What I'm trying to get at is, at the end of it, when you boil down DEF CON, it's community.
Sense of community.
People want to see each other, people want to talk to each other, they want to share experiences, and if they don't have to walk to three or four different hotels, that's awesome.
So... okay, so I'm going to sort of officially start this off.
I'm Dark Tangent.
I started DEF CON 32 years ago, and over the decades it has grown and grown, and so I'm just going to give you a couple little insights that I've picked up along the way, and then send you off into the stream of the CON.
We have fantastic speakers, we have great creators, and I'm just going to try to orient you a little bit about kind of what's going on.
Something you'll hear frequently is that the CON is what you make of it.
And the thinking here is that there's an unlimited number of things you can do.
You can't do them all.
So please, be okay with yourselves when you can't do it all.
My big moment for this was I think DEF CON 3 or so.
DEF CON 1, I knew it all, I was there, I saw it, it was awesome.
DEF CON 2, whoo, there's more people, this is great.
DEF CON 3, after the CON, people are coming up to me and saying, that was great, did you see the thing that happened?
Like, no, I didn't see the thing.
It's my CON.
I didn't see the thing.
It's like I'm missing out.
DEF CON 4 rolls around, you're like, okay, I'm never seeing all the things.
Like, I just have to be okay with that.
And then when you make that mental shift, then it's like, well, then I want to create more things I won't see.
So I don't feel so guilty, you know, like I'll just be able to internalize it.
There's absolutely no way in the world.
And then other fuckers, they also will have stuff that they don't see.
And then we'll all be in the same boat together.
And it just kind of grew that way.
So that's where the phrase came.
It is what you make of it.
If you want to be technical, get at it.
And so what's going on there is, let's say there's a thousand people and then years later there's 10,000 people, 20,000 people.
It's hard to be social with 20,000 people.
So we have to figure out a way to get you into smaller groups.
So a lot of behind-the-scenes engineering is how to break up large groups into sort of affinity groups, car hacking, and then break that up into like ODB hacking.
And now you're at a table with 10 other people doing the thing you're interested in at that moment.
And now you can make friends if you're at a table with 8 or 10 people.
You can do that physical security, lock picking, high security lock, and now you're at a table with 10 lock pickers.
And so when people say there's too many people here, it's like, yes, we know that.
But we spend a lot of time trying to figure out how to get you to have more personal experiences.
Like the food court, you sit at a table, people will join you and they will talk.
Whether you like it or not.
So that's part of it.
Also, we really try to instill this thing of like ask questions.
Maybe at DEF CON 1 there's a handful of people that knew how the world worked.
Not anymore.
There's no way any of us can understand how any of this technology works at any depth.
Because the market forces have required specializations in our careers.
You will be like 9 miles deep on some tech stack and the guy next to you has never fucking heard of that tech stack.
Because he's not in your area.
He's in aerospace or IOT or OT or something.
And so that's super cool because now you have license to ask what you think are dumb questions.
So just ask questions.
I'm not going to tell anybody if you ask me a dumb question.
It's our secret.
And so now we're creating this environment.
You get these individual experiences.
You can ask dumb questions.
You can wear whatever you want.
And we just want you to like... so the origin story, I'm sure probably many of you have heard it.
But when I started Defcon, I couldn't go to cons because they were all invite only.
There was one con or two cons that weren't invite only.
No.
Summer con was invite only.
Hoho con.
So they were all named after seasons.
Hoho con was in Christmas.
Christmas con or Xmas con.
Then there was pump con in Halloween.
Summer had summer con.
And so we named Defcon or I named Defcon not after a season because I didn't like how that locked me in.
And I wanted to make it not invite only because I had been excluded.
So that meant I had to let everybody attend.
I couldn't limit it.
And so that's the biggest fork in the road that Defcon ever had to make.
Open or closed.
And since I had been excluded by closed, I made it open.
Okay, now you're open.
How do you limit attendance?
You can't limit attendance because now you're rewarding type A personalities and I hate those fuckers.
Because they get up early.
They go down their checklists.
So I needed to be able to balance them out with the team type B.
So that's been one of our challenges.
As we grow, we turned into through those two forks in the road, we became a reflection of the community.
If people are complaining, oh, no, there's too much aerospace this year.
Sorry.
That's the way the world is going then.
Those people decided to show up.
So that must mean something.
It wasn't artificially created.
So sometimes when you look around, why are things the way they are, it's largely the result of extrapolating some of these early decisions.
One other thing I say is, so I was really, I was in college.
But Donna had a documentary movie or something come out.
And in it, she's having this camera follow her around everywhere.
And some other celebrity wants to talk to her privately and asks, hey, can you turn off the cameras?
And she doesn't turn off the cameras because she says, well, if it's not recorded, does it even exist?
Did it even happen?
And it's a famous, other people have said this for years.
But my first exposure to that quote was in this Madonna documentary.
So I was like, aha, I have to record the first DEF CON.
Because there's going to be people who wanted to come that didn't.
So we audio record all the talks.
And now I'm trying to sell these talks.
And they're in cassette tapes.
And I'm duping them in a cassette tape duplicator.
Not a hard drive duplicator.
A cassette tape duplicator.
And I'm trying to sell these things.
And I do that for about a year or two.
Then we have the next DEF CON.
I got another stack of tapes.
But by the third DEF CON, streaming has come along.
We have real streaming.
And I'm like, oh, yes, I am selling these tapes.
So I encode everything and I put it online.
And I just gave away the talks for free.
So now that became a tradition.
I just recorded and gave away all the content.
Part of that was because, again, in the early days, there was limited access to information.
Right?
There was no Google or AltaVista.
No Amazon.
No excuse me.
You would spend half your energy trying to find the information.
The person that knew the answer.
And the other half trying to understand it.
Nowadays, the time for you to reach the information is like, I don't know, a couple of minutes.
Doing a couple of searches.
And so to accelerate that in the early days, we gave away all the content.
Well, then we started Black Hat.
Black Hat gave away all the content.
Now, basically that's the norm.
Every conference, at least in the hacking space, gives away their content for free.
I like to say that's a master.
It's weird.
It was not.
It was because I was type B and lazy.
I didn't want to keep shipping those tapes.
Hey, hey, hey, hey, it's patched.
I see it here.
Hey, hey, two, two, two, two, two, but I'm not getting it out of the actual channel.
Hey, hey, hey, hey, hey, hey, hey, hey, hey, two, two.
Two, two.
I mean, there's something cool being at the music concert and seeing the artist, but you can also enjoy their music later.
Same thing here.
If you miss a talk you wanted to see, it's okay.
We'll release it.
You just do what you want to do.
Right?
Make a couple of bullet points each day of what you want to explore.
If you get your two or three things done, victory, but don't feel bad.
The other thing is we are not an infosec event.
Right?
We are not RSA.
We are a hacking event.
What does that mean?
It's one of the things the CFP review team does.
It's basically our filter.
When you submit to DEF CON, one of the first questions that goes through our mind is, is this hacker?
Right?
Hey, hey.
Is there a sense of joy of discovery?
Is there like a spontaneous aha moment that the speaker, the presenter had?
Oh, my gosh, that's how this chip really works?
I would never have figured that out.
Unless I spilled vodka on it.
And so, we don't have attendees that work on Oracle million dollar database servers.
Who here has an Oracle million dollar database server?
Nobody.
Right?
So, they might edit RSA or Black Hat.
That's where they're working.
Corporate environments have that stuff.
Not here.
So, the idea is if you're going to hear a talk, it should be with technology you can download.
The tools that people are talking about should be released.
You should be able to hear something and go and play with it.
And so, that means it limits our pool.
We're not going to have the cool super Oracle database hacking talk, but we'll have other cool talks that are also accessible to you.
So, we start trying to choose content that is more hacker, that gives you an idea how to think.
And I had a friend, I might have told this story last year, I had a friend that I asked him, hey, are you sending anybody to Defcon or Black Hat this year?
And he was involved in a, let's say a part of the government that does stuff to people that don't like us.
And so, I'm always curious like what his thought process is.
And he said, well, no, I'm not sending anybody to Black Hat, but I'm sending my team to Defcon.
I was like, well, that doesn't, like, why would you do that?
He said, well, my guys are pretty good.
I mean, they're really good.
And it's like polishing the edge of a knife, like you're honing it, sending it to Black Hat.
Like, they'll get a little bit better technical skills, but I mean, hey, look, it's pretty fucking sharp.
But I send them to Defcon to learn how to think.
How to approach the problem.
How to think differently.
That's more valuable to me now, right?
They can sharpen their knives all day long elsewhere.
And when he said that to me, it was this aha moment.
Because running the con, you're very close to it.
And you see all the problems.
They're, like, in your face because everybody has no problem telling me where all the problems are.
And so, I sometimes don't see the big picture.
But when somebody far away explains what they're seeing, it's like, okay, now that I understand that, we'll do things to try to help you learn how to think differently.
I mean, we were doing that already, but it was never, like, up front and center.
So, that's super cool.
And then the final thing is, we really try to support the community.
That's why I said hacker.
Right?
We're a community.
Defcon is one part of the community.
We've been around a long time.
Maybe we're one of the biggest cons in the community.
But there are lots of communities with lots of different, like, norms and behaviors.
One of the things we like to do here is not stop.
So, we go to 2 in the morning or so.
And we have music.
And we have all these entertainment performances.
And the hacking community is big enough.
We have our musical style.
Right?
We've got nerd core.
And when you go to other countries, or when we were doing, we did Defcon in China and Beijing for a couple of years.
And I remember we get over there and we're like, yes, okay, what's the music scene like in China, in Beijing?
Is it rock?
Is it jazz?
What is it?
We've got to get people from the community.
We've got to showcase people from the community and have them play music at our parties.
And they're like, oh, yes, okay, yeah, we'll get music for the parties.
I'm like, yeah, but who are they?
What's the cool thing?
It's like, oh, no, we don't have that.
What do you mean?
It's like, well, there's nobody does that here.
There's no style or musical bands.
Like, oh, no.
What else does the community not do over here?
And so, it's made me think.
Something is more unique here where people have created musical genres around it.
They've had enough space to express themselves to grow the community in different ways.
And a lot of the questions we got when we were in China, like a Chinese dude in a giant fucking banana outfit would jump on stage and run around.
And the Americans would be like, oh, hey, banana guy.
And they'd just keep going.
And the Chinese people would be like, what the hell is going on here?
There's a banana on the stage.
Does that mean something?
And they're looking in the program.
When the banana shows up, am I supposed to do something?
It's like, no, that's just the banana guy.
And we were trying to inject a certain amount of weirdness.
And it didn't go so well because they're not programmed for weird.
The question they would get is, okay, there's a scavenger hunt.
Now, what do I get?
Why would I do that?
Why would I invest 8.2 minutes of my energy into that if it doesn't help my career?
Well, yeah, it's not going to help your career, but you're probably going to have fun doing it.
And you can see them really working through that.
And so the hacker spirit and the mentality I think is universal, but the way in which people get there is quite different, right?
And we were really lucky in the states that we got a lot of time between high school and college and having to have a career that we could screw around.
Like if I had to do my effort I put in college in high school years, I wouldn't be a hacker.
I'd be too busy.
And so we're also really lucky the way that people got into hacking and allowed this amount of creativity.
We want you, especially I think in America, you're allowed to fail.
You're supposed to fail.
If you don't fail, how do you learn?
Like we love the underdog.
We love the comeback story.
And partially I think it's because it shows somebody failing and then succeeding.
That's not such a universal story, you know, in the world.
So one of the things we do, before I run out of time, just to explain the back story is you'll see around the con we have these signs up.
It's our code of conduct.
And it lays out what we do.
The code of conduct applies to everybody.
It applies to me.
It applies to everybody in the Goon shirt.
It applies to you.
Everybody.
And the idea here is that we should respect each other and not make people feel afraid, unwelcome, you know.
So if you don't like what someone is saying, great, just move on.
You don't have to get into a fist fight with them.
But what's the natural consequence of having a policy is you have to enforce the policy.
If you don't enforce the policy, people are watching and they'll see if we don't enforce the policy, it doesn't mean anything.
So then a few years later we came up with our transparency report.
And you'll hear this at closing ceremonies.
Everything that we figured out that happened during the con that violated the code of conduct policy, we'll just kind of give you a quick summation at the closing ceremonies.
And this is sort of a hack to make us accountable to ourselves.
Because if we didn't know we were going to have to report all this stuff, there's an incentive to then how would the community ever know we're actually taking their concerns seriously?
Oh, yes, thank you for your report.
Oh, sorry, no problems this year.
And so it's kind of painful.
It's sad when we have serious things on the transparency report.
But I also think it's absolutely a healthy thing that we have to do and we must maintain to show the community that we're holding ourselves accountable.
And I'm always open for ideas and rooms for improvement.
Because ultimately, right, the con is what you make of it and I want you guys to feel, gals, but you can do whatever you want.
We're trying to create this experience.
And the other thing is, I have 35 seconds.
The other thing is the origin story of DEF CON of the speakers was that there was so much bullshit online or on voice bridges about what was real and what was fake, what technically worked and what didn't.
You know, if you call this one number and put in this code, the next phone call you make can't be traced.
Like, really, can't be traced.
What is that number you're calling?
I don't know.
It's the no tracing phone number.
Why does the no tracing phone number exist?
I don't know, but it's the no tracing phone number.
God, I've got to find somebody from the telco to come and explain what this number is.
If you have a bulletin board and you put on the log in page, law enforcement is not allowed to log in.
No law enforcement.
And they create an account and they log in.
That's entrapment.
Really?
So if the FBI is investigating you and you just put these signs up, like, FBI, you must raise your hands, identify yourself, they've got to do that?
Oh, yeah, that's called entrapment.
I don't think that word means what you think it means.
Like, Al Capone would have used that somehow to his advantage.
Okay, I've got to find a prosecutor now.
So we got the first F gun, we had the prosecutor that was prosecuting a bunch of people and she got up there and, you know, laughed about that.
We got people from telco, we got people from Sun Microsystems talking about how exploitation and managing large systems actually worked.
Hearing from the horse's mouth.
From the source.
And that's why sometimes you'll see speakers like our next speaker, previous director of the National Security Agency, General Nakasone, it's like, now you're hearing from the source.
These aren't people you might normally come into contact with.
So that's why sometimes you see these big name VIPs.
It's because we're trying to expose you to people and content that you might read about but you don't normally bump into in your life.
And luckily we're big enough and they're interested in us enough, they want to come and meet us now.
It's not just a one-way street.
It's not just us wanting to know what they're doing.
So with that said, thank you very much.
Sorry my voice is shot.
I sound like a frog.
Have a great time.
Thank you very much.
I'll see you around.