diff --git a/HACKING.md b/HACKING.md
index 2d9ea7b..5d5e4b1 100644
--- a/HACKING.md
+++ b/HACKING.md
@@ -30,6 +30,25 @@
   or above a particular intensity. Indicate somehow the length of
   each continuous stretch at that intensity
 
+## Multiuser
+
+I am minded to avoid writing any of that user registration/authn stuff
+and just use a third-party SSO thing like Authelia to cover password
+resets etc.  Installation instructions will include "set up a reverse
+proxy for this app which sends Remote-User and other Remote-* info as HTTP
+headers".
+
+
+However, we do still need some changes
+
+1) trackpoints are no longer unique by time
+2) also sessions
+3) we want a `users` table with id and name/fullname/email to tie them back to
+4) if there is no userid for the current Remote-User header, make one
+
+
+
+
 ## Sessions