f0396371c9
Rewrite the planning docs (credibility-plan, packaging-strategy, why-fieldwitness) in plain, concrete language while preserving all plans, costs, and technical decisions. Rename gtm-feasibility.md to credibility-plan.md and update all references. Light scrub of c2pa-integration, index, and CLAUDE.
216 lines
8.1 KiB
Markdown
216 lines
8.1 KiB
Markdown
# Credibility and Field-Testing Plan
|
|
|
|
**Audience:** Internal planning (solo developer)
|
|
**Status:** Active planning document
|
|
**Last updated:** 2026-04-01
|
|
|
|
## Overview
|
|
|
|
Phased plan for getting FieldWitness trusted and known in the press freedom and
|
|
digital security space. Constraints: solo developer, ~10-15 hrs/week, portfolio/learning
|
|
project that should also produce real-world value.
|
|
|
|
---
|
|
|
|
## Current Strengths
|
|
|
|
- Federation layer does something existing tools don't: gossip-based attestation sync
|
|
across orgs with offline-first design and append-only hash chains
|
|
- Three-tier deployment model maps to how press freedom orgs actually work
|
|
- C2PA export is well-timed as interest in content authenticity is growing
|
|
- Working codebase with tests, deployment configs, documentation
|
|
|
|
## Core Challenges
|
|
|
|
- **Trust deficit:** "Some guy built a tool" is a warning sign in this space, not
|
|
something that makes people trust it
|
|
- **Chicken-and-egg:** Need an audit to be trusted, need to be trusted/money for an audit,
|
|
need adoption for money
|
|
- **Limited bandwidth:** 10-15 hrs/week makes sequencing critical
|
|
- **Stego perception risk:** Steganography angle can hurt trust if presented as the main
|
|
feature (perceived as "hacker toy")
|
|
|
|
---
|
|
|
|
## Phase 1: Foundation (Months 1-6)
|
|
|
|
**Goal:** Make the project easy for people in this field to understand.
|
|
|
|
### Technical credibility (60% of time)
|
|
|
|
- Ship C2PA export as the v0.3.0 main feature (target: 8 weeks)
|
|
- Write formal threat model document at `docs/security/threat-model.md`
|
|
- Model after Signal protocol docs or Tor design doc
|
|
- De-emphasize steganography in public surfaces -- lead with "offline-first provenance
|
|
attestation with gossip federation"
|
|
- Set up reproducible builds with pinned dependencies
|
|
- Get CI/CD visibly working with test/lint/type-check/coverage badges
|
|
|
|
### Documentation and clear explanation (20% of time)
|
|
|
|
- Write "Why FieldWitness Exists" document (~1500 words): the problem, why existing tools
|
|
don't solve it, what FieldWitness does differently, who it's for, what it needs
|
|
- Create 2-minute demo video: field attestation -> sneakernet sync -> federation ->
|
|
verification
|
|
|
|
### Talking to people in the field (20% of time)
|
|
|
|
- Lurk on `liberationtech@lists.stanford.edu` -- do NOT announce tool cold; wait for
|
|
relevant threads
|
|
- GitHub engagement with adjacent projects (real contributions, not performative):
|
|
- `guardian/proofmode-android`
|
|
- `contentauth/c2pa-python`
|
|
- `freedomofpress/securedrop`
|
|
- Post Show HN when C2PA export ships
|
|
|
|
---
|
|
|
|
## Phase 2: Getting Outside Validation (Months 7-12)
|
|
|
|
**Goal:** Get the work reviewed by at least one recognized entity.
|
|
|
|
### OTF (Open Technology Fund) -- https://www.opentech.fund/
|
|
|
|
**Internet Freedom Fund:** $50K-$900K over 12-36 months. Solo developers eligible.
|
|
Rolling applications.
|
|
|
|
**Red Team Lab:** FREE security audits commissioned through partner firms (Cure53, Trail
|
|
of Bits, Radically Open Security). This is the single most important action.
|
|
|
|
**Usability Lab:** Free UX review.
|
|
|
|
**Application timeline:** 2-4 months from submission to decision.
|
|
|
|
**Strategy:** Apply to Red Team Lab for audit FIRST (lower commitment for OTF, validates
|
|
you as "OTF-vetted").
|
|
|
|
### Compelling application elements
|
|
|
|
1. Lead with the problem: "Provenance attestation tools assume persistent internet. For
|
|
journalists in [specific scenario], this fails."
|
|
2. Lead with what's different: "Gossip federation for cross-org attestation sync,
|
|
offline-first, can export to the C2PA format used by Adobe, Microsoft, and the BBC."
|
|
3. Be honest about status: "Working prototype at v0.3.0, needs audit and field testing."
|
|
4. Budget: stipend, audit (if Red Team Lab unavailable), 1-2 conferences, federation
|
|
relay hosting.
|
|
|
|
### Backup audit and funding paths
|
|
|
|
| Organization | URL | Notes |
|
|
|---|---|---|
|
|
| OSTIF | https://ostif.org/ | Funds audits for open-source projects; may be too early-stage |
|
|
| Radically Open Security | https://www.radicallyopensecurity.com/ | Nonprofit, reduced rates for internet freedom projects; focused audit ~$15-30K |
|
|
| NLnet Foundation | https://nlnet.nl/ | EUR 5-50K grants, lightweight process, solo devs welcome, includes audit funding |
|
|
| Filecoin Foundation for Decentralized Web | https://fil.org/grants | Relevant to federation/provenance angle |
|
|
|
|
### Building relationships
|
|
|
|
- Submit talk to **IFF 2027** (Internet Freedom Festival, Valencia, ~March)
|
|
- Open sessions and tool showcases have low barriers
|
|
- Talk title: "Federated Evidence Chains: Offline Provenance for Journalists in
|
|
Hostile Environments"
|
|
- Cold outreach to 3-5 specific people:
|
|
- Access Now Digital Security Helpline trainers
|
|
- Harlo Holmes (FPF Director of Digital Security)
|
|
- Guardian Project developers (ProofMode team)
|
|
- Present it as a complement, not a competitor
|
|
- Lead with "I want honest feedback"
|
|
- Conferences:
|
|
- **RightsCon** -- https://www.rightscon.org/
|
|
- **IFF** -- https://internetfreedomfestival.org/
|
|
- **USENIX Security / PETS** -- academic venues, for federation protocol paper
|
|
|
|
---
|
|
|
|
## Phase 3: What Would Keep This Going, and When to Stop (Months 13-24)
|
|
|
|
### Green lights (keep going)
|
|
|
|
- OTF Red Team Lab acceptance or any grants
|
|
- A digital security trainer says "I could see using this"
|
|
- A journalist or NGO runs it in any scenario
|
|
- Another developer contributes a meaningful PR
|
|
- Conference talk accepted
|
|
|
|
### Signs to stop / change course
|
|
|
|
- Zero response from outreach after 6+ months
|
|
- Funders say problem is already solved
|
|
- Security reviewers find fundamental design flaws
|
|
|
|
### If green (months 13-24)
|
|
|
|
- Execute audit, publish results publicly (radical transparency)
|
|
- Build pilot deployment guide
|
|
- Apply for Internet Freedom Fund
|
|
- Present at RightsCon 2027/2028
|
|
|
|
### If red (months 13-24)
|
|
|
|
- Present it as a reference implementation / research project
|
|
- Write federation protocol as academic paper
|
|
- Lean into portfolio angle
|
|
|
|
---
|
|
|
|
## Portfolio Context
|
|
|
|
### Framing
|
|
|
|
"I designed and implemented a gossip-based federation protocol for offline-first
|
|
provenance attestation, targeting field deployment in resource-constrained environments.
|
|
The system uses Ed25519 signing, Merkle trees with consistency proofs, append-only hash
|
|
chains with CBOR serialization, and can export to the C2PA format used by Adobe,
|
|
Microsoft, and the BBC."
|
|
|
|
### Skills demonstrated
|
|
|
|
- Cryptographic protocol design
|
|
- Distributed systems (gossip, consistency proofs)
|
|
- Security engineering (threat modeling, audit prep, key management)
|
|
- Systems architecture (three-tier, offline-first)
|
|
- Domain expertise (press freedom, evidence integrity)
|
|
- Grant writing (if pursued)
|
|
|
|
### Possible roles this work could lead to
|
|
|
|
- Security engineer (FPF, EFF, Access Now, Signal, Cloudflare)
|
|
- Protocol engineer (decentralized systems)
|
|
- Developer advocate (security companies)
|
|
- Infrastructure engineer
|
|
|
|
### Key portfolio artifacts
|
|
|
|
- Threat model document (shows security thinking)
|
|
- Audit report, even with findings (shows maturity)
|
|
- C2PA bridge (shows standards interop, not just NIH)
|
|
|
|
---
|
|
|
|
## Timeline (10-15 hrs/week)
|
|
|
|
| Month | Focus | Deliverable | Time split |
|
|
|-------|-------|-------------|------------|
|
|
| 1-2 | C2PA export + threat model | v0.3.0, `threat-model.md` | 12 code, 3 docs |
|
|
| 3-4 | Demo video + "Why FieldWitness" + CI | Video, doc, badges | 8 code, 4 docs, 3 outreach |
|
|
| 5-6 | OTF Red Team Lab app + community | Application submitted, Show HN | 5 code, 5 grants, 5 outreach |
|
|
| 7-9 | Community + backup grants | Outreach emails, NLnet/FFDW apps | 8 code, 3 grants, 4 outreach |
|
|
| 10-12 | IFF submission + check whether anything is working | Talk submitted, go/no-go decision | 8 code, 2 grants, 5 outreach |
|
|
| 13-18 | (If green) Audit + pilot guide | Published audit, pilot doc | 10 code, 5 docs |
|
|
| 19-24 | (If green) Conference + IFF app | Talk, major grant application | 5 code, 5 grant, 5 outreach |
|
|
|
|
---
|
|
|
|
## What NOT to Bother With
|
|
|
|
- Paid marketing, ads, press outreach
|
|
- Product Hunt, startup directories, product-launch campaigns
|
|
- Project website beyond clean README
|
|
- Corporate partnerships
|
|
- Whitepapers before audit
|
|
- Mobile apps
|
|
- Discord/Slack community (dead community is worse than none)
|
|
- Press coverage (too early)
|
|
- Competing with SecureDrop on source protection
|
|
- General tech conference talks (domain-specific venues only)
|