research, 45(7), 1-20.

• Rammert, W., & Schulz-Schaeffer, I. (2002). Technological Action: Agency and Normativity in Human-Technology Relations. Cambridge University Press.

• Barad, K. (2007). Meeting the Universe Halfway: Quantum Physics and the Entanglement of Matter and Meaning. Duke University Press.

• Coeckelbergh, M., & Gunkel, D. J. (2023). The Philosophy of Artificial Intelligence: Contemporary Debates. Oxford University Press.

This week we’re so excited to welcome the ladies of the Celebrity Memoir Book Club podcast: @ashleyhamm & @clairethescare

Fitting in their incredible taste of movies, books, tv shows and music into a 90 second video may have been the hardest thing we’ve ever done tbh.

Featuring:

• True Blood

• America’s Next Top Model 

• Nickelback 

• In Her Shoes

• My Brilliant Friend by Elena Ferrante

• Sisterhood of the Traveling Pants

What’s Shelf? A fun way to learn about you and your friends’ taste — from music, to shows, movies, books & more! It’s like the lovechild of Spotify Wrapped, Letterboxd, and Goodreads.

To stay in the loop with new episodes, follow us on Instagram. Check out the other episodes here.

On this episode of What’s on my Shelf, we’re welcomed by Brooklyn food review TikToker Alex @mutammara. Follow Alex’s Shelf at shelf.im/mutammara 

Featuring:

• League of Legends

• Sex Education

• Paramore @haileywilliams 

• Colorado @reneerapp 

• Live for Me @omaropollo 

• Jujutsu Kaisen

What’s Shelf? A fun way to learn about you and your friends’ taste — from music, to shows, movies, books & more! It’s like the lovechild of Spotify Wrapped, Letterboxd, and Goodreads.

To stay in the loop with new episodes, follow us on Instagram. Check out the other episodes here.

On Control, Accountability, and Authority

In an effort to mirror what it’s like building a product and company, I ran an activity where my team had to piece together a puzzle without knowing the intended final image. When building a company, we have to be open to the fact that we don’t know what the final outcome needs to be as the puzzle pieces come together. And yes, even the founder doesn’t really know what the final image is. This led to a dialogue around whether stepping in or standing back was the most effective mode for the CEO to be in, especially considering the unique insights team members brought to specific segments of the puzzle.

Brian Chesky suggests that detail-oriented involvement from the CEO is crucial for maintaining alignment and momentum. He posits that the more proximate the main decision-maker is to the project the better. At the early stages, the founder is domain expert in many aspects of the company, but as the organization expands, the domain expert should ideally be the decision-maker, and often this isn’t the founder. Finding the balance between being in the details and empowering autonomy becomes a sophisticated dance of leadership.

Logically-speaking, I (as the CEO) am ultimately held accountable. And as a leader, I am in a unique position where I could have a lot of control, and could also shift accountability internally. So someone who's directly responsible for a project could technically have no authority (just do what Jad says) and full accountability (if the project goes south, they're ultimately responsible). And so where there’s accountability, there must be agency. And agency requires trust and letting go of control.

A rule of thumb my friend Matt Braley shared is to train the leader do the job to our standards, figure out how to measure the standard, then step away when we see the standard is met 80%+. Naturally, I’ve found that I let go when I trust the person, and I won’t when I don’t. If I don’t trust handing over the reigns, I should really ask myself “can we up-skill the person in a reasonable time so that we’re comfortable?” And if not, then the difficult question should be “why is is this person on the team?”

Despite my ultimate accountability as CEO, or someone's direct responsibility for overseeing progress towards a goal or project, it is essential to establish expectations and foster an environment where everyone takes ownership. That means that no one person is to blame, and that every member on the team is taking 100% responsibility. Everyone accepts their part in both successes and setbacks, openly discusses contributions to challenges, and actively works together to find solutions, fostering a culture of accountability and shared growth. Creating a culture where collective ownership is embraced means that success and failure are shared, fostering an environment of mutual accountability and collaborative growth.

On Whiplash

Navigating a startup is inherently turbulent, with constant learning and shifting priorities. Deciding what takes precedence and for how long is incredibly challenging but critical to progress. This journey demands a blend of urgency and the acceptance of imperfect processes, focusing on agility and on-the-fly problem-solving rather than flawless execution from the outset.

The CEO's actions can rock the boat even more as it navigates the turbulent waters. Underpinning it all is the view that clarity is kindness, and that getting to clarity is the ultimate goal. A few things worth aligning around could include:

• How much time we're "budgeting" for a bet, so that we're committing to a focus for some time, and also so that we're thinking about the scale of the project based on a specific time horizon.

• What part of the discovery process are we currently in? Are we diverging? Exploring different approaches, sketching 100 solutions, running lots of quick tests in different directions, etc. or are we converging: narrowing our focus, testing one thing out and maintaining constraints? 

• The communication flows day-to-day, ensuring that we're collaborating (and not working in silos) as much as possible, and also making room to check in that we're on track for a high impact project and naturally pre-morteming so things just float when there are blockers. Importantly, we should aim to do this in a way that doesn't apply unnecessary pressure or constrains creativity and play.

On Conscious Leadership and ‘Amping It Up’

I find myself toggling between two versions of myself as a leader.

The first: the empathetic, people-first servant leader. A la Concsious Leadership Group.

The second: the driven, results-focused executive that runs towards discomfort and doesn’t accept coasting. A la Frank Slootman’s Amp It Up.

This internal conflict generates both personal anxiety and confusion among my team regarding which version of me they’re dealing with. My goal is to forge an integrated leadership style that harmonizes these aspects, leveraging their strengths to guide my actions and decisions.

On Learning and Anxiety

I tell myself that it’s very natural to be anxious when we're trying to do something very hard, especially when the process requires making a lot of mistakes on the way. Rome wasn’t built in a day, and neither is the process of inverting the internet’s personal data model. Unlocking a retentive consumer product lots of people love is something very very few products can get to — and so I must remind myself that we’ve already achieved more than most startups can dream of.

I had heard many times that startup success is PACE OF LEARNING. But it took me a while to internalize that. A good way to maintain a strong pace of learning is to be in discovery mode – and this applies even at established companies (see: Kodak, or every big tech company that is trying to be bold and take risks again).

One way to reduce anxiety is to shift to a discovery mindset that celebrates learning, not just results. And to trust the process and maintain that learning will lead to results. There’s a lot of inertia against shifting toward a discovery mindset:

• Conditioning: We've been rewarded our entire lives for being right, knowing all the answers, and avoiding mistakes. But perfectionism slows us down when we need to learn by trial and error. We'll suffer endlessly unless we get comfortable with being wrong, not knowing the answers, and making mistakes.

• Incentives: Typically folks get recognized for results over learnings. That’s how we’re typically rewarded through school. This might work well in established businesses where the levers are well understood. But at a startup, we first have to learn what the levers are before we can set the right targets and strive for results. And learning leads to out-sized results.

• The illusion of knowledge: We can't learn things when we believe we already know, so this illusion of knowledge hinders our effort to discover. Recall the bull: beauty is in the simplest outcome (and often we’re stuck amidst the higher complexity phases, and so we actually don’t really know until we get to the simplest form of the bull or can explain a complex concept like a 6 year-old). We often view new information, especially contradictory information, as a threat thanks to our various cognitive biases (including our friends confirmation bias, hindsight bias, consistency bias and sunk cost fallacy).

This requires balancing being a confident visionary with being a curious, skeptical scientist. It's less about feeling confident we have the right answer, and more feeling confident that we can figure it out. When we work from a place of insecurity, we see information as a threat. But new information is the currency of discovery. Great scientists build the confidence to push aside their self-doubt and run toward surprises. To seek discomfort. A discovery mindset means openness, experimentation, focus on users and data, collaboration, bold thinking, and risk-taking.

Subscribe now

Hit reply and let me know if this was interesting or useful, or not. This is an experiment :)

On this episode of What’s on my Shelf, we’re welcomed by model and activist Dominique (@dominiquerashae) to tour her stunning Shelf.

Featuring:

• Vintage Playboys

• Dead Ringers

• Steve Lacy & Calvin Harris

• Sitting on Top of the World by Burna Boy & 21 Savage

What’s Shelf? An app to showcase everything you’re into rn. It’s the lovechild of Spotify Wrapped, Goodreads and Letterboxd. Available to download on iOS and to pre-order on Android.

To stay in the loop with new episodes, follow us on Instagram. Check out the other episodes here.

What’s on my Shelf episode 7 is with koodos labs’ very own Simona.

Featuring:

• Fourth Wing @rebeccayarros

• SATC @everyoutfitonsatc

• @chappellroan

• @kardashianshulu @kimkardashian

• Garden State @hulu

• Anomia
  

To stay in the loop with new episodes, follow us on TikTok & Instagram. Check out the other episodes here.

What’s on my Shelf episode 6 is with the one and only Avantika, aka Karen in the new Mean Girls OUT TODAY. Avantika is a multi-hyphenate artist, the youngest South-Asian to Star and Executive produce a 'Crown of Wishes' series and is also a current student at Columbia.

Featuring:

• Grand Budapest Hotel 

• Percy Jackson 

• Film camera 

• Giant water bottle 

• The New York Times Magazine 

• Mean Girls 

To stay in the loop with new episodes, follow us on TikTok & Instagram. Check out the other episodes here.

On episode 5 of What’s on my Shelf, we’re welcomed into writer, producer and stand-up comedian Moss Perricone’s home! He’s worked on shows like Beavis & Butt-Head, The Patriot Act with Hasan Minhaj, The Other Two and most recently Mindy Kaling and Charlie Grandy’s Velma for HBO Max.

Featuring:

• Serge Lutens Parfum 

• Have One On Me

• Codex Seraphinanus

• The Wilder Shores of Gastronomy 

• Talk to Her

• Oscar Picollo Lamp 

To stay in the loop with new episodes, follow us on TikTok & Instagram. Check out the other episodes here.

On episode 4 of What’s on my Shelf, we’re welcomed by Brooklyn-based artist Courtney Kinnare in her home studio.

Featuring:

• INVT

• The Artist’s Way

• Nikon Coolpix 3000

• Money Heist

• Chrome Nail Powders

To stay in the loop with new episodes, follow us on TikTok & Instagram. Check out the other episodes here.

On episode 3 of What’s on my Shelf, we’re welcomed by New York City’s very own clout guy aka Jean-Luc. Jean-Luc walked so the Tabi Swiper could run….

Featuring:

• Oppenheimer Muscle Milk

• A Fish Doesn’t Know When It’s Wet by Pharrell 

• Ring Light and his Calvins

• The Idol

• Material Girl

• Prada Loafers  

To stay in the loop with new episodes, follow us on TikTok & Instagram. Check out the other episodes here.

You can follow Kailey’s Shelf at shelf.im/kailey.

Featuring:

• A good ol’ Chicago Bulls Jersey

• Something to Give Each Other by @troyesivan

• The 1975 (specifically their @chickenshopdate)

• Gilmore Girls

• Hello Kitty Island Adventure,

• A Court of Thorns and Roses by @therealsjmaas

What’s on my Shelf? is an award-winning* series featuring creators, artists and tastemakers sharing what's on their Shelf. To stay in the loop with new episodes, follow us on TikTok & Instagram. And check out the other episodes here.

*manifesting.

On this episode of What’s on my Shelf, we’re welcomed by comedic legend and freelancer extraordinaire Corbin Chase. Bet you can’t name one person who’s both a charcuterie stylist and been on 2 seasons of American Idol….

You can follow Corbin’s Shelf at shelf.im/corbinchase.

Featuring:
-Tangos by Les Baxter 💿
-SSX 3 🎮
-How to Have Impossible Conversations by Peter Boghossian 📚
-Olivia Rodrigo for Paper Mag 💜
-Suspiria 🎥
-Team USA Gymnastics videos 📺

*manifesting.

To stay in the loop with new episodes, follow us on TikTok & Instagram. Check out the other episodes here.

On New York.

I'm frequently asked why koodos labs is building a team in NYC. In essence, this city possesses the highest ambition per capita and the most culture per square foot globally. To establish a generational company that centers culture, these are indispensable elements.

On philosophy in tech

There’s a noticeable lack of deep thinking and introspection in the tech world. It's common to find that foundations are incorrectly laid. However, this isn’t to say we should spend our days in deep thought and avoid shipping regularly to gather feedback and iterate. Scientists also run experiments & talk to people to validate their mental models. They don’t just think.

Unearthing the “secrets” that underpin creative works demands production. The resonance of many profound creative pieces stems from a deep understanding of the human condition; and to get there the creative process necessitates a significant amount of trial and error.

On content discovery

Content discovery is not a burning user need. Yes, there are plenty of problems with content discovery, and yes “we don’t know what to watch” sometimes — but we’ve found that it’s simply not a burning human need and there are plenty of channels to discover content today. People aren’t short on new content. We’ve chosen to frame content discovery as an outcome of our experience, not as a need or value proposition for using our product.

On distribution & the deadly sins.

Attention is the most scarce resource. Platforms, driven by the goal of maximizing time spent and ad views, exploit basic human desires—often summarized as the “deadly sins” of lust, gluttony, greed, sloth, wrath, envy, and pride. This model, when it becomes the foundation of user engagement, instigates a destructive cycle.

In our journey, we’ve anchored on share of identity, instead of share of time. That there’s ongoing utility, joy and insight unlocked from continuous use — that it can be generative and cathartic, without being a time suck or numbing. The idea that Shelf and Self are one letter apart, and that users should be able to see themselves on their Shelf. This is especially important as we shift ownership of one’s identity, and the data that underlies it, to the user.

Nonetheless, the dynamics of distribution are distinct. It revolves around seizing attention amidst the endless demands on it. The deadly sins can make a product resonate, create allure, and quickly occupy mental space. While the sustaining attributes and foundations of a retentive product might not be based on these patterns, it’s evident that effective distribution articulates how a product caters to intrinsic human desires or fears from the onset. It’s possible to align good long-term intentions, avoid gimmickry, and leverage innate human desires for distribution simultaneously.

On the future

I envision a world where diverse tastes are not just tolerated but celebrated; where our similarities unite us and enable us to see beyond the superficial, appreciating each other’s essence. A world where our differences are not viewed as reason for division, but as gateways to uncharted terrains awaiting exploration. We don’t need a second brain, we need a second heart. We need more soul. I imagine a world where our data is unequivocally ours, where we can keep all our stuff in “virtual USBs” that can be connected and disconnected at will, fostering a sense of ownership and empowerment in the infinite expanse of the internet.

Subscribe now

Critics, Analysts, and Tomorrow’s Tech

The narrative in academic spaces like the Berkman Klein Centre tend to have two distinct voices: the critics and the analysts.

Critics, with their incisive observations, lay bare systemic gaps and push for transformative reforms. Their critiques, although usually lagging, capture public opinion and foreshadow regulatory shifts — vital exposure for people building future-oriented technology.

Meanwhile, analysts weave theory and historical insights to paint a picture of what lies ahead. While some ideas born out of academic thought, such as fresh approaches to personal data management, might still be in their nascent stages, they're on the cusp of becoming our reality. It was at the BKC that I had my first exposure to questions around media consumption and self-presentation, the practical limitations of data interoperability, privacy techniques to empower individuals and many of the other themes we touch on at Koodos Labs.

Foreseeing the AI Wave

At the heart of the conference was the question of AI's future trajectory and impact on society. In the shadows of the social media era, there's an urgency to comprehend the potential spirals AI might trace. But what offers hope is the present-day academia and policy-makers' proactive and pragmatic approach, a stride towards anticipated challenges with purpose.

The Quiet Power of Scholarship

To some, academia seems slow and completely disconnected from the reality of building for users and markets. While there’s some truth to that and there’s a very strong need for builders and scholars to meet, it’s precisely the unhurried pace of scholarship, steeped in thought, that grounds us. It’s the time to theorize, discuss, tear down and build again.

Whereas for builders with limited runway and market demands, we're often running against the clock, making it easy to miss alternative approaches or the nuanced implications of our endeavors. When there’s urgency, we tend to retrofit solutions based on what we’ve come to know and it’s very hard to break that pattern. The more access to knowledge we have, the more of an edge we can have as fast-moving builders.

Towards Pragmatic Idealism

I was inspired by Jacinda Arden, New Zealand’s former Prime Minister and now a BKC Fellow. In her efforts to run a country and make policy decisions at speed (like during the Christchurch attacks and COVID), she had limited access to data and had to intuit her way to decisions quickly. She regularly referenced a frame of reference: “pragmatic idealism”: seeking to realize (seemingly unreachable) ideals by taking into account practical considerations. It's a philosophy that resonated deeply with me. When applied to the role of tech innovation, her perspective was that technology magnifies societies existing ills and isn’t a source of our ills. This viewpoint not only shifts the problem's definition but also broadens its responsibility beyond the people building technology — although there’s a need for tech founders to consider societal impact alongside maximizing financial returns — a necessary goal for any venture-backed company.

In closing, as the Berkman Klein Centre marks a quarter-century of intellectual leadership, it serves as a potent reminder of the symbiosis between the tech world, policymakers and academia. Their combined insights foster not only innovation but also responsibility. Whether we're addressing what the future of social media is, the challenges of AI or decentralized technologies, valuing critics and analysts, or pondering the deeper lessons of scholarship, the guiding light remains: to create technology that pushes society forward. It's a journey of continual learning, and I'm grateful to be a part of it.

Subscribe now

In this post we will dive deeper and demystify how apps actually implement authentication. Do it right, and you barely notice it. But do it wrong, and you lock users out or open major security holes.

We'll see how apps authenticate you, from old school passwords to slick new standards like WebAuthn, and we’ll get our hands dirty discussing security and usability trade-offs, encryption, individual sovereignty, and more!

By the end, you'll have a solid grasp of how real-world apps tackle authentication using the methods we've covered.

Let's get started!

Authentication 🪪

The first thing you do when you log into an app is identify yourself.

This might be using some kind of identifier — typically an email address or phone number — or logging in through Google, Facebook, or some other third party service, and using their knowledge of your identity instead.

Taking that identification and ensuring that it is yours is the process of authentication1. Once you’re authenticated, you can use the app!

In the earlier post we explained that authentication can be achieved in one of three different ways. You can demonstrate that you:

• know something

• own something, or

• are something

Only the person you're identifying as would know or own this information, or have that identity.

All modern apps use a technique that boils down to one of these three methods to authenticate you.

So let’s look at each in turn!

Knowledge-based authentication 🧠

Password-based authentication uses the first of these authentication methods — it verifies that you know something only the user you're logging in as would know: their password, pin, passphrase, or any other secret shared between the user and the service.

To prevent attackers being able to access your account in case an app’s authentication data is leaked through a hack, the app doesn’t actually store the password, but a hashed2 version of it.

Roughly speaking, the hash of your password is like an encrypted version of your password, except that given your password’s hash, it’s very hard (near-impossible, if hashed correctly) to retrieve the original password3.

Limitations of passwords

Implementing password-based authentication yourself is fraught with difficulty.

Some of the “fun” challenges you can anticipate are:

• Properly implementing passwords — You need to manage salting, hashing, encryption and then store them securely in your database.

• Password recovery flows — You’ll also need to implement email-based password recovery. But what if your password-recovery emails go to spam? Having angry users contact customer support because they can't log in is not fun.

• Handle "password1@3" — You'll quickly realise that people like to use weak and easy-to-guess passwords.

  This could allow hackers to find a password through a dictionary attack4 — something they can do if they get access to a leaked version of the database, for example — before later gaining access to the running system.

• Block bots — Users also really like to reuse passwords5, so you might have hackers attacking your system because of a data breach on a completely different website. Blocking these hackers when they’re attacking your site from many different IP addresses is a major challenge6.

• Additional friction - There will be quite a few users who won't have the patience to go through the password-recovery flows after forgetting their password. Instead, they just give up and go do something else. Forcing your user to remember something to log-in can add additional friction and increase churn.

• And much more7

Each of these steps is hard and requires scarce engineering resources, which is why authentication providers such as Supabase, Auth0 and Clerk offer managed versions, at a cost.

But most significantly, users may forget their password and never even use your site in the first place!

To summarise: passwords are a poor authentication mechanism. They’re hard to implement, unsafe, and lead to a poor user experience!

So: is there a way to authenticate users without relying on something that only they would know?

I wouldn’t still be writing if there wasn’t, so let’s get into that!

Ownership-based authentication 🔒

Ownership-based authentication is our second authentication method — it involves verifying that you own something that only the user you are attempting to log in as would own, such as their email inbox or phone number.

One-time passwords

For instance, when you log in, an app might send you a one-time password (OTP8) via email. This is typically a random short, server-generated, alphanumeric code like ZXY1, but it can also be a magic link, which is a URL containing the OTP as part of it.

The OTP is a temporary secret that is only shared between the app and the user's email inbox, is valid for that specific interaction, and is invalidated once used.

If you log in using this OTP, then you’ve successfully demonstrated ownership of the email address connected to the user account, and so you must be that user — you’re successfully authenticated!

SMS-based logins can also be used, but SMS are not encrypted and can easily be discovered by anyone on the network by sniffing for text messages9.

SMS-based logins can also be gamed for profit — a big reason why many apps no longer solely rely on SMS for authentication, or even only offer SMS based authentication for premium or paying users.

But worst of all, SMS and emails may take minutes to be delivered, or may never be delivered at all10!

Is there a way for the user and service to coordinate on a shared, time-based secret, without sending it over an insecure, slow and unreliable communication channel?

I haven’t stopped writing, so yes!

Time-based one-time passwords

Authentication apps, such as Google Authenticator, provide time-based OTPs (TOTP11).

These authentication apps are set up well in advance of logging in, typically during the first onboarding session. Instead of using SMS or email to send the OTP to the user, an app on the user’s device generates a TOTP using the current time and a secret shared between the user and the web app.

This is much safer than SMS or email OTP delivery, as it does not rely on the security of external communication channels. The TOTP is generated locally on a device the user possesses and controls, making phishing and interception attacks much more difficult.

Hardware authenticators

Finally, hardware security keys, such as a YubiKey12, are a physical authentication device that a user can carry around with them. These are often used in high-security environments, such as in an enterprise, and can also create OTPs. These are really powerful devices, and we’ll dig into them more soon.

Whilst ownership-based authentication methods are often more secure, easier to use (no need to remember a password!), and easier to implement than passwords, they still require the user to do something cumbersome to authenticate.

This is an opportunity to switch device, get distracted, churn, and never use your app at all!

For this reason, authentication methods that require the user to switch device are used sparingly, only for sensitive operations such as when logging in on a new device for the first time.

So — can we authenticate a user without requiring them to use two devices? Absolutely!

WebAuthn 🕸️

WebAuthn13 is an awesome, new(ish) protocol that allows users to authenticate themselves whilst browsing the web.

Instead of using emails, passwords, YubiKeys, or OTPs, the information needed to authenticate a user is stored in an authenticator — typically the browser or device.

Public-key cryptography

The method used for authentication is public key cryptography. It’s the same technology used in Transport Layer Security (TLS) — a networking protocol which is used for nearly all traffic on the internet. It’s fundamental to security, so let’s take a quick aside to dig in:

The idea behind public-key cryptography, or asymmetric encryption, is pretty simple: each person has two keys — a public and private key. The public key is shared with everyone, and the private key is kept to themselves.

Seems pretty simple so far. But we can now do two magical things:

• Anyone can send the user a message by encrypting it with the user’s public key. Only the owner of the private key — the user — is able to decrypt that message.

• The user can use their private key to sign a message. Anyone with the public key can verify that that user signed the message, and no one other than the user is able to sign it as that user.

Public-key cryptography in WebAuthn

The browser or device, acting as an authenticator, generates a new public/private key pair as the user onboards onto a web service. The private key is kept hidden, potentially stored securely in a hardware security module (HSM14) on the device, and the public key is shared with the web service.

When the user later wishes to log in, the website asks the browser to sign a specific message. The browser or device does so using the private key, the website verifies it is indeed the same user using the previously shared public key, and the user is now authenticated!

https://webauthn.io has an awesome demo of this — try it out!

With WebAuthn, the user doesn’t need to type their username or remember a password and can login with a single click — very impressive!

And excitingly, the prompt to log in with WebAuthn will only appear on the correct site, thereby preventing the phishing attacks that were possible with passwords 🎉.

But logging in with a single click also makes it easy for friends, enemies, and attackers to log in with a single click, if they got close enough to your machine.

So, can we ensure it’s you actually doing the clicking? Surely!

Multi-factor authentication

The HSM can actually prompt the browser for something before it allows access to cryptographic operations, such as generating a public and private key or signing a message. And the browser can prompt the user for this data in turn.

The prompt can ask for a password — another example of knowledge-based authentication — or, even better, ask for biometrics, such as your fingerprint or face. Laptops and mobile phones commonly support fingerprint readers, so this is a fast, easy, and secure15 way for users to authenticate.

Clicking a button to sign in and using your fingerprint is multi-factor authentication, since it requires two forms of authentication for you to log in: ownership of the device with the HSM and your inherent identity and ownership of your fingerprint.

And because you attest to your own identity, this is a form of self-sovereign identity — we’ll talk about this more in the next post.

Cross-device authentication

WebAuthn does pose a problem, though.

Users typically use a website on multiple devices: their phone, tablet, and laptop. It’s easy to share a password between devices — does WebAuthn offer something similar?

Yes! Well, sort of.

You can delegate the authentication to a roaming device — which could be your phone, laptop, or YubiKey — anything that is accessible via bluetooth, NFC, or USB. In turn, that device can sign the message on behalf of the main device.

This is an additional layer of protection, since malware on a site would need to infect an entirely different device than the main one you’re using to steal your private key — neat!

However, this means that we’d always be reliant on that first device for logging into that service, or we would need to set up a private key on each device we want to log in from — hardly a good user experience, and potentially worse than multi-factor login using passwords and OTPs.

Limitations of WebAuthn

WebAuthn isn’t a panacea, and does come with some notable downsides:

• Single point of failure — If you lose a device, you’d lose access to all of your logins that that device stores the private keys for. Recreating those logins would take ages, and would be a massive pain!

  Passkeys16 are an exciting new feature to help plug this gap and to share private keys across devices, allowing for ease-of-access and easy recovery. The fun part is that Google17 and Apple’s iCloud would sync these private keys for you — it’s built into the platform!

  As excited as I am about Passkeys, they are new and controversial1819, and it’s unclear if they’ll achieve mass adoption.

• Inflexibility — Passwords are flexible enough to support most flows that users need20. In contrast, WebAuthn only supports a subset of flows.

  For example, sharing access to a single account (eg to access the bills of an energy provider) with a friend is straight-forward with passwords, but much tricker with WebAuthn.

• Uncertain adoption — Perhaps most important is that users aren’t familiar with the passwordless world.

  Will they onboard? Will they log in again on a new device? Will they understand the user flow? We don’t know yet — and it’s a risk to try out something as innovative as this.

Whilst I really want a passwordless future, and think WebAuthn and Passkeys could be our saviour, there’s one more form of authentication that is widely used and worth learning about.

Identity-based authentication 🙋

The third way we can authenticate is to use something we are — our identity. Biometric authentication is one example of this, and we briefly covered it in the last section.

But we can also implement this by outsourcing identity verification to a third party that users already have an account with — an identity provider21.

When you see “Login with Google” or “Login with Facebook”, that's identity-based authentication in action.

The identity provider tells the app that you are indeed the person you claim to be by providing it with a signed ID token.

When the app you’re signing into gets this token, it uses the signature to verify that the identity provider did indeed create that token — and now you’re fully authenticated!

OpenID Connect

OpenID Connect (OIDC22) is the underlying protocol used for this flow. OIDC is a layer on top of OAuth 2.0 — a protocol used for access delegation23 — that standardises identity data like your name and email address.

Big tech giants like Google, Facebook, Twitter, and Microsoft all offer identity services that implement OIDC. It's easy and convenient for users since they can leverage their existing accounts.

And it saves a ton of headaches for developers since they no longer need to build secure authentication systems. Instead of authenticating a user yourself, just plug into Google, and you're done!

This is an example of federated identity24, where a user’s identity is used across multiple systems — Google, Facebook, and all the apps that rely on these identity providers — instead of just one.

Limitations of identity federation

However, identity federation has a fundamental flaw: the identity provider can revoke access at any time, instantly locking you out of all sites. You don’t own your identity — it’s stored on Google’s servers, not yours.

You may think it’s rare, but it’s surprisingly common2526 to find posts on Hacker News of users being denied access to their Google or Facebook accounts due to one reason or another, and totally unable to access any service that they used Google or Facebook as an identity provider for.

The quest for true user-owned identity is an active area of innovation which I'll cover in an upcoming post! Subscribe now to be updated when it’s released 👇

I would love to hear folks thoughts on this — feel free to comment below or DM me!

Have a great week all — stay tuned for Part 3!

Apple’s about to announce its first foray into mixed reality, an advanced AR/VR headset destined to transport wearers into immersive new realms of connection. It will be the latest attempt by Apple to redefine human connection through media. 

When I started writing this, it wasn’t meant as another speculative piece on how mixed reality might change the world. I remain doubtful people will opt for extended time in clunky and costly headsets. Yet experience warns against betting against Apple in matters of hardware. So, somewhat against initial intention, this is me waxing poetic about the world that could emerge should Apple finally propel us into mixed reality. Perhaps I’m just another fanboy, but if any company can navigate that elusive shoal between human needs and technological possibility, it would be Apple.

Each new medium, from cuneiform to encryption, alters the nature of community and relationship. The telegraph swiftly connected distant hearts; radio gave voices to the voiceless. Social platforms have made connection constant and performative, as if living life connected to an audience.  Virtual and augmented reality promise connection unbound from the corporeal world. No longer confined to sharing thoughts or images after an experience, but sharing experience itself, as lived in a virtual space. What changes when our realities can be shared, not just described? When distance collapses not into text or image, but into a dimensional shift that transports us, Alice in Wonderland-esque, across time and space?

The potential for human connection may be both the means and end of whatever new realities Apple has coded into being. Its devices spread through networks, even as they are networks made manifest, a map of humankind overlaid onto the world. Each heartbeat pulses out a steady beat of intimacy and alienation, and technology quickens the pulse.

New realities bring both promise and surcease, profoundly reshaping the connections between us. How fitting that a company so adept at consecrating intimacy through glass and metal would turn its alchemist’s furnace to distilling human connection into a vaporous stream, fit to flow across the chasms that separate us. The medium is still the message, however rarefied the medium becomes. All else perishes if technology doesn’t join lives and souls. Let’s not forget: connection remains its most fundamental, and lasting, purpose.

With skepticism and anticipation, see you on the other side?

With that context in mind, I’ve been curious about how we form our tastes and what makes us like what we like. My thoughts here are heavily inspired by a number of perspectives on the topic, including the work of Matthew Salganik, John Deighton (one of koodos labs’ advisors), Susan Rogers, Ogi Ogas, Luke Burgis, W. David Marx, and many others.

In today’s piece, I share some of my takeaways from Susan Rogers and Ogi Ogas’ fantastic book, This Is What It Sounds Like — for more, check out their book here.

Before we jump in, a few announcements:

• Will you be at SXSW? We're hosting an event with Crush Ventures. It'll be after-hours at a coffee roastery with a vinyl DJ, tacos and ~some announcements~.

  Request an invite

• The culmination of months of research — I published a high-level framework on progressive decentralization for fellow builders alongside my collaborator, Prof Scott Kominers.

• We coordinated a limited working group on scaling cooperative platform models. The discussions led to a paper that has been in the Top Ten Download list on SSRN for multiple journals since it’s publication.

I identify as…

Our taste profile is formed through biology, experience and happenstance. Your random neural wiring, your exposure to media and culture in the time and place you grew up, and the sheer chance of consuming this piece and not that piece at crucial moments in your life all shaped your taste and influenced the kind of art, music, food, fashion, etc. that you can fall in love with. Your one-of-a-kind taste profile develops and evolves as your internal perceiving, thinking, feeling and social networks learn through experience.

If we were to disregard our broader need for societal acceptance and status — we’ll return to these in a future piece — then our true taste profile at any point in time isn’t something that we choose any more than we choose our height or sexual orientation. The art that tickles our mind isn’t something that we can control. All we can do is be open to learning what this wandering can teach us about our true nature — whether we’re musically attracted to Billie Eilish or Billy Idol. In human relationships and musical relationships, our opportunities for fulfillment start with being honest with ourselves about what we are truly attracted to. In short, the way our mind reacts to art is less something we cultivate, and more something we recognize.

Because each of our brains are wired to experience rewards from different facets of music, we’d be misguided to think that anyone’s taste is superior to anyone else’s.

The neuroscience of liking a song

Our most private dreams and fantasies — the fears, hopes, and longings nestled deep in our psychic core — are all bound together in a neural network in the brain, one associated with our sense of self. One of the best ways to activate the personalized “self network” is by consuming art that resonates with the sweet spots on our taste profile. For example, when we’re immersed in the enjoyment of a favorite record, our mind-wandering network lights up like fireworks.

As our brain is idling, the contents of our reveries — what the psychologist William James labeled “flights of the mind” — contribute to the conscious conception of our personal self. Whenever we daydream or fantasize, our mind drifts to places that are intimate and private, thinking about what we like, what we need, and what we desire. Thus, when we listen to music we love — music that aligns with our sweet spot — we activate the part of our mind that fuels the deepest currents of our identity.

Beyond that, when we’re consuming something, we naturally start to link our personal experience to the experience of the art. Nobel Laureate Eric Kandel explored how when we view a painting, we start to evaluate whether the ideas and feelings it evokes within us match our self-concept. Our memory circuits kick into retrieval mode rather than encoding mode and we automatically “play back” memories of people, places, and events that we associate.

So what do we end up liking? Cultural artifacts that maximize the reward of letting our minds wander — rewards linked to our deepest conception of personal self. And this can be different at different points, for example sometimes we need to access our most-buried emotions, while other times we need to feel our inner dance, warrior or athlete. Sometimes we need words to express our tangled thoughts, other times we’d like to visualize an impossible romance. We turn to our favorite records, videos, poems to take us where we want to go — where we need to go.

Sharing AUX, sharing myself

Gaining insight into a friend’s musical tastes can be an intimate experience that reveals how they see themselves in relation to the world, the value of aesthetic experiences in their lives, or who they want to be when they grow up (or who they wanted to be). In many ways, when we play a song for a friend or send them a recommendation, we aren’t merely sharing the content with them, but we’re letting them in on a part of who we are. This doesn’t just apply to music, but extends to other cultural artifacts.

Interestingly, the identity constructive aspect of culture tends to be more pronounced in our more formative adolescent years. That’s because, neurally, what teens think of themselves is almost identical to their impression of what others think about them. Effective social cognition relies on self-knowledge and self-awareness, and both are under development through adolescence. This is also why lots of social apps, which tend help us temper our view of ourselves, start with a young audience — beyond that group just having more time on their hands.

Beyond a personal resonance, there’s a confluence of external factors for why we like what we like — and also what we say we like. We’ll explore those in a future article.

When we were thinking about ways to incentivize people to re-aggregate all their data in one place, we often found ourselves returning to the metaphor of the shelf, to things tacked up on bedroom walls or record collections. All of these represent stores of our stuff and physical manifestations of who we are, what we are, or how we want those closest to us to perceive us.

Using this framing, of the shelf as a proxy for the self, it’s an interesting coincidence that the words self and shelf are only one letter apart. Because to self-chronicle is to self-construct. The journey of identity construction is intertwined with our active collecting and chronicling of things and ideas. It isn’t that fixed self that we have to actualize or memorialize, it’s the changing and evolving one.

Life online can move so quickly it often feels like a blur. Swipe left, swipe right, swipe up, swipe down. Dings and pings for update notifications. The rabbit holes that algorithms send us down, some of which end up being too good for our own good. And the next thing we know, three hours have passed. In a lot of ways, today’s internet moves at such speed that it puts us in a kind of trance.

Is the ‘metaverse’, being heralded as the next manifestation of our connected lives, going to make things any better? What about the lean-back AI-generated future? One hint may lie in the ‘For You’-page, and the impending FYP-ification of our digital spaces. Everything is being personalized not just down to the level of the individual, but also to the moment at which the individual opens the page. Today’s online experience is dictated by momentum, instead of discrete moments.

What if we could slow things down, so that each digital moment doesn’t merely ‘autoplay’ into the next one? A place where things that truly resonate with us can be captured and serve as extensions of ourselves. Where our online actions are more intentional, more contemplative, and more deliberately non-swipey. What about spaces that feel like “sanctuaries”?

“One of the most necessary corrections to the character of mankind today is a considerable strengthening of the contemplative element in it.” 

— Nietzsche

If we wanted to get big-brainy about it, collecting lifts that moment to the level of consciousness. Of going from just one more nanosecond of life online to something of significance for us. But simply collecting digital things, and moments, isn’t enough.

To produce is to real-ize

In French, the word for producer is ‘réalisateur’ —  or the one who realizes. To produce is to realize. It’s the idea of making something ‘real’, of taking a jumble of ideas and turning them into something understandable and appealing. That’s what good producers do. They make things that don’t yet exist ‘real’. And this applies beyond the context of identity construction. If we think about the process of navigating ideas, we strengthen our understanding of the problem or get clarity on the idea by producing, by shipping, by putting something out there. The act of producing helps you realize the idea and take it from abstract to concrete.

On the advice of a dear mentor, I (Jad) recently took part in a Hoffman Institute weekend retreat and was taken aback by the centering on “Expression” in their process:

In a psychotherapeutic context, you might have heard the advice to sit with that feeling to get through it faster. This is similar. Expressing ourselves — whether that’s by speaking to others, journaling about it, embodying what we’re feeling physically — the act of “expressing”, and therefore “producing”, helps us realize.

On the internet today, consumption is considered the main way to establish one’s particular identity (i.e. we are what we consume) and production is usually ignored in the discourse around identity-forming, since whatever we do outside of work is considered “consumption”. But what happens if we reframe so that more of what we do is framed as “productive” — can some forms of consumption be framed through the lens of “production”?

And the more we realize, the more we become ourselves

The unity of one’s life consists in the coherence of the story one can tell about oneself. 

 — Simon Critchley

As life plays out, we’re constantly re-writing our one-page autobiography. And the story that we tell about ourselves might be different in different contexts, around different audiences or in different points in time.

“Who are you?” said the Caterpillar.

Alice replied, rather shyly, “I — I hardly know, Sir, just at present — at least I know who I was when I got up this morning, but I think I must have been changed several times since then.”

“What do you mean by that?” said the Caterpillar, sternly. “Explain yourself!”

“I can’t explain myself, I’m afraid, Sir,” said Alice, “because I am not myself, you see.”

— Alice in Wonderland, Chapter 5, Advice from a Caterpillar

We’re constantly writing a rough draft of our autobiography. It’s perpetually reshaped by our experiences, but also bounded by where we’re at in our development. The more our story comes together, and the more at peace we are with our story, the more we know ourselves. And, in culture today, we’re in the metamodern phase of rebellion against a fixed state of self — moving beyond the postmodernist view of “performing” as whoever we want to be at any given point in time.

Delineation of the self as part of our story

As we chronicle our lives online, we are forced to distinguish between our role as reader and our role as protagonist. And in that process, we separate the self from the things that influence the self in the story we tell ourselves, and the story we in turn tell the world about ourselves.

We rarely record such a realization of ourselves. Instead we capture bits of our selves, operating in particular moments. But it is this deliberate self-chronicling that becomes self-constructive.

So rather than view our identities as a “nucleus” and our quest to center who we are in one place — to create one single central story, or one ‘profile’ of ourselves — our identity might be better conceived as “distributed”. Distributed across media that’s shaped us. We are a constellation of the things and experiences that define us. Or to use Walt Whitman’s phrase, “we contain multitudes”.

The reluctance of most user-generated content platforms to come to terms with their status as not just a social network but also a personal resource is rooted in this tension. Therefore, any effort to understand the nature and origins of the self is an interpretive effort largely done elsewhere, in parallel perhaps to our life online.

Our understanding of who we are is best served if we view it through a constructivist lens. That way we can see ourselves as the product of the situations in which we operate, the sum of things in which we participate, and put our gaze upon what is hopefully a vast collection of encounters and experiences.