Filippo Valsorda: Wikipedia Community Contributor to Cryptography Library Maintainer

This is a continuation of our series exploring the paths that Recursers take to RC, what they do during their batch, and what happens after.

Filippo is currently a Go cryptography library maintainer. He came to RC for two batches: his first was in 2013 after he finished high school, and his second was in 2017 after he’d worked on the cryptography team at Cloudflare.

Here is Filippo’s story:

Before RC

I started programming in the Wikipedia community; I started with templates—the community was super helpful and were there to help you figure out stuff. I graduated to building small JavaScript tools for the editors community to automate some of the encyclopedia maintenance tasks, and then eventually to bots in Python. I ended up maintaining an open source project, youtube-dl, and I was also interested in cryptography and security, but was self-taught. That was the programming experience I had when I joined RC the first time; I’d just finished high school (high school was not about programming and we barely ever saw a computer), and the Recurse Center sort of happened when I decided not to go to university.

During his first batch at RC

I saw RC on Hacker News. It resonated with finally having a community to learn programming in. At that point I had seen a total of one programmer in-person total, and having a lot of them around sounded appealing. In my application I talked about doing youtube-dl and some cryptography stuff, but I ended up doing a bunch of smaller things—in a sense it was a bit of a classic mistake! In another, it was actually a good way to use my time at RC because I ended up getting to know a lot of different people and exploring a lot of different topics by working on projects together. I did Iron Blogger, which was a tradition at the time, and I did Set 7 of the Cryptopals challenges, which dropped during my batch. I wanted to be the first one to finish these—I skipped dinner, I skipped that night, and I stayed around the space until very, very, very late. I think I finished them in thirty hours or something like that. I’m grateful that I had the space to do that because I think that’s something that gave me a lot of visibility for my career.

RC worked really well for me from the beginning. I’m not good at structured work, I like to chase whatever is shiny and interesting, and the Recurse Center was just the right amount of structure around me to be able to go and follow curiosity to where it would lead, and learn freely, and have people to discuss things with. It was just space and permission and company to learn and do projects and churn through interesting stuff.

After his first batch

After my first batch, I did some consulting and ended up having clients who had gone to RC—the network of alums and the community helped me get started. Then I got lucky with something: The Heartbleed Test, which I only knew how to make because another Recurser showed me Go during a random evening social. I kind of dismissed it at the time (I was excited because he was excited, but I didn’t really follow up on it), but then Heartbleed happened and I remembered that there was a TLS library in Go that should be easy to modify, so I used it to make a test for the vulnerability. That got very popular, and got me hired at Cloudflare.

I built a profile for myself, gave a lot of talks, and started to contribute to the Go project. I sort of burnt out a little. I left Cloudflare in 2017, and the first thing I thought was, “great! now I’ve got time for another batch.” Next steps: RC, obviously. In between jobs is a great time to do RC.

During Filippo’s second batch of RC

I came in with a bit too high of expectations for myself. I remembered how in the first batch I had done a lot of small things and I thought, “well, that was a waste—I should have used this chunk of time to work on a large, consistent project that I can see developed; you never get this much time to dedicate to a project.” Honestly, I think that analysis is wrong now!

Jobs will give you the opportunity to have to maintain a project; the Recurse Center gives you the freedom to NOT have to ship a large thing at the end of the batch.

As long as you have something to show at the end of the week on Friday about what you learned, I feel like you’re doing RC well, even if it has nothing to do with what you did the week before or the week before that.

The expectations I had set—wanting to deliver this large thing (I started out doing a Go implementation of the Tor protocol), to have spent my time well—now I see that’s not the right way to go about it. I’ve always said that changing your project after you start RC is a good sign. You should have a project you want to do before you start RC, and you should expect it will get tossed and you will end up doing something else that is interesting with other people. Now I understand that changing projects often is also fine: if that’s how your brain works and that’s how you learn and that’s how you follow curiosity, that’s totally ok!

After RC

After the second batch of RC, I got hired by Google to lead the security of the Go project. In a way, the road that led me there started at the RC party where that alum showed me Go! I left in May of this year, but I am still the maintainer of the cryptography libraries in the standard library, including the TLS stack. Now I’m trying to build a new model for professional open source maintainers to get paid to maintain critical pieces of open source that the ecosystem needs. The idea is working as a contractor for companies that need the ongoing maintenance to be sustainable and that benefit from having access to the maintainers, both as advisors and as a way to get input into the roadmap.

In 2019 I had had a project on the back-burner for a while: everyone was still using PGP for file encryption, and I wanted to build a better alternative, something easier to use and more secure. We ended up designing it in a couple days at Never Graduate Week 2019 with my friend and fellow Recurser Ben Cartwright-Cox. It’s now a very popular tool, age-encryption, and it’s only so easy to use thanks to Ben and that NGW.

The community to me is both a number of people with whom I kept a connection on a 1-1 basis as well as all of these connections that happen in other spaces and companies between people because we have the Recurse Center in common.

I can wear an RC pin at conferences and people will come up and be like “I’m from this batch!” I still show up for the Never Graduate weeks, even if they’re online they’re pretty great. I love the tooling that RC has built. !!Con, which uses the same tooling, is the only remote conference I ever attended that felt as exhausting as a real conference because of all of the interactions and people I got to talk to.

Something I like about RC is that there are people of all backgrounds there: on one hand, you get the people that are very junior who still know what it’s like to figure out something for the first time, and they can see what’s hard or easy to understand about a new project; on the other hand, you have people who have been in the industry 30 years and know font rendering inside out, and can tell you everything about how fonts have been rendered on all of the platforms because they have written half of the implementations and are taking a break from being a director at Google or something like that. Mixing that was definitely a lot of the value that I got from RC, from both sides of that interaction.