Ephraim Park

Shallow Dive: OAuth 2.0

2021-12-31T00:00:00+00:00

Context

Now that I went over the basics of user authentication and session management (here). I was curious about how “login with X” worked. I eventually learned that it’s powered by OAuth 2.0. This post will do a shallow dive on OAuth 2.0 on what it is and how it works.

What is OAuth 2.0?

Let’s search the internet for it! Based on the internet, “OAuth 2.0 is the industry-standard protocol for authorization.” Authorization? Let’s search what that is too! From this article, it says “authorization is the process of giving the user permission to access a specific resource or function.” What?

Once you understand OAuth 2.0, these definitions make sense, but they were not helpful for me when I started the journey to understand OAuth 2.0. So, let’s take a step back and understand what is the problem that OAuth 2.0 is trying to solve.

Let’s say we are building a service, let’s call it an “AwesomeService”, that prints a user’s Instagram photos. When a user comes into our service, we want to show the user’s Instagram photos so that he/she can select the photos that he/she wants to print.

In order to do that, our service needs to have access to the user’s Instagram photos. One way to achieve this is to ask for the user’s Instagram account and password. Then, the service can log in to Instagram as the user and access the user’s photos. But there is a problem. Now the service can do much more than that. The service can delete the user’s photos or post a new photo. Basically the service can do whatever the user can do since the service now knows the user’s password. This is bad.

We want a way for “AwesomeService” to get permission to access the user’s Instagram photos without asking the user’s Instagram account password to “AwesomeService”. This is where OAuth 2.0 comes into the picture.

OAuth 2.0 is a protocol that enables a user to grant permission (or authorize) to a service to access the user’s resources stored in another service in a secure way. The resource could be the user’s profile information, photos, or really anything!

Let’s jump into how it works!

Terminology

OAuth2.0 is quite complicated and involves multiple components. Let’s establish terminologies before we get into the details.

Let’s continue with the “AwesomeService” example above. There is a website called “AwesomeService” that tries to access a user’s Instagram photos and John is trying to use the “AwesomeService”.

Resource Owner: John - a user who owns the resource.
Authorization Server: An Instagram server that authenticates the resource owner and provides an authorization token and an access token.
Resource Server: An Instagram server that stores/provides John’s Instagram photos when given a proper access token.
Client: AwesomeService - a service that’s trying to access resources from another service.

How does it work?

1000ft View

Let’s say John has logged into the “AwesomeService” website, and AwesomeService wants to access John’s Instagram photos to display it on its website for John to view and select. This kicks off OAuth 2.0 flow:

AwesomeService sends a request to Instagram Authorization Server saying that we want to access the user’s Instagram Photos.
Instagram Authorization Server authenticates the user.
- In other words, Instagram Authorization Server asks the user to provide the Instagram account and password – this is fine since it’s Instagram Authorization server asking for Instagram password.
Once the authentication is successful, Instagram Authorization Server asks if John, the user, is okay with AwesomeService accessing his Instagram Photos.
Once John says it’s okay, Instagram Authorization Server sends back an authorization token to AwesomeService.
AwesomeService sends the authorization token back to Instagram Authorization Server to get an access token back.
- I will get back to why this step is necessary later.
AwesomeService sends a request to Instagram Resource Server with the access token to fetch John’s Instagram Photos.

Closer Look

So, how does each step actually work?

AwesomeService sends a request to Instagram Authorization Server saying that we want to access the user’s Instagram Photos. You can play around with this OAuth Debugger (https://oauthdebugger.com/) for this step.
- This step needs the following information
  - Authorization server URI: Instagram’s (or Facebook) OAuth authorization server URI https://www.facebook.com/v12.0/dialog/oauth
  - Redirect URI: Once the authorization is finished, the authorization service will redirect the user to this URI with the authorization token encoded as a query param.
  - Client ID: This tells the authorization server which service is making the request. AwesomeService needs to register itself to Instagram OAuth beforehand to get this client ID.
  - Scope: Scope tells the authorization server which permission this request is asking for. In our example, scope will be “read access to John’s Instagram photos”.
  - Response type: This is either “code” or “token” or both. Let’s revisit this later.
  - Response mode: I actually don’t know much about this field. Let’s keep it as a “query”. :)
- This information is passed as a GET request to the authorization server. That looks like the following:
  - https://<authorization-server-uri>?client_id=<client-id>&redirect_uri=<redirect-uri>&scope=<scope>&response_type=<code|token>&response_mode=query
Once John goes to the url generated from step 1, it will show the authentication UI for the authorization service.
Once John successfully authenticates himself, the UI will ask for John’s permission to grant access based on the “scope” field from step 1 to AwesomeService.
Then, the authorization service will redirect John to the Redirect URI from step 1 with the authorization token.
When John sends a GET request to the redirect URI with the authorization token, AwesomeService backend can read the authorization token value as a param. Then, AwesomeService backend sends a request to Instagram Authorization service again with an authorization token and a secret key (a secret key generated when AwesomeService registers itself to Instagram OAuth) to get an access token.
AwesomeService backend now has the access token, and can make a request to the resource server!

This is a high level flow of how OAuth 2.0 works!

What’s more?

Implicit Flow

The flow that I went through is usually called an “Authorization flow”. There are a few more flows in OAuth. The one that I will briefly touch on is an “Implicit flow”.

If you look at the “Authorization flow”, AwesomeService needs to get authorization token from Instagram Authorization server and then send another request to Instagram Authorization server again with the authorization token to get an access token.

This is to ensure the security of the access token. It assumes that the front end code that runs on the browser is not a super safe place. Authorization token which gets passed as a param to the redirect URI is exposed to the front end code. Then, the authorization token gets passed to the Awesome service backend, which then sends the direct request to the Instagram Authorization server with a secret key to get an access token. AwesomeService backend calls the Instagram Resource Server with the access token.

In this flow, the authorization token can be stolen but it’s fine since there is a secret key that only the AwesomeService backend and the Instagram Authorization server knows. The access token is also safe since it never left the AwesomeService backend.

This works when you have a backend. But nowadays, there are a lot of single page apps that don’t really have strong backend support. In that case, “Implicit flow” is used. In the “Implicit flow”, the step that returns authorization token in the “Authorization flow” will just return an access token directly. “Implicit flow” is considered less secure compared to the “Authorization flow”.

OpenID Connect

OAuth defines the overall flow but the granularity of “scope” is defined by each company implementing OAuth 2.0. The lack of standardization on “scope” led to a pain point in implementing “Log in with X”. For example, the scope for getting the user’s email in Instagram was different from Google.

OpenID Connect is an extension on top of OAuth 2.0 that said let’s make some common “scope” like “openid”, “profile”, and “email” for fetching basic user information to standardize user profile fetching use cases for OAuth.

There is an OpenID Connect debugger: https://oidcdebugger.com/

References

Thanks for reading through the post. This is just a worse version of the following video lectures:

https://www.youtube.com/watch?v=t4-416mg6iU
https://www.youtube.com/watch?v=996OiexHze0 Check out the videos to get more in-depth understanding with some cool visual aids.

If you are developing an OAuth use cases, these debugging tools are super helpful:

https://oauthdebugger.com/
https://oidcdebugger.com/

Shallow Dive: Web Authentication / Session

2021-12-30T00:00:00+00:00

EDIT: It seems like what I am describing in the post as Session Token is closer to JSON Web Token (JWT) rather than Session Token. But the overall idea is similar for both of them. Here is a great video about Session Token vs JSON Web Token

Context

Even after 5 years of work experience. User authentication / session management has stayed as a black box to me. The lack of knowledge did not block me in any way for my day to day job. There was another team handling the problem; I only needed to focus on my team’s project.

However, as soon as I started to think about building something outside of the company’s context, I became paranoid about the session management and security of the service. Obviously, I am not trying to build a security infra from scratch, but the lack of context was slowing me down on utilizing the existing tools out there.

So, I wanted to use my quarantine time to do a shallow dive on this topic.

Before we go on to the main topic, let’s cover Cookie first. Cookie plays a core role in web session management. So what is it?

Cookies are small blocks of data (key/value pairs) set by a web server and stored on a web browser. It is sent back to the web server through the http header for every request to the web server once the value is set.

One common use case of Cookies is a shopping cart for a logged out user. The following diagram demonstrates the interaction between Web Browser and Web Server for adding two items (id:123, 456) to the shopping cart.

Things to note:

Cookies are set by the Set-Cookie header in HTTP response from the web server.
Once Cookies are set, Web Browser always sends back the key/value pairs of Cookes to the subsequent request to the Web Server. That’s why the second addToCart request has “Cookie: cart=[123]” in its request header.

Building a Todo list web site

In this section, we will try to build a simple user session management for a Todo list web site.

The Todo list web site will support.

A user can register (sign up) to the web site using an email and a password
A user can login (sign in) to the web site using an email and a password
A logged in user can add todo item

Registration Before we can authenticate a user, the user has to register (or sign up) to a web site first. Let’s build an api for registration. This api only takes an email and password for the register.

API pseudo code:

app.post(‘/registration, (req, res) => {
  const hashedPassword = hash(password); // why hash is necessary is a topic that I will skip :) 
  db.User.addRow(email, hashedPassword); 
  res.sendStatus(200);
});

The web site can have input fields for email and password. Once a user clicks on the “Sign Up” button, the browser can send a request to the api with email and password values to register the user to the web site.

If the user entered ‘newuser@gmail.com’ and ‘newpassword’ as the email and password, the api will add a new row in the User table with the information. Let’s just assume that hash(‘newpassword’) results in ‘hashednewpassword’.

User Table: [
  {email: ‘newuser@gmail.com’, password: hash(hashednewpassword)},
] 

Sign in Now that the user has registered to the web site, we want to enable the user to sign in. Let’s build an api for the sign in. This api also just takes an email and password for the user.

API pseudo code:

app.post(‘/signIn’, (req, res) => {
  const {email, password} = req.body;
  const hashedPassword = hash(password);
  const row = db.User.findRow().where(‘email’, ‘==’, email);
  if (row.password === hashedPassword) {
    res.sendStatus(200);
  } else {
    res.sendStatus(500);
  }
});

The web site can have a sign in page which has input fields for email and password. Once the user enters the email and password pair and presses the submit button, the request will be routed to the signIn API and be processed accordingly.

In our example, if the user enters ‘newuser@gmail.com’ and ‘newpassword’ pair, the sign in process will result in success! Once the browser gets the “success” response, it can show that the sign in was successful to the user.

Add todo item Yay! So, we are done with the user session management, right? Let’s build an actual feature!

Let’s build an end point to handle adding a todo item. Take a look at the following version where the api only has one parameter, todoitem, as part of a request body.

API pseudo code:

app.post(‘/addTodoItem, (req, res) => {
  const {todoItem} = req.body;
  db.TodoItem.addRow(todoItem);
  res.sendStatus(200);
});

This is not going to work since we don’t know to which user this todoitem belongs to. We can solve this problem by adding an email to the api param, right?

API pseudo code:

app.post(‘/addTodoItem, (req, res) => {
  const {email, todoItem} = req.body;
  db.TodoItem.addRow(email, todoItem); 
  res.sendStatus(200);
});

Now, we know the user who added the todoItem and the content of the todoItem. Are we good now? Not quite. With the current design, anyone can add a new todo item in anyone’s account. Even if I am not the ‘newuser@gmail.com’ user, I can just call the api with a request body {email: ‘newuser@gmail.com’, todoItem: ‘todo item’} to add a new todoitem to the account.

One way to solve this issue is to pass a password as well as the email to the api.

API pseudo code:

app.post(‘/addTodoItem, (req, res) => {
  const {email, password, todoItem} = req.body;
  const hashedPassword = hash(password);
  const row = db.User.findRow().where(‘email’, ‘==’, email);
  if (row.password === hashedPassword) {
    db.TodoItem.addRow(email, todoItem); 
    res.sendStatus(200);
  } else {
    res.sendStatus(500);
  }
});

Note that we want to keep the backend api to be a stateless service. So keeping some kind of state on the backend to figure out which authenticated user is calling the api is not an option.

This will work. But some of you might have noticed that there are a few weird things:

Our addTodoItem endpoint enforces a user to enter email and password for every addTodoItem call. When we use a web site on the internet, we don’t enter an id and password for every action.
There is no distinction between a logged in user and a logged out user. signIn api is essentially useless at this point.

This is where the concept of Cookies and Session come into the picture. Since we don’t want to make the backend service to be a stateful service, we will leverage Cookies and make a client (Web Browser) to keep track of the state (user session in our case).

2-1. Sign in with Cookies Let’s rewrite the signIn api with the Cookies. In this version, once a user passes the right email and password, Web Server will store logged in user information (session information) using Cookies.

API pseudo code:

app.post(‘/signIn’, (req, res) => {
  const {email, password} = req.body;
  const hashedPassword = hash(password);
  const row = db.User.findRow().where(‘email’, ‘==’, email);
  if (row.password === hashedPassword) {
    res.setHeader({
      ‘Set-Cookie’: `loggedInUser=${email}`
    }).sendStatus(200);
  } else {
    res.sendStatus(500);
  }
});

Once the Cookie is set, the logged in user information will be passed to all subsequent requests to the Web Server. Let’s rewrite the Add Todo Item api.

3-1. Add todo item with Cookies Since add todo item only works for the logged in user, if the Cookie is missing the data, it will redirect the user to the signIn page. If a user is logged in, the Cookie will have the user information, so the user information doesn’t have to be passed through the request body. Request body needs todoitem only.

API pseudo code:

app.post(‘/addTodoItem, (req, res) => {
  const email = req.cookies.loggedInUser;
  if (email === null) {
    res.redirect(‘/signIn’);
  } else {
    const {todoItem} = req.body;
    db.TodoItem.addRow(email, todoItem);
  } 
  res.sendStatus(200);
});

However, this version has a similar problem as before. A user may tamper with the Cookie data from Web Browser and change the loggedInUser value to another user’s email to add a new todo item to a random person’s account.

Encryption can help mitigate this issue. Since the client (Web Browser) doesn’t have a need to use Cookie data, Web Server can use encrypted value as a Cookie data instead of a plain text value to prevent a user from tampering.

2-2. Sign In with Cookies with encryption Before setting the email through Cookies, encrypt the value with an encryption key. This encryption key should only be known to the Web Server!

API pseudo code:

app.post(‘/signIn’, (req, res) => {
  const {email, password} = req.body;
  const hashedPassword = hash(password);
  const row = db.User.findRow().where(‘email’, ‘==’, email);
  if (row.password === hashedPassword) {
    const encryptedEmail = encrypt(email, ‘encryptionkey’);
    res.setHeader({
      ‘Set-Cookie’: `loggedInUser=${encryptedEmail}`
    }).sendStatus(200);
  } else {
    res.sendStatus(500);
  }
});

3-2. Add todo item with Cookies Since the encryption key is only known to the Web Server, we can trust that this Cookie data is a value set by signIn api, not something generated by a malicious actor.

API pseudo code:

app.post(‘/addTodoItem, (req, res) => {
  const encryptedEmail = req.cookies.loggedInUser;
  if (encryptedEmail === null) {
    res.redirect(‘/signIn’);
  } else {
    const email = decrypt(encryptedEmail, ‘encryptionkey’);
    const {todoItem} = req.body;
    db.TodoItem.addRow(email, todoItem);
  } 
  res.sendStatus(200);
});

That’s about it! Now, once a user logs into the web site, the web browser keeps the user session (loggedInUser) information (usually called SessionToken, AccessToken) in the Cookie and keeps passing it to Web Server to let the server know that the user is logged in. The following diagram demonstrates the interaction:

Wrapping up

This is a super simplified version of the session management. Hopefully you are not trying to build things from scratch that you don’t need to understand all the details. I don’t know the details either. However, if you want to learn more, here are a few things that I skipped over.

SessionToken usually holds more information than just the id of a user; It usually includes things like expiration date for the token.
There are multiple attributes around Cookies. It seems like security sensitive information like SessionToken should be used with attributes like “httpOnly” and “secure” to prevent malicious Javascript code from reading it and to make sure SessionToken is only communicated over ssl to keep it safe.
SessionToken can be stored in “local storage” or “session storage” of a browser rather than Cookies.

Most of the post’s content are from Everything You Ever Wanted to Know About Authentication

JWT
- JWT Intro
- JWT Intro Video
OAuth2.0
- OAuth2.0 at high level
- OAuth2.0 with more detail and OpenID Connect

On Nietzsche

2021-03-30T00:00:00+00:00

Again, the devil took him to a very high mountain and showed him all the kingdoms of the world and their splendor. “All this I will give you,” he said, “if you will bow down and worship me.” Jesus said to him, “Away from me, Satan! For it is written: ‘Worship the Lord your God, and serve him only.’” Matthew 4:8-10

I didn’t give a second thought to this passage when I encountered the story at a young age. It was yet another story from the bible where Jesus overcame the temptation of the devil.

Recently, I went on a stroll to Twin Peaks. It was a short walk from my place and an easy way to get a killer view of San Francisco. As I looked down at the night view of SF, Temptation of Christ went through my mind. If the devil asks me to bow down and worship him for SF, would I be able to resist the temptation? It didn’t take long to get to the answer. I would have bowed down to the devil in a split second. After the thought, I realized that my mind is not at the right place now.

Not long after the stroll, I watched a documentary called “Genius of the Modern World’’ covering Nietzsche. It walks through Nietzsche’s life from childhood to death and how his philosophy developed with it. His philosophy was a search for the meaning of life in the absence of God. He arrives at the idea of self-realization and achieving greatness as the meaning of life.

Ironically throughout the documentary, I, born and raised in a Christian family, was struck by the similarity between my mindset and that of Nietzsche’s. It seemed like a testament to how widespread Nietzsche’s philosophy is in modern society, which I was deeply soaked into.

Self-realization and achieving greatness as the goal in life, I had no problem with. What bothered me after watching the documentary was the last work from Nietzsche, “Will to Power”. In his final chapter of philosophical search, he marveled at the strength of will to power. Given his previous thoughts leading up to this point is aligned with my thinking, it made me wonder if my motivation is also coming from the will to power.

Most of my life, I saw myself as a non-aggressive and non-competitive person who can give away opportunities. It didn’t take long to prove myself wrong after I started working. Competing for the shiniest project and being defensive about giving away projects became everyday life at work for me. It became worse after I joined my current team where I was given good opportunities. I went through the “virtuous” cycle of working on high impact projects which lead to more opportunities. I pushed myself to seize the opportunity. Over time, I realized that I am becoming more and more obsessive and selfish. It was not “Let’s achieve greatness as the team” mentality. It was more of “I need to be the one who achieves greatness” which unfortunately sounds a lot like a will to power.

The bigger problem is that this will to power seems to grow. This obsessive and selfish mindset produced tangible results that are easy to measure. Because it’s so effective at generating visible results, I was drawn to the pattern without even realizing. As I went through the cycle, the will to power started to take more space in my mind.

I think I am able to be in the okay zone thanks to people around me keeping me grounded. But I do feel the need to hone the skill to calm myself down.

How can I do that? I don’t know the answer to this question yet. But the followings are a few ideas that I am playing around with:

My first step is to acknowledge that I have somewhat intense will to power that can easily tip out of balance. I need to be conscious of the environment that I put myself in so that I can always stay in balance.
Instead of trying to act like I won’t have the will to power over night, I should think about how to put this tool into a good use. Maybe I should practice associating myself to something bigger than my physical self, and work for something that is beyond me.
I need to learn to define what greatness is. I am striving to achieve greatness defined by other people. As a social animal I don’t think I can completely escape from this, but I need to learn to strike a balance.
I need to think more about things that I should be grateful for. There are so many things that I need to be grateful for. Being super focused on a small thing shrinks my mind and makes me overlook grateful things and only see things that I lack.

Even long after the stroll to Twin Peaks, the story of Jesus lingered in my mind. How could he possibly say no to that? After thinking about it for a while, I came to a closure that it probably was his faith. Jesus had the faith that everything he needs will be given. Everything I need in life will be given to me. Why is this so hard to just have faith in that line? Let me just have some faith and chill the fuck down!

On When Breath Becomes Air

2020-07-05T00:00:00+00:00

How I learned about the book

I don’t exactly remember when it was. MSG friends and I were waiting to get a table for dinner at Sushi Plus in Redwood City. I probably have finished a book recently, and was asking for a book recommendation. Jungi mentioned that he had read a book called “When Breath Becomes Air”. He said it was about a neurosurgeon getting diagnosed with cancer and his journey with it. I didn’t read the book at the time, but for some reason, the name of the book stuck with me, even though it was one short discussion. Recently, with Covid-19, my work-life balance has worsened and my exhausted self was spending a lot of time watching YouTube before going to bed. I picked up this book to fight that habit. Although I am still watching YouTube a lot, I really enjoyed reading through the book.

Summary

Paul Kalanithi was a rising star in the Stanford Neurosurgery Department. It was his final year as a resident when he got diagnosed with lung cancer. The cancer changed his life completely from what he thought his life would be. The book is an autobiography by Paul Kalanithi reflecting through his life trajectory. In my opinion, this book is really about death and the transformation of his relationship with it.

Death as philosophical subject

In the first part of the book, death is something that is an interesting subject to him. He wants to get a better understanding of the meaning of life, and he wants to approach his search with science. With these interests, neurosurgeon was a natural path for him to get a deeper understanding into cognition, life, and death.

Death as an observer

After he became a resident in Stanford Neurosurgery Department, his experience with death changes. It no longer is just an academic subject. He is arguably the most close observer of death. People with severe brain conditions come to him as a patient and he has to make a call of which procedure to be applied. He is the one who needs to guide the patient throughout the journey, sometimes to cure and sometimes to the end. He is the one who needs to explain the patient’s condition to their family. He is the one who needs to make a call on when to stop the medical treatment.

Death as a subject

His diagnosis with lung cancer transforms his relationship with death. He is no longer an observer of it. He now is the subject of the arrival of death.

Thoughts

Fear

Throughout the book, the biggest impression was that he was brave when confronted with death. Before the diagnosis, he was a hard working, prominent neurosurgeon. There were a number of best offers lined up for him, waiting for a less than a year left graduation. Although it is clear that he was frustrated by the sudden change in his course of life, he is not put into defeat. He keeps on living. He goes back to being a resident and puts in hours caring for patients. He works with his wife to plan for the family. He writes this book. There are many cases where fear influences my decision. Fear, without being analyzed where it is coming from, impacts the behavior to land in a sub-optimal place, not fully in and not fully out, somewhere in the middle. My impression of Paul was that he doesn’t let his emotion suffer from the negativity of fear. Rather, he does risk management and just executes on it. I should try analyzing the fear, make a risk management plan, execute on the plan, and live on.

Work Life Balance

Paul was a workaholic. He had put in a crazy amount of work hours to achieve his goals. However, his work ethic put his relationship with his wife in jeopardy and I see this as one factor to the cause of cancer. This part struck me a bit since I have been feeling the pressure to perform and putting long hours to work myself. At the end of the day, I feel like I am growing so I think those efforts pay off, but sometimes I question myself, “can my body/mind handle this long term?”, “would I be able to keep a healthy relationship with my loved ones?”. I still don’t have a good action plan to improve this. The book reminded me that this is something important that I should keep thinking about.

What do I want to do

Another thing that I thought was interesting was the question of “What do I want to do with life?” Often people say that the answer to this question becomes clearer upon a death bed although the question becomes more like “What should I have done with life?” Paul’s story puts a different angle to this question. He knows that the death is near but doesn’t know how near. There was a paragraph that he thinks about what he should do if there is a week left vs a few months vs a few years. Throughout the story, his thoughts change over his journey. It was an interesting thought exercise to think about that question. At the same time, it was interesting that the answer to that question doesn’t become clear even near death. I guess the takeaway is to execute with full earnestness to my answer at any moment without fearing the answer to change. It will change, but journey to the previous answer is not worthless as long as I put my best toward it.

On The Stranger by Alert Camus

2020-03-31T00:00:00+00:00

I went downstairs for dinner. We were setting up the table and looking for a TV show to watch for the day. I just sat in the reclining chair at the corner of the living room, my head soaked with tiredness from working from home all day, unable to face the effort it would take to switch gears for an off hour and enjoy the time with housemates. But the tiredness was so intense that it was just as bad sitting still in front of the TV and dinner table with dinner. To stay or to go, it amounted to the same thing. A minute later I stood back up toward where my phone was charging and started walking.

I could see the familiar notifications on the screen. The phone looked for my face with an attempt to unlock itself. As I waited patiently, I could feel my forehead swelling under the tense expectation. All that expectation was pressing down on me and making it hard for me to relax. And every time I felt a hint of fatigue inside my head, I strained every nerve in order to overcome the tiredness and the thick drunkenness it was spilling over me. With every change of animation on the screen, from movement of lock icon to expanding notifications, my jaws tightened. A few microseconds felt like a long time.

From a tip of expanding notification I could see the white ‘w’ surrounded by an ominous yellow circle, a Work Chat notification. It must have been the message of agreement from the teammate. I wanted to hear good news to alleviate work from me, to escape the tiredness and to find comfort and rest again at last. But as I read the Work Chat notification closer, I saw that H’s message had come back otherwise.

He must have been alone. He must have been lying on his back, with his hands loosely holding on to his phone, his body partly covered by a blanket. It was nonsense. As far as I was concerned, the whole thing was clear, and I’d come downstairs without even thinking about the possibility of this response. This work rightfully belongs to his team, not us.

As soon as I saw the message, I tapped on the notification and opened my Work Chat. “I think APP should take this work,” I said. Then, I sent “How could this work not be related to the platform?”. His profile picture showed up again with “…” to indicate him typing. I could sense that his answer would glare right back at my eyes. The movement of dots was even lazier, more drawn out than a suspended sense of time.

It occurred to me that all I had to do was escalate the work and that would be the end of it. But the whole animation and exhaustion were pressing on my head. “It can be a tricky question” his message started, and it ended with “this is more like a clean-up for artifacts belonging to a specific use case”. I couldn’t see his face. After all, he is far away from me physically. Maybe it was the wording on his message, but it seemed like he was laughing. I waited. The fatigue was starting to overtake my brain, and I could feel my sanity losing its grip. It was this exhaustion that I couldn’t stand anymore, that made me move forward. I knew that it was stupid, that I wouldn’t get the fatigue off me by sending back another message. But I sent it. And this time, blaming the lack of platform support as the reason for the work. I pressed on the ‘send’ button. And it was like knocking on the door of unhappiness.

Later, I told this story to my housemates. They asked “why did you have to be so aggressive for nothing?”. “It’s because I couldn’t get 8 hours of sleep that day.”

On Never Split the Difference

2020-02-29T00:00:00+00:00

How I got to this book

I was going through Amazon’s best sellers list looking for a book to read before bedtime. In the list, “Never Split the Difference” caught my eyes. Communication is one of the areas that fascinates me, and negotiation is something that is very important but something that I think I am not particularly good at. Description section read the author of the book, Christ Voss, is a former international hostage negotiator for the FBI.

What this writing is for

The structure of the book is a back and forth between his introduction of negotiation technique and an anecdote of using the technique in real negotiation. Many of the techniques resonated with me and I wanted to try in my real life settings. I know I will forget most of the techniques soon, so I wanted to take this opportunity to summarize techniques that I want to try so that I can remember better.

Negotiation Techniques

My understanding of this book’s main theme is to leverage the counterpart as much as possible. It says “Please remember that our emphasis throughout the book is that the adversary is the situation and that the person that you appear to be in conflict with is actually your partner”, and the book focuses on how to make the counterpart into your partner.

I have categorized the technique into the followings:

Understand the counterpart’s true intention
- The key in understanding the counterpart’s true intention is to give him the sense of comfort and keep him talking.
- Asking “No” Question
  - “Extracting that information means getting the other party to feel safe and in control. And while it may sound contradictory, the way to get there is by getting the other party to disagree, to draw their own boundaries, to define their desires as a function of what they do not want.”
  - “Break the habit of attempting to get people to say “yes.” Being pushed for “yes” makes people defensive. Our love of hearing “yes” makes us blind to the defensiveness we ourselves feel when someone is pushing us to say it.“
- Effective Pauses
  - “Silence is powerful. We told Benjie to use it for emphasis, to encourage Sabaya to keep talking until eventually, like clearing out a swamp, the emotions were drained from the dialogue.”
- Minimal Encouragers
  - “Besides silence, we instructed using simple phrases, such as “Yes,” “OK,” “Uh-huh,” or “I see,” to effectively convey that Benjie was now paying full attention to Sabaya and all he had to say.”
- Mirroring
  - “Rather than argue with Sabaya and try to separate Schilling from the “war damages,” Benjie would listen and repeat back what Sabaya said.”
- Labeling
  - “Benjie should give Sabaya’s feelings a name and identify with how he felt. “It all seems so tragically unfair, I can now see why you sound so angry.””
- Paraphrase
  - “Benjie should repeat what Sabaya is saying back to him in Benjie’s own words. This, we told him, would powerfully show him you really do understand and aren’t merely parroting his concerns.”
- Summarize
  - “A good summary is the combination of rearticulating the meaning of what is said plus the acknowledgment of the emotions underlying that meaning (paraphrasing + labeling = summary). We told Benjie he needed to listen and repeat the “world according to Abu Sabaya.” He needed to fully and completely summarize all the nonsense that Sabaya had come up with about war damages and fishing rights and five hundred years of oppression. And once he did that fully and completely, the only possible response for Sabaya, and anyone faced with a good summary, would be “that’s right.””
Make the counterpart think for the solution
- Asking Open-Ended Calibrated Question
  - “Instead of asking some closed-ended question with a single correct answer, he’d asked an open-ended, yet calibrated one that forced the other guy to pause and actually think about how to solve the problem.”
  - “And the secret to gaining the upper hand in a negotiation is giving the other side the illusion of control.”
  - “Giving your counterpart the illusion of control by asking calibrated questions—by asking for help—is one of the most powerful tools for suspending unbelief.”
  - “But calibrated questions are not just random requests for comment. They have a direction: once you figure out where you want a conversation to go, you have to design the questions that will ease the conversation in that direction while letting the other guy think it’s his choice to take you there.”
  - “First off, calibrated questions avoid verbs or words like “can,” “is,” “are,” “do,” or “does.” These are closed-ended questions that can be answered with a simple “yes” or a “no.” Instead, they start with a list of words people know as reporter’s questions: “who,” “what,” “when,” “where,” “why,” and “how.” Those words inspire your counterpart to think and then speak expansively.”
  - “But let me cut the list even further: it’s best to start with “what,” “how,” and sometimes “why.” Nothing else.”
  - “And “why” can backfire. Regardless of what language the word “why” is translated into, it’s accusatory.”
  - “Calibrate your questions to point your counterpart toward solving your problem. This will encourage them to expend their energy on devising a solution.”
  - “By making your counterparts articulate implementation in their own words, your carefully calibrated “How” questions will convince them that the final solution is their idea. And that’s crucial. People always make more effort to implement a solution when they think it’s theirs. That is simply human nature.”
  - “Ask calibrated “How” questions, and ask them again and again. Asking “How” keeps your counterparts engaged but off balance. Answering the questions will give them the illusion of control. It will also lead them to contemplate your problems when making their demands.”
  - “Use “How” questions to shape the negotiating environment. You do this by using “How can I do that?” as a gentle version of “No.” This will subtly push your counterpart to search for other solutions—your solutions. And very often it will get them to bid against themselves.”
  - “Don’t just pay attention to the people you’re negotiating with directly; always identify the motivations of the players “behind the table.” You can do so by asking how a deal will affect everybody else and how on board they are.”
- The Rule of Three
  - “The Rule of Three is simply getting the other guy to agree to the same thing three times in the same conversation. It’s tripling the strength of whatever dynamic you’re trying to drill into at the moment. In doing so, it uncovers problems before they happen. It’s really hard to repeatedly lie or fake conviction.”
  - “The answer, I learned, is to vary your tactics. The first time they agree to something or give you a commitment, that’s No. 1. For No. 2 you might label or summarize what they said so they answer, “That’s right.” And No. 3 could be a calibrated “How” or “What” question about implementation that asks them to explain what will constitute success, something like “What do we do if we get off track?””
  - “Is the “Yes” real or counterfeit? Test it with the Rule of Three: use calibrated questions, summaries, and labels to get your counterpart to reaffirm their agreement at least three times. It’s really hard to repeatedly lie or fake conviction.”
General tips
- Loss Aversion:
  - “people will take greater risks to avoid losses than to achieve gains. That’s called Loss Aversion. To get real leverage, you have to persuade them that they have something concrete to lose if the deal falls through.”
- Anchoring Effect:
  - “You can bend your counterpart’s reality by anchoring his starting point. Before you make an offer, emotionally anchor them by saying how bad it will be. When you get to numbers, set an extreme anchor to make your “real” offer seem reasonable, or use a range to seem less aggressive. The real value of anything depends on what vantage point you’re looking at it from.”
- Similarity Principle:
  - “Exploit the similarity principle. People are more apt to concede to someone they share a cultural similarity with, so dig for what makes them tick and show that you share common ground.”
- They are not crazy:
  - “When someone seems irrational or crazy, they most likely aren’t. Faced with this situation, search for constraints, hidden desires, and bad information.”

2019 Recap

2020-01-25T00:00:00+00:00

2019 was a year of comeback

I joined Facebook as a full time in 2016. I was fresh out of college and excited about the new challenge in front of me. CEA was my first team, and I started working on a project called Long Range Planning tool. The project started out as an intern project around June and I joined the team in October. At the time, the intern has already finished the internship and the intern mentor was working on the project. The deadline for the project was December 2016 since the tool was necessary to do LRP exercise in January 2017. As I started working on the project, it became clear to me that the design of the system had a flaw. Over Christmas, I wrote a document with the proposal of new design and made a prototype of the system, and I gave a presentation to my manager and my manager’s manager about the new system. Long story short, I built the tool with my new design and got promoted. At the time, my confidence, arrogance rather, skyrocketed. Facebook is a piece of cake, I thought.

Then, I started thinking about moving to Software Engineering team (I was Performance and Capacity Engineer at the time). I thought I could be great anywhere I go. I worried more about the process, passing the interview to transition to Software Engineer, than finding the right team. Fortunately, I passed the interview, and I joined a team called Video Infra Insights in July 2018. That was the beginning of dark age of my career. By the end of 2018, my confidence level plummeted, and I was not sure if I could survive in Software Industry. I considered switching out of the team, but I wanted to give it another try for a half. However, the situation did not get better. The direction that I thought the team should go and the direction that the team was going were completely opposite. I went through counseling, meditation, etc., but I could not cope with the situation. I completely crumbled. I had to switch out of the team.

With lots of discussions and help from my friends, I joined my current team, Instagram Ads Experience, in August 2019. I was nervous. I was not sure if my self-esteem could bear it if I could not adjust in this team again. Thankfully, with a lot of mentorship from my teammates and my friends, I was able to ramp up quickly and become a core member of the team. Most importantly, I feel like I am providing value to the team. I am very much grateful to my friends and teammates. I am super excited about 2020 and it’s all thanks to their support. 2019 had truly been a year of comeback for me.

Why I stayed at Facebook.

Before I go on to what I want to achieve in 2020, I want to touch upon why I decided to stay at Facebook over moving to different companies. Facebook is a company that pushes an engineer not only to do engineering work but also to take product manager-like role. For example, an engineer is expected to provide input to product direction and be responsible in convincing stakeholders and aligning other teams to work toward the same goal. Throughout my time at Facebook, I had a hard time coping with this. Until recently, my understanding of a good software engineer was narrow. Technical expertise was the only pillar that made a good software engineer, I used to think. This mindset irritated me whenever I had to do non-technical work like planning, talking with stakeholders, etc. Overtime, however, I started seeing the importance of those non-technical work in bringing value. There is an art in prioritizing, planning, and delegating to maximize the productivity of a team. Good engineer should be able to handle not only technical challenges but also non-technical challenges to maximize the impact. My weakest points are around these soft skills, and Facebook is a great place to learn the skills. So, I chose to stay at Facebook.

What I want to focus on in 2020.

Since I chose to stay at Facebook to hone my soft skills, I want to optimize my time in 2020 around them. I am not sure how to facilitate my learning other than just keep doing stuff that I am not comfortable with until I get comfortable doing them. One thing that I want to try, though, is to write excessively. I want to keep track of weekly plan, meeting notes, learning notes (wikis), and daily review. Hopefully, writing will help me do clarify intention for my time spent, and facilitate learning. I am super excited for 2020, and to see how it unfolds!

On Talking to Strangers

2019-11-09T00:00:00+00:00

Revisionist History by Malcolm Gladwell is one of my favorite podcasts. Malcolm is a master storyteller. On the podcast, he introduces a historical event or social phenomenon. They are not always new event or phenomenon that I did not know about, but in the end, it always leaves me with the chill because the narrative sheds a different light that it always feels so new. In the 4th season of Revisionist History, he advertises his new book “Talking to Strangers”. I had to read it.

Majority of the book explains three common human behaviors on talking with strangers: default to true, fallacy of transparency, and coupling of behavior. Default to true is a human tendency to assume good intent of a stranger until there is overwhelming evidence to prove otherwise. For fallacy of transparency, Malcolm explains how inaccurate it can be to read a stranger’s mind through visual cues like facial expressions. Coupling of behavior describes how a human behavior is coupled with the situation as much as it is with the person’s personality.

The examples and researches that he writes in the book to demonstrate these behaviors are fascinating and I would recommend this book just for that. However, the book does not end there.

The final part of the book focuses on Sandra Bland case. It can be seen as another police mistreatment of black people by bad cop. The book, on the other hand, looks at this incident from a different angle. He uses the three behaviors as lenses to look into how successful Kansas City police experiment ends of disseminating a distorted message to the police department of different areas, and how dangerous it is to build a system without accounting for the complexity of talking to strangers. To him, Sandra Bland case is one incident from systematic failure, that was bound to happen.

The content was fascinating, but the story telling method is what really got me hooked. The building blocks that he used are so familiar to us. After all, the three behaviors that he explains are not revolutionary. We are kind of familiar with those ideas. Sandra Bland case is also not so new. We all are familiar with the cases of police mistreatment of black people. Yet, when he used these familiar lenses to tell a story about a familiar case, everything felt so fresh that it really stuck to me.

We all look at the world through our own lenses, but in many cases, we are oblivious to that. Reading this book not only helped me understand the complexity of talking to strangers and the danger of not accounting for that complexity but also got me to think about what lenses I use to look at the world. What kind of lenses do I default to when absorbing the world around me? Do those lenses provide perspectives that will help me to push myself toward my goals? Additionally, another questions that I should ask myself are about the diversity of my lenses. Am I exposing myself enough to different lenses to understand the world to the fullest?

Anyways, it was a very enjoyable book with a lot of fascinating stories and research. I would highly recommend this book!

By the way, you may have already noticed it, but reading this book probably won’t help you to get better at talking to strangers if that is what you are looking for. :)

Mind Training

2019-04-14T00:00:00+00:00

Two weeks ago I met a person who works at OpenAI at my friend’s birthday party. We talked about what we do. He was working on a machine learning model that creates a coherent story when given few sentences to start. At the time, I thought “what a cool project” and moved on. Later when I thought about it, the model seems to draw parallel with the thought that I have been thinking and reading about my mind. My mind is a story telling machine! Similar to the machine learning model, it doesn’t always create a true story. It is just constantly generating a stories that are coherent to the triggers that surround me. Even more similar, I think the mind gets trained to generate a certain type of stories over time.

This perspective on mind came very recently. I have never treated my mind as something that needs training. Instead, I have always pushed my mind to put myself into discipline. Looking back, now, I think one of the biggest motivation that I have used is a fear. Fear of not going to good school, fear of not getting a good grade, and fear of not getting a good job were common driving forces that I have utilized to push myself. My mind, without me noticing, has been trained to use fear as its biggest voice.

Toward the end of my college years, as I started to think about my life after school, I started to notice that I did not really know what I like to do. My mind has be trained not to listen to what I like. Its priority was set to getting a good job, and in order to meet the goal, it listened less and less to stuff that I like. I felt like my mind has grown deaf to my feeling over time. This became more of a problem after graduation. During a school year, regardless of what I liked to do, the next steps were pretty clear. However, after school, there is no single path. Instead, there are so many paths that I could take my life to. What would be the best for me? My mind did not know.

In 2018, I switched team, and unfortunately, the career trajectory was not as good as I expected when I made to decision to move. At this point, my mind got completely lost. I was not sure of anything. I felt a strong urge to switch to different team, but I was not sure if I felt it because the team really was a bad fit for me or because I wanted to run away. It eventually reached the level where I was not sure if I can survive in the industry. Thankfully there were many friends to talk about this and Benjamin recommended me a book, “The Headspace Guide to Meditation and Mindfulness.” Meditation was not something that I thought seriously about before, but I was ready make a leap of faith on anything that could help. I finished the book a few weeks back, and I have been meditating for about a month now. It did not magically solve all of my problem but I think that it has been helping and I wanted to share some of my learnings.

I think the biggest change in perspective was on learning that the mind can and needs to be trained, and that meditation is a way to train the mind. Andy Puddicombe, the author of the book, says that “Meditation isn’t about becoming a different person, a new person, or even a better person. It’s about training in awareness and understanding how and why you think and feel the way you do, and getting a healthy sense of perspective in the process. (p. 14)” In fact, most guided meditation from Headspace app are built around in building awareness on thoughts, feelings, and body sensations that comes and goes instead of being caught up with a series of thoughts.

As I paid more attention to my body, I was able to be more aware on how my body is feeling and how that is very closely connected to my mind. Many times, when I fall into the cycle of negative thoughts, I find myself that there is a physical sensation that triggers these thoughts, mostly fatigue or little discomfort in my head. Before whenever I fell into unproductive cycles like watching YouTube, I would be harsh on myself for lack of self control. Now, when I fall into that cycle, I notice how tired I am.

This changed my belief that strong mind can control everything. Instead, I am thinking that the best my consciousness can do is to keep my body at its optimal state by sleeping, eating, and exercising at the right time. Self control will come naturally when my body and mind are in healthy state. Instead of being harsh on myself, there are essentially four things I can do when I am not in the best state: sleep, exercise, eat, and meditate, in the order of effectiveness.

My hope is that as I take more care of my body and put effort to keep it at its best, my mind will calm down and be okay with what is happening. And eventually to experience other benefits that book promised like being more present, and being more clear in thoughts.

The book talks about how training our mind changes our experiences in all dimensions in life. “… when it comes to the way you think and feel about those situations, the starting point is to acknowledge that it’s the mind itself that defines your experience. This is why training the mind is so important. By changing the way in which you see the world, you effectively change the world around you. (p. 26)” I hope I get to enjoy that feeling someday :)

On Peak

2019-03-14T00:00:00+00:00

2018 has been a tough year for me. I went through two team changes, and for each change the reality was different from my expectation. With the new changes, I was not performing at the level that I wanted to. My confidence tanked, and my head was filled with negative thoughts. I was starting to think that my soft skills were so bad that I would not be able to survive in the industry; I am not born with the skill sets that I need; I don’t have eyes to identify impact, etc. During my time in Korea from Dec 2018 to Jan 2019, I seriously considered changing team / company, right after I get back. I even thought about coming back to Korea or going to graduate school for Ph.D. In the end, however, I came to a conclusion to stay in the current team and try my best for at least another half. If I move out of this team now, it’s literally running away from my responsibility, and I am not a person to run away from my responsibility.

Anyways, after I got back to California in mid Jan 2019, I ran into a short clip that talked about a book called Peak. It was saying that natural talent doesn’t really exist in reality and with the right practice a person can improve in any skill. I was immediately hooked since I was blaming my lack of natural talent in soft skills (and many other skills) and was feeling like I was hitting against a wall. I recently finished reading the book, and I am so happy that I ran into the book. I don’t think reading the book magically solved all my problem, but the book helped me to see a light of hope that I could not see before.

How did it help me see the light?

Anders Ericsson, the author of the book, starts by saying that there are two perspectives in looking at learning. One is to see learning as a process to fulfill a predefined potential, which is determined when a person is born. Another is to see learning as a process to grow the potential itself. He is a strong believer of the latter and the book introduces building blocks of his belief and researches that back up his idea.

Brain can change

He uses major portion of the book to explain why he believes that a person’s potential is not something preset. In order to have meaning discourse, he uses brain as a concrete object that represents potential. Traditional view of predefined potential has a deep relationship with the belief that one’s brain stops growing / changing at certain age at which point the person’s potential is set. There is nothing that can improve the brain’s functionality. In the book, he uses multiple researches that disprove that claim. One example that I remember is the research on London Taxi drivers. The test to be a London Taxi driver requires thorough memorization of London. It will give a candidate a pick up location A and a destination B and the candidate’s job is to provide the most efficient path from A to B from memory. The research consisted of two groups. Test group consisted of people who were starting to prepare for the Taxi exam and control group was people who were not. When the researchers scanned their brain, there was no significant difference on the size of the part of brain that controlled memory. After 4 years, the researchers re-scanned those people. Now there were three groups: one group that became London taxi drivers, one group that gave up, and the control group. As you might have guessed, the size of brain grew significantly for the group that became taxi drivers. The other two groups had similar brain size as 4 years ago. This research, along with other researches in the book, clearly shows that brain can adapt and rewire itself to grow our potential.

… the brain’s structure and function are not fixed. They change in response to use. It is possible to shape the brain – your brain, my brain, anybody’s brain – in the ways that we desire through conscious, deliberate training. (p. 36)

Deliberate practice

Okay, now we get that the brain can rewire itself, but how? Anders’s answer to that is practice. But not just any practice. He calls it a deliberate practice. He emphasizes the difference between naive practice and deliberate practice. Naive practice is a mindless practice. For example, if I play tennis with my friends just for fun without really focusing on my stroke, that would be a naive practice, and it won’t help much in development of my tennis skill. He argues that the best way to hone an ability is to do deliberate practice. My understanding of deliberate practice is that 1. It needs to be focused. The purpose of the practice must be clear. 2. It needs to be challenging enough that it’s not possible to do perfectly with the current skillset. 3. It needs to have a feedback loop. What is that I am doing correctly that can be improved? The following is the summary of deliberate practice based on the author’s own words.

The hallmark of purposeful or deliberate practice is that you try to do something you cannot do – that takes you out of your comfort zone – and that you practice it over and over again, focusing on exactly how you are doing it, where you are falling short, and how you can get better. (p. 157)

If the deliberate practice is done over and over again, our brain will adapt itself so that it can be better at what it’s trying to do.

Mental representation

How does this rewiring of brain manifest in our thought process? The author refers to this as a mental representation. As people do deliberate practice and their brains rewire themselves, people’s mental representation changes. The thought process of an expert is different from a novice. Anders uses chess as an example to demonstrate his point. When ordinary people are shown multiple chess boards in the middle of a game and asked to recreate them from memory, most fails to do it. However, when grandmasters are shown the boards, they are able to recreate the boards almost exactly. What makes the difference? He attributes to mental representation. The way these two groups of people look at boards is different. To ordinary people, the chess pieces on the boards are independent pieces, but to grandmasters the chess pieces on the boards tell a story of the game. They explain the board with abstract words like line of forces and power. In his own words, mental representation is:

As we shall see, the key to improved mental performance of almost any sort is the development of mental structures that make it possible to avoid the limitations of short-term memory and deal effectively with large amounts of information at once. (p. 24)

He also goes on to say that deliberate practice and mental representation form a virtuous cycle where deliberate practice leads to improved mental representation which helps in getting better self feedback during deliberate practice.

What now?

Reading this book at this point in myself helped me to reframe my mindset. My mindset was falling in a pessimistic swamp. I felt like my lack of natural talent set me to a failure. This book tells otherwise. With correct practice, I can improve any skill set I want (though it might take time). This book helped me to 1. Be hopeful that I can be better at areas that I was not good at. 2. Be patient. There is no expert that was good at what they do from day one. For me to be frustrated because I am not the best at the field after short period of time doesn’t make sense. On more concrete note, I think I have been 1. Approaching coding as every day business and didn’t really think about how to improve them. Nowadays, I am trying test driven development which I think is a good start. I need to look for ways to improve my practice on TDD further. I think revisiting the code that I wrote after about a month may be helpful. 2. Looking back, I have been running away from the opportunities for practices when it comes to soft skills. I need to put myself into those practices. Instead of running away from it thinking that I suck at that, I need to think that these are good opportunities to do deliberate practice on soft skill and I should capitalize on that. I think doing improv as Benjamin suggested may be a good way to put myself into do deliberate practice.

He has a strong message toward the end. He states that with deliberate practice people can own their potential and thus their life.

With deliberate practice, however, the goal is not just to reach your potential but to build it, to make things possible that were not possible before. This requires challenging homeostasis – getting out of your comfort zone – and forcing your brain or your body to adapt. But once you do this, learning is no longer just a way of fulfilling some genetic destiny; it becomes a way of taking control of your destiny and shaping your potential in ways that you choose. (p. 48)

Hell, I want to do that!

Ephraim Park

Shallow Dive: OAuth 2.0

Context

What is OAuth 2.0?

Terminology

How does it work?

1000ft View

Closer Look

What’s more?

Implicit Flow

OpenID Connect

References

Shallow Dive: Web Authentication / Session

Context

Cookie

Building a Todo list web site

Wrapping up

Related Topics

On Nietzsche

On When Breath Becomes Air

On The Stranger by Alert Camus

On Never Split the Difference

How I got to this book

What this writing is for

Negotiation Techniques

2019 Recap

2019 was a year of comeback

Why I stayed at Facebook.

What I want to focus on in 2020.

On Talking to Strangers

Mind Training

On Peak

How did it help me see the light?

Brain can change

Deliberate practice

Mental representation

What now?