Post-Pandemic Vacation Planning, Actual Leisure, and Threat Modeling

What does it even mean to plan a vacation for pleasure after more than a year where we felt like being outside your home was the most dangerous thing?

I’ve planned two-week trips before. I’ve planned many trips to New York. I’ve planned solo trips, unstructured trips full of wandering, and trips meant to answer some kind of built-up longing.

My upcoming trip is all of these things, and yet this is new.

What is it to just be starting to leave the house again, to retrain my brain to not think that BART cars and other enclosed spaces are shared incubators of guaranteed death, only to immediately go to one of the most populated cities in the world?

Difficult, I’d say. And also as necessary as anything has been for the last year.


For this trip, I wanted to try existing in New York in an ordinary, “I live here, actually” kind of way. During my last longer stay there, I split an apartment in the Upper West Side for a week with my friend who lived in Astoria for many years, who was always a commuter train ride away even once she had to leave the city. I’ve never been there without that backup. I have other friends there, but the focus won’t be the same.

This time, I’m going to spend a week in the Lower East Side and then a week in Fort Greene, at the advice of another friend who used to live there. I think highly of Astoria, but my visits to New York were based there for more than a decade. A fact-finding mission needed to be based elsewhere.

For the second week, I’m pretty sure I’ll have relaxed enough to stay in a bedroom in someone’s apartment – or I certainly hope so, because that is what I’m doing. After a week bouncing around the city, I will have gotten used to some things. But upon arrival, after hours and hours in airports and a sky tube and all this proximity, I assume that I’ll be essentially broken. I did manage to find one of the only flights from SFO to JFK that didn’t leave at either 7 am or 11 pm, so I’m not destroying myself (AGAIN) with a red-eye flight or one that’s so early it might as well be. But after six hours in a plane following 15 months in my apartment and almost only in my apartment (with a handful of exceptions), I’ll be wrecked. And heading from that into a stranger’s apartment is too much. My first week will be in a modest li’l hotel, and that is fine.

I realized that the following things will be especially important on this early voyage back into the world:

  1. A door that closes and that no one will come through. A ton of Manhattan Airbnbs had a single bathroom accessed either through the guest’s room or host’s room, and while I understand what’s up with this, I also know that my tolerance for risk and weirdness will be bottomed out upon arrival and likely won’t replenish fast enough to make this something I can deal with.
  2. A reasonably predictable situation, which sleeping in someone’s living room, rules for where snacks may and may not be eaten, a living room full of forbidden exercise equipment but no furniture, or sleeping behind a curtain do not permit. Yes, these are all real examples of options I (briefly) considered.
  3. A place to stay where, if it does take me until 4 pm the day after I arrive to reemerge into the world – not unheard of for me on first days of trips – it won’t be observed, keep anyone from having a pee, or otherwise affect anyone except me.

I’ve always tried to minimize strife when planning trips, working to balance that with budget concerns so I can do more for less. Rarely, though, has the definition of strife included “I want to do everything I can to ensure I don’t end up hiding under a blanket, wishing I was back home.”


A central part of my job is threat modeling, which means considering a system (either built or just planned) and figuring out where risk lies and what those possible risks might be. With something like a website, some of the risk comes from anything that takes in text or other parameters. You can mess with the servers behind them by putting in input that does weird stuff to databases, or you can compromise other users by sending them links with parameters that make things misbehave. You can overwhelm an unprotected server with traffic, taking it offline. What systems does it connect to? What data does it present or allow users to update? These are all things to consider.

I like threat modeling, and it’s been an interesting era to have cultivated this skill. Now I threat model myself. What happens with my own vulnerable system once I go somewhere new, full of new inputs and uncertain motivations?

I can address some: I’m still being cautious, but my antibodies should have reached full strength more than a month ago, so my caution is mostly for the benefit of other people as we scramble to figure out exactly what the risk of transmission is with new variants as a vaccinated person among people with compromised immune systems or other risks. I’ve been figuring out how I want to work within those risks and trying to err on the side of being conservative. I decided to not go out for the two weeks leading up to this trip because the chance of dragging some California variant across the country to an unsuspecting city felt like an unforgivable risk.

And then there are the others.

The brain-breaking people fear, old social anxiety amped up by a lack of practice and so many months of stranger danger, all this aquarium living. How I know handling necessary things, like feeding myself in an unfamiliar place, gets more complicated when I’m freaked out. And then the ever-present curiosity of whether I’ll return to not trusting said vaccination, which has nothing to do with the vax itself and everything to do with this being the first time I’ve had a vaccination for a current and newly arisen concern rather than a piece of distant-to-me history, a new kind of trust fall.

As with websites and servers and networks, there are mitigations. I’m getting out among people a bit before taking the big plunge. I’ll bring snacks with me, and I’ll plan at least a couple of meals for my first full day there, so my decisions will be fewer as I adjust. And the last?

No system can be perfectly secured. Eventually, you just have to go live and plan to respond to any incidents that come up.

With travel in other years, I depended on my reliable love for leaping into the unknown. Things would be awkward sometimes, because I would need to learn things as I went, but in the end, they’d all be good stories. This was, I learned in 2020, the difference between anxiety and fear. Anxiety is a thing to vanquish, to push against and congratulate yourself on your bravery.

Fear is different. I understand that better now. It reminds me of this amazing article about Airbnb trying to make headway into Japan, only to discover that different cultures weigh risk and uncertainty differently. I used to have an American risk tolerance, all acceptance of failure and encouragement to try again and again, but I find myself feeling more like many of the Japanese people in that article now. I assume that’ll diminish, but I can’t guess when.

I used to consider myself brave in what turned out to be a fairly flimsy definition of the word—harmless, generally, but not something that stood up well in the most recent era. And my ability to rely on that quality has taken a beating in the samey-same last year-plus of living, this cheap cartoon repeating background version of life, this phase where “I saw a person” becomes an anecdote worth relaying, this era where donating blood is fascinating enough that it fuels more than an hour of excited conversation.

What else is there to do, really, but fling myself into one of the biggest cities in the world? I can be mindful of what I know, understand that the problems I can’t predict can probably either be dealt with by throwing money at it or running away to regroup, and trust that my old instincts are somewhere in there.

And if not, and you happen to see a story about a pink-haired NYC tourist who absolutely lost her shit in a newsworthy way? Spare a little kindness before you keep scrolling.