A stranger walks into your room: how a broadcast link works

The most-used feature in Huddles is also the one we get asked about most nervously: anyone with the link can listen? Yes. Here is exactly what that means, what it does not mean, and how it is built, because the details are what make it safe.

What the person with the link gets

Somebody in a huddle presses Go live. They read a short card that says, plainly, what is about to happen — that the conversation can be heard by anyone with the link, that the link lasts a day, that listeners can react and ask to speak — and they tick a box every single time, because consent you cannot point at is not consent. Then they get a link.

Whoever follows it lands on a door. It has the name of the huddle, the space it is in, and a field for a name. No password, no account, no app. They type a name, pick a face if they like, and they are in the audience.

From the audience they can hear the conversation. They can see the whiteboard if the speakers have it open, and the document, and a screen share, and a video the room is watching together, all in sync. They can send reactions, which everyone sees. They can chat. They can raise a hand. If somebody running the room brings them up on stage, they can talk.

What they cannot do: see the space, see who else is in it, draw on the board, or speak unless invited. They are a listener, and a listener is a different kind of thing from a member.

The link is a signed grant, not a password

The link carries a token. The token is a signed statement — signed by the server, with a secret only the server holds — that says: this token admits its bearer to the audience of huddle X, until time T. It cannot be forged, because the signature would not match. It cannot be extended, because the time is in the signed part. It cannot be pointed at a different huddle for the same reason.

It is unaddressed, deliberately. A link you can only open if you are a particular person is a link that does not work when it is forwarded, and forwarding is the entire point. So instead of addressing it we made it short-lived: twenty-four hours, the shortest life of anything the product issues, because it is the most forwardable.

The same primitive — a signed, short-lived, single-purpose grant — underlies every kind of link Huddles issues. An invitation to a space lasts days and admits a member. A link into one huddle lasts two hours and seats a participant. A broadcast link lasts a day and admits a listener. The rule that connects them: the more a link grants, the less time it grants it for.

Stopping is real

When the broadcast ends — somebody presses End, or everyone leaves, or the huddle is made private — three things happen at once. The grant is revoked, so the link stops working. Every listener's connection is closed, with a code that tells their screen "that is a wrap" rather than "reconnecting". And the huddle's board and document, if it had them, go with it.

We did the revocation and the disconnect on purpose. Revoking alone would leave people listening to a room its members think is closed. Disconnecting alone would have them reconnect a second later. Both, or it is not really stopped.

Why a listener is cheap

This is the part that made the feature possible rather than just desirable.

In a huddle, every member has a presence: a position on the field, an avatar, a place in the grid that decides who can see whom. Presence is what makes the space feel alive, and it is also the expensive thing — every member's position has to reach every other member, ten times a second, so the cost grows with the square of the room.

A listener has none of that. No position. No avatar on the field. No place in anybody's grid. They receive the huddle — who is speaking, what is being shared, the captions, the chat — and nothing about the space around it. Which means a hundred listeners cost about what a hundred copies of one frame cost, rather than a hundred people's worth of presence multiplying against each other.

We built the audience as a different model from the members rather than as "members with fewer permissions" precisely so this would be true. It is the single most important architectural decision in the product, and it is invisible.

What the audience sees, and what it does not

The listener's screen shows the stage — the faces of the people who may speak, with a ring on whoever is talking — the title, a count of who is listening, and whatever the room is sharing. It does not show the space, or anyone in the space who is not on the stage, or the roster of other listeners by name beyond a drifting handful of faces.

The room, meanwhile, sees a count, not a roster. Five hundred names in a panel is a stadium, not a room. The one exception is a raised hand: somebody asking to stop being an audience is asking to become a person, and you cannot bring a number up on stage.

The stage

Being in the audience and being on the stage are different, and the difference is enforced by the media server, not by the interface. A listener's audio token lets them subscribe and not publish. If they are brought up, they get a new token that lets them publish; if they are put back down, that token is what stops. A client that wanted to talk over the host could not, because the permission is not a flag the client holds.

That same rule applies to members. Somebody who drags themselves into a huddle that is live is seated — in the huddle, but not on the stage — until somebody brings them up. Before we did that, anybody could walk into a broadcast with a live microphone.

Why the door has a name field and nothing else

We have been asked why the door does not ask for an email, or offer sign-in more prominently, since a listener is a person we would like to keep. The answer is that the door's job is to let somebody hear a conversation that is happening right now, and every second of door is a second of that conversation they are missing. Sign-in is offered beside the name, never instead of it. Anyone who wants to stay can make an account afterwards, from inside, having already seen what they would be joining.

It turns out the product is a better sign-up page than a sign-up page.

The short version

A broadcast link is a signed, one-day key to the audience of one room. It admits a listener who costs almost nothing, can hear everything and change nothing, and can be brought up to speak by the people running the room. When the room closes, the key stops working and the audience is shown out.

That is the whole feature. It fits on a card, which is why we put it on one.