SoCraTes 2026 - Onwards to new adventures

For multiple reasons, this year’s SoCraTes Conference was a very special one for me. First, Daniel Steinhauer, whom I met at the OSCO last year, and I decided to share a room. This originated in not getting drawn in the lottery twice. At least I wanted very much to go to SoCraTes this year. And so we decided to share a room. Thank you, Daniel, for sharing. You were a quite relaxed room-mate. Second, this was the first time I was there as a complete private individual. I was in between jobs and took a break of two months before traveling directly from SoCraTes to Stuttgart to have my first day on the new job. Had I realized this earlier, I might have asked to start a bit later at the new company. In case you are curious: It turned out quite well. Being too exhausted to be nervous and still in this contact-friendly, positive and open mind-set SoCraTes tends to bring was a good combination. Oh, and if you think I must have been well rested before traveling to Soltau, I must disappoint you. Two months of a break feel way too short when one tries to pack all the other things into it. Third, this was the first time (not counting the training I gave last year), I packed a prepared talk for the open-space.

Traveling to Soltau

Since I met Lisi Hocke four years ago at my first SoCraTes we managed to travel together to Soltau. So we did this year. It is always a pleasure to catch up in person. Thank you. This year, Claudia Bischoff was sitting in the same coach, and we all together missed our connection train and had some coffee before meeting a lot of other participants on the platform for the regional train. Travel to Soltau was very nice and relaxed. Having the train conductor placing on in 1st class helped a lot. This was actually a very nice surprise. Thank you! To be honest, I cannot remember the first evening very much anymore. There was dinner, there were people; there was some chatting. As I was tired and having the room the first night for my own, I took advantage of that and retired kind of early.

Training Day

I had not made a fixed plan for training day yet. This year the first training session was four hours, instead of two. I decided to visit “Psychological Safety Awareness” by Gitte Klitgaard. Partly because in my last project I was in a team where there was none and I tried to make it better as it was the most important thing to change. Partly because starting at a new company this might come in handy and partly also because it felt way more rewarding on a personal level than learning LLM-related things. It was quite worth the time. As one of the rules was not to talk about what others said, I will just share some things I’ve learned or which came to my mind.

• Sitting down when doing workshop, to not teach from above.
• Encourage active passing in round-robins to get into the habit to hear everyone.
• I do have to think about the “storming” phase in Tuckman’s model of team development. It feels much more it should be a negotiating phase on how we want to work together. One that might never really end.
• Not sure if it was in the workshop or the grain of thought was just created there: I need to think about “Assume everyone did their best”. I might be tempted to change this to “Assume everyone wanted to do good work” in the future. As I wrote, I need to think about that a bit more and this might then be another article.

The second, two-hour, training was facilitated by Diana Montallion and Sofia Katsaouni with the title “From Feature Factory to Forge”. What shall I say, Diana brought so much energy to this training, and it was so much fun. We explored how capabilities in a system are related to each other and how to design for evolving relationships. It was hilarious to watch an external challenge to the system turning the movie selection service into a movie recommendation and piracy service in our group.

After that training day and a dinner, Juke Tabold lead us into the World Cafe where old and new participants formed groups to answer three questions and mixing groups after each one. This is one of the situations, SoCraTes shows its diverse group of participants. One thing always feels in common: People tend to take care of each other. Most of the time it works.

On that day, Marc Kalmes, another, kind human being I’ve met at OSCO, surprised me very much. At the beginning of the year we talked about a book on mastodon, at that day he handed me a copy and wished me fun reading it. Thank you very much!

Open Space Day 1

The first marketplace is always a bit special. Do I find the energy and courage to get up and propose a session in front of all those people? Having a prepared talk made it a bit easier. And so I proposed a session on Threat Modeling. Either as a talk, as an experience exchange or as something in between. You never know who shows up, right. But let’s go in chronological order.

• Aki Salmi had a session on “Teach yourself modern frontend”. Of course, I was late, which is totally fine in open spaces. I joined the moment he talked about teaching from the back of the room and the concept of the course he put together for teaching this topic. I also learned a bit about frontend development afterward. Both were quite interesting.
• My own session on Threat Modeling. I was so happy, we did not do the ‘in between talk and experience exchange’ thingy. I basically gave my talk, practised sitting down to not teach from an elevated position. We had also some more experienced persons in the room, which helped in the discussion afterward. I do really hope more people are now just getting started with this methodology. Thank you to all who showed up! A special thanks go out to Lisi, having a known and friendly face in the audience helped me a lot in staying calm. Furthermore, Lisi surprised me afterward and proposed we might try to give a workshop on this topic on Sunday. More about this later.
• “Testing without touching exercise” by Joep Schuurkes was up next. He showed us a screenshot from an old-school web-frontend and wanted us to think about behaviors we would test, expect or want in this piece of software. This was quite fun as it really helped me think first before jumping into action. Usually, I do have an idea and start right away to work on it. Then I think about the next.
• “Let’s talk about code review (in the age of LLM)” by Frank Sons. Frank posed the question on how to do code reviews if an agent writes the code, and maybe another one or multiple already did a review on it. Then a human does a review before handing it over to another human doing a review. One idea, which was voiced (in this and an earlier) session was to maybe do the reviews of the task input and output together as humans and let the agents work on the things in between. To be honest, I sometimes feel like we start to forgetting all the learnings from the pre-LLM age. We should always ask why we do a code review, why did we think pairing or an ensemble were a good idea, why did we learn specification up-front might be not a good idea. Developing software was and still is a social as well as a technical endeavor.
• Next up was “How to help junior SW developers learn in an AI world” by Pascal Dufour. In my opinion, we did not talk much about the “in AI world” part, but more about general things like respect, do not be the know-it-all, learning from each other and such things. Still, it was an interesting session.

Three years ago, Lisi Hocke started to facilitate open-ended ensemble CTF sessions in the evening and nights. She did it this year as well. I love those sessions. They are interesting from a technical and a group dynamic perspective. And Lisi does a really great job facilitating. This year, the session was a bit special for me. I’ve started doing more and more of those challenges over the years and now bring some experience in the tooling and on how those boxes might be designed. Therefore, I could follow the group this year way better. Sadly, we did not capture the first flag this night. It always amazes me how humbling an easy-labeled box can be. There might be some special knowledge needed or something on does overlook. There is always something to learn.

Open Space Day 2

Second marketplace. The second time, I joined the queue. This time to let Philipp Zug do the talking and announce a session on the security card game, Lisi, he and I started to develop four years ago after meeting at SoCraTes. Thank you, Philipp, for announcing; I was kind of awake but not sure if I could be talking at the moment.

• Raimo Radczewski proposed a session on “Organizing Anarchy”. I had to be there. The question I take with me from this one is: Can anarchy work if you have forces trying to destroy that kind of living? Can it only work as long as it does not endanger the powers which are?
• The joint session of Philipp, Lisi and me on the status of the Security-Card-Game. As I wrote, this project started four years ago at SoCraTes and since then is slowly progressing. As we do this in our side-hours, this is a deliberate decision. Usually there is a small boost of speed before SoCraTes. This year, the people played it for the first time! That was quite a nice surprise. The group started to discuss the next move, questioned game mechanics and introduced a group voting. Thank you, Eric, for managing the votes; there is a Kudos-Card waiting for you. Also thank you all for the great feedback. And thank you Lisi for noting it down and already putting it into an issue.
• This slot was a hard pick. There was a session on Colonialism and a photography exhibition by Thierry de Pauw’s daughter and a session on “Residual Architecture” by Felix. As I always wondered what residual theory and residual architecture is, I ended up there. Turns out, it is a theory by Barry O`Reilly that should help to design resilient systems by making up stressors (also very unlikely ones) and trying to secure your system against them. When the solutions to protect against stressors repeat, your system might have reached criticality and might be able to tolerate a lot of stressors you never have thought about. Quite interesting. I need to read up about this. Also, please take the summary with a big grain of salt. This is what I understood from this session and might be entirely wrong.
• “How to delete stuff” by Elizabeth Zagroba was next. I supposed it was on “How to delete stuff from your codebase.” But hearing about the session on “Vehicles in the park” on the day before, I would also have gone with a session on “How to really delete things so the information is lost”. It was an interesting session on why it is sometimes hard to delete and decommission things. People came up with ideas like: Celebrate deleting things, delete things and see if someone complains (which might be tricky if this is used only once a year). Personally, I am always happy if code can be deleted or something is shut down. It reduces complexity. And personally, I always make a small celebration when the lines of code are less after a change than before (and often enough betray my self as adding the new stuff in one PR and deleting the old ones in another PR). One thing which peaked my brain was the term “Any decision record” for ADR instead of “Architecture Decision Record”. Having a record of why a decision was taken might also help deleting stuff.
• Simon Görtzen gave a summary of the book “Psychology of software teams” by Cat Hicks. This helped me move this book from the “want to read as soon as possible” to “want to read, but no hurry” pile. Thank you! The most important message I take from this session is to see culture and psychological safety as core infrastructure in an organization and not as a nice to have.

After Juke Tabold led us into a retro perspective and closed the open space, workshops were announced. Usually this happens on Sunday. Lisi and I had not yet had a chance to talk about how to announce. Somehow we managed.

Before the next CTF session by Lisi I had the chance to brain-dump all the things the group had tried and I could remember into a Miro board. The night before we really tried a lot of stuff, JavaScript deobfuscation, XSS, blind XSS and much, much more. This night, we finished the machine. Learning for me: Once again, systematically enumerate all the things would have helped. I am really not very good at this.

Workshop day

So happy there was no marketplace today as the workshops were announced already. This allowed for having breakfast. However, Lisi and I did not yet have the time to talk about ideas and concepts. We only talked about intentions. The good thing was, we already thought about proposing such a workshop to conferences next year and talked about the topic of threat modeling multiple times this year. For me, it also helped I took part in some of Lisi’s past workshops (the one about the Secure Development Lifecycle hooked me up on AppSec three years ago at SoCraTes) and loved the way she had facilitated them. It also helped we know each other well, and I trust her quite a lot. Roughly 30 minutes before the workshop started, we sat down and sketched it out. We even closed the door and put a sign “Preparation in progress” on it. Usually, a mortifying situation. With Lisi this turned out to be enough time to agree on a concept, examples to use and to be calm. Then people showed up. Something around 15! This being SoCraTes, we got very lucky having a group of people knowing how hwo to self-organize when hands-on tasks are handed out. I was amazed how engaged the participants were. I am so grateful for Lisi’s trust! I am so happy we did this. Thank you for taking notes and the debriefing afterward. It might be the sleep-deprivation at that time, but for me, it did not really feel like we did do a workshop together for the first time. And I must add: I learned a lot from Lisi during the workshop and afterward during a debriefing. Super grateful. We now have a good starting point to work out a workshop. If you are interested at Lisi’s impression, read it on her blog.

I was quite exhausted at that timepoint and managed to squeeze in a quick nap before dinner. Lisi then offered another CTF session after the topic came up at dinner. With all of us being low energy at that time, I learned a few things about myself in that session.

After that session, a small group of people ended up in the hallways. Claudia and Lisi were play testing a game Luna brought from the game-jam workshop. It was looking fun, I for myself was way too tired to actively take part. But it was a very nice and calm way to end the last day at the hotel.

The way home

Well, not really home in my case. I had to go to Stuttgart. Funny enough, I’ve met Dorian (who was also at the conference) on the train to Hannover who is living in Stuttgart. We would have had the same journey if I had not already had a ticket back to Nürnberg and opted to travel to Suttgart via Würzburg. So I chatted for some more hours with Lisi Hocke before traveling on to Suttgart and fell exhausted into a hotel bed and wondering how my first day at the new company would go.

Other things

Of course, there were some nice chats and interaction with people like Janina Nemec, Sofia Borga and many others. Those interactions are not forgotten, even if not mentioned. I totally forgot to chat to Michael Knorr, who introduced me to that universe. But we might see each other in Nürnberg.

Oh, and one thing on Kudos-Cards. This year it felt like a 1:1 ration of writing and receiving. I should write more next year to move the ratio back in favor of giving. I really like those cards and keep them on my desk at home. From time to time I look them through to dive into memories.

It is such a privilege to be able to take part in this conference. I hope I will be there next year as well.