Work

Shield of Self-Defense: an open security curriculum

The problem. Small civil-society groups in Taiwan need security guidance they can follow without an IT department. OCF's openly licensed (CC-BY 4.0) curriculum, first released in September 2024, was organized by technical topic: accounts, encryption, files, networks.

What I did. I led its revamp. The material is now organized by who is reading: individuals, people who run an organization, common incidents, tools and a self-assessment, with a knowledge base for the consultants who teach it. The personal part runs in eight chapters, from threat modeling and device hardening on iOS, macOS, Windows and Android to encrypted communication, backups and overseas-travel checklists, all written for readers with no technical background. I rebuilt the site on MkDocs Material, with each publish deploying to GitHub Pages and then clearing the CDN cache for ssd.ocf.tw.

I also built a 3D game version in Three.js with its WebGPU renderer. Players walk to five "security ruins", one for each section of the curriculum, and relight each one by winning a quiz battle; wrong answers are explained, never punished. Five practice stations cover passphrases, phishing links, two-factor and passkeys, 3-2-1 backups and deepfake calls. It works offline once loaded, keeps progress in the browser, and has an attract mode for running unattended at an event booth.

Where it stands. The curriculum, the game and their source are public and openly licensed, so other trainers can teach from them or adapt them. The game's intro is available in Traditional Chinese, Simplified Chinese and English.

ssd.ocf.twThe gamegithub.com/ocftw/ssd

Security accompaniment for human-rights defenders

The problem. Human-rights and civic groups in Taiwan are targets of phishing, account takeovers and data leaks, but rarely have the people or budget to handle security systematically. A one-day workshop raises awareness and then fades; the group's daily habits stay the same.

What I did. OCF ran a year of long-term accompaniment instead, with six high-risk organizations and human-rights-defender groups. I led the on-site training and implementation: checking endpoints and devices, reviewing each group's accounts, data and workflows, setting up day-to-day security processes, and helping write internal security policies in language non-technical staff could actually follow.

The result. The program published three reports, on the digital threats facing Taiwan's human-rights and democracy groups (2024), on what the accompaniment achieved (2026) and on one attack case (2026), presented at a public forum in July 2026. The curriculum became Shield of Self-Defense, above, so groups outside the program can learn from it too.

Project page and reports (in Chinese)

Open source localization platform

The problem. Translations of open-source software into Traditional Chinese tended to go one of two ways. Commercial translations were done once, then fell behind and were abandoned. Community translations varied in quality and depended on volunteers who burned out.

What I built. The project, run with Taiwan's Ministry of Digital Affairs, a translation company and the English department of National Taiwan University, trains professional translators and takes on university interns. I built and operated its Weblate translation platform, with the test sites and deployment infrastructure behind it, so translators could do their work online. I also coordinated training, workshops and the internships, across projects such as Element (Matrix), IRMA/Yivi, GOV.UK Notify and GOV.UK Forms, and the Standard for Public Code.

The result. The project has trained seven professional translators and taken on more than twenty translation projects, with one or two interns each semester. OCF presented the model at FOSDEM 2025.

Project pageFOSDEM 2025 talk

OONI Research in Taiwan

The problem. OONI measures internet censorship by having volunteers run tests from their own networks. In Taiwan, the list of websites those tests check had last been updated in 2017, and it was not clear how much of the country's networks the measurements covered.

What I did. As an OONI community partner, OCF restarted the project in October 2023 with three workstreams: analyzing network coverage, updating Taiwan's test list, and localizing OONI into Traditional Chinese with a shared glossary. I worked with the global OONI community on the research, co-published the first local report, and translated the measurement methodology for civil-society readers.

The result. The December 2023 report analyzed about 2.78 million measurements over 94 days. Taiwan ranks in the world's top ten by measurement volume, yet only 32 of its 437 networks (7.3%) appeared in the data, and two providers accounted for about 80% of it. The gap showed where new testers were needed most. The work continues as OONI reports at anoni.net, and in a Tor, Tails and OONI workshop held before RightsCon 2025 in Taipei.

Project pageThe 2023 reportLater OONI reports at anoni.net (in Chinese)

Taiwan's open source communities at FOSDEM

The problem. Taiwan has active open-source communities, but they were rarely visible at FOSDEM, Europe's largest open source conference, where many of the projects they use and contribute to meet.

What I did. I coordinated a multi-year effort to bring them there: an OCF and Taiwan open source community stand at FOSDEM each year since 2023, speaker logistics, curating what each community brought, and building partnerships with European projects.

The result. In 2024 the stand carried material from seven communities, including COSCUP, PyCon Taiwan, SITCON, g0v, vTaiwan and Cofacts, with four flyers and a directory of Taiwan's communities, and the printed material ran out. In 2025 OCF gave a talk there on the localization project above.

Project pageFOSDEM 2024

2025–nowCo-organizer

anoni.net, the anonymous network community

The problem. Tools like Tor, Tails and OONI protect people online and measure censorship, but much of what explains them is only available in English. anoni.net started from workshops on those three tools, held with the Tor and OONI teams around RightsCon 2025 in Taipei, and became a community project in July 2025.

What I do. I maintain its documentation site, built on MkDocs Material: 254 pages and 77 posts in Traditional Chinese, with English and Simplified Chinese versions and onion and IPFS mirrors. For campus Tor relays, the community translated EFF's Tor University Challenge into Traditional Chinese and put together a kit for anyone proposing a relay at their school, with a proposal template, setup steps and answers for university IT offices. I run three webtunnel Tor bridges for the community, and wrote onionoo-fastapi, a proxy that gives the Tor network's relay data API an OpenAPI schema, so other tools and AI agents can use it directly.

The result. The first campus relay went up at National Taiwan Normal University's computer science department, built by a community member, and is described as the first Tor relay on TANet, Taiwan's academic network. At COSCUP 2026 the community ran a two-day track, with an afternoon of talks on anonymous payments co-hosted with the Taipei Ethereum community. I see the two as complementary: Tor hides who you connect to, and anonymous payments hide who you pay.

anoni.netgithub.com/anoni-net/docsTor relays in TaiwanThe Tor bridges

2020–2025COSCUP

COSCUP Volunteer and Subscribe

The problem. COSCUP, Taiwan's largest open source conference, is organized entirely by volunteers. Recruiting them, organizing them into teams and running the paperwork, down to reimbursing expenses, happened across a long trail of Google Forms and mailing lists. And once attending no longer required registration, COSCUP needed another way to keep people informed.

What I built. COSCUP Volunteer is the platform the organizing team runs on: teams and their members, applications with review and waitlists, forms, tasks, and budget and expense requests, which moved off Google Forms and onto the platform in 2022. It creates Google Workspace accounts, talks to volunteers through Mattermost and Telegram bots, and sends mail through AWS SES. It is written in Python with Flask and a FastAPI API, Celery and MongoDB, runs in containers on AWS EC2, and holds an OpenSSF Best Practices badge. I wrote most of it, 1,088 of its 1,227 commits, alongside 18 other contributors. Subscribe, its companion, handles newsletter sign-up with email verification and the sending itself, on Flask, Celery, MongoDB and SES.

The result. By mid-2022 the platform had 1,631 accounts and 8,660 logins, with 930 volunteers linked to Mattermost, and the newsletter grew to more than 7,000 subscribers. I maintained both through COSCUP 2025. Both are AGPL-3.0, so any other volunteer-run conference can use them.

COSCUP-Volunteersubscribe

2019–2022Internal Platform team (IT/MIS)

MIS-Workspace: automating internal operations

The problem. Administration, finance and IT ran much of their work by hand, across systems that did not talk to each other: moving data into SAP, handling leave requests, creating and removing accounts when people joined or left, and counting equipment. The same steps came back for every new hire, every departure and every month.

What I built. I led development of MIS-Workspace, an internal platform that tied six-plus systems, including GSuite, SuccessFactors, Slack, Jira, Bitwarden, VPN and Falcon endpoint security, into one directory and provisioning workflow. Joining and leaving became a single flow that creates or removes accounts across those systems. Leave requests, equipment inventory and the exchange of administration and finance data with SAP were automated. It was written in Python against each system’s API, with Celery and RabbitMQ running the jobs on a schedule and retrying them automatically when a system failed to respond. Colleagues outside engineering used all of it through simple web pages, and an employee information page brought assets, group memberships and department data into one view.

The result. Finance and administration work that used to take at least a week shrank to a single afternoon the teams could schedule together. In IT, the slow, repetitive jobs moved to scheduled automation, so the team worked at a steadier pace instead of stopping for routine chores, and troubleshooting got faster because the information was finally in one place.

2017–2019Retargeting team

Retargeting data pipeline

Retargeting shows ads to people who have already visited an advertiser's site, which means deciding, at ad-serving speed, whether a visitor belongs to an audience. I owned the pipeline that turned audience data processed in Spark into bloom filters, a compact structure that answers that question quickly. I improved its throughput by reimplementing the step that joins topic lists with user sessions as concurrent Go code using goroutines. I also led the refactoring of the tool that synced Google Analytics data, so it could keep up with the campaign management team's changing requirements.

2015–2017Business Intelligence team

Salesforce and campaign systems in sync

Business development, account management and campaign management teams kept deals in Salesforce and campaigns in internal systems, and moved information between them by hand. I built a service that synced the two in both directions, replacing that manual work and helping those teams close deals faster.