Announcement

**number6** · August 6, 2020, 16:59

Hackers see weaknesses in systems. They find parts of systems which are weak, and ripe for enhancement, or exploitation, or improvement.

Hackers can also appreciate parts of a system which work really well, and should remain when the system is rebuilt.

Your experiences, and ideas about DEF CON 28 Safe Mode (the good, the bad, and the ugly) and your ideas on what should be kept, abandoned or re-factored are a huge part of how DEF CON improves.

What worked for you? What didn't work at all? If you were Dark Tangent , and you were planning DEF CON 29, and you decided an online DEF CON was required, what would you change? what would you keep? What would you change?

Thanks!

**lrvick** · August 7, 2020, 14:31

Literally signed up just to say I am sad and disappointed to see Discord be chosen over open alternatives like Matrix, IRC, or some combination via bridging.

I totally get having to make choices in a short time window, but as a software freedom and privacy advocate I can't in good conscience recommend anyone go participate in the Defcon community this year if it means asking them to install proprietary apps on their phones and join yet another a walled garden... and then if they want apps or bots of extensions, then it encourages people to build on top of that walled garden creating lock-in.

If there is not time or resources to spin up your own servers in such a short time window (which I totally get), you could point chat.defcon.org at a turn-key hosted https://element.io instance. Yes these are also not servers you own, but it is still an open source federated platform with end to end encryption the sysadmins can't break and you control the DNS to redirect people to your own servers at any later date when resources exist to do so.

As it stands I can't really participate this year as I have built my life and career and hacker communities without needing any proprietary software on my devices or having to encourage others to do so. I try to lead by example that this is a viable path to be successful in this industry.

May not be the best analogy but I am starting to empathize with vegans whose friends all decide to move hang-outs to a BBQ restaurant. It really makes me sad there is no place for people like me to participate in the biggest hacker conference in the country this year.

At the very least as a last ditch I suggest making the room #defcon:matrix.org public so those with hard ethical lines on software and privacy that still want to participate in the defcon experience have somewhere easy to find each other.

I also realize this is pretty late, and I took for granted that Defcon always had the resources to be inclusive to those that prefer open software and protocols. If there was a lack of resources that made people feel like there was no choice but to use Discord, then I share some blame in that for not jumping in to offer help sooner. If anyone wants to try and pursue an open chat solution I am willing to throw some of my money, and experience into the ring if that is what is needed. Hit me up.

For now I have created #defcon_public:matrix.org for use for the open source outcasts like me until we figure something else out. I am also in #defcon on freenode.

I know everyone means well, and I hope we can find a more inclusive path forward together.

**number6** · August 7, 2020, 14:51

Originally posted by lrvick View Post

Literally signed up just to say I am sad and disappointed to see Discord be chosen over open alternatives like Matrix, IRC, or some combination via bridging.

I totally get having to make choices in a short time window, but as a software freedom and privacy advocate I can't in good conscience recommend anyone go participate in the Defcon community this year if it means asking them to install proprietary apps on their phones and join yet another a walled garden... and then if they want apps or bots of extensions, then it encourages people to build on top of that walled garden creating lock-in.

If there is not time or resources to spin up your own servers in such a short time window (which I totally get), you could point chat.defcon.org at a turn-key hosted https://element.io instance. Yes these are also not servers you own, but it is still an open source federated platform with end to end encryption the sysadmins can't break and you control the DNS to redirect people to your own servers at any later date when resources exist to do so.

As it stands I can't really participate this year as I have built my life and career and hacker communities without needing any proprietary software on my devices or having to encourage others to do so. I try to lead by example that this is a viable path to be successful in this industry.

May not be the best analogy but I am starting to empathize with vegans whose friends all decide to move hang-outs to a BBQ restaurant. It really makes me sad there is no place for people like me to participate in the biggest hacker conference in the country this year.

At the very least as a last ditch I suggest making the room #defcon:matrix.org public so those with hard ethical lines on software and privacy that still want to participate in the defcon experience have somewhere easy to find each other.

I also realize this is pretty late, and I took for granted that Defcon always had the resources to be inclusive to those that prefer open software and protocols. If there was a lack of resources that made people feel like there was no choice but to use Discord, then I share some blame in that for not jumping in to offer help sooner. If anyone wants to try and pursue an open chat solution I am willing to throw some of my money, and experience into the ring if that is what is needed. Hit me up.

For now I have created #defcon_public:matrix.org for use for the open source outcasts like me until we figure something else out. I am also in #defcon on freenode.

I know everyone means well, and I hope we can find a more inclusive path forward together.

Thanks for the constructive criticism.

It is possible to access discord servers and participate as a Human without using the PayPal and HumanPlus, and just use a Web Browser (Chrome/Chromium, Firefox, MS Edge, etc.)

I've been able to visit and watch videos on twitch and youtube with a common web browser as a Human.

There may be some villages that have content that required proprietary applications, but I have not encountered that yet.

So far, I have not encountered those. So far, all of the content I have been testing works fine with just a Web Browser on a desktop.

We considered IRC and other services, and we had a discussion about those choices here in the thread where you are replying: https://forum.defcon.org/node/232087

How would you address the concerns discussed in that thread on the topic of various platforms?

Keep in mind, we have a limited number of goons available with which to moderate content and helps avoid problems with people looking to disrupt access, and ruin attendee experience.

**lrvick** · August 7, 2020, 16:30

I read over the thread before posting, and I didn't see anything that was a hard blocker, unless I totally missed or misread something. Thanks for calling my post constructive.

I am really trying hard to offer what is clearly a minority perspective I feel strongly about without being too much of an ass. Fine line...

I did see notes about IRC and it being hard for people to use that lack bouncers. My community #! runs Oregono IRCd which has a built in bouncer so people can come and go as they please and it supports websockets natively so pure static web clients can connect as well making it easy to rapidly support people via web, desktop/mobile IRC clients... whatever people have and ensure they get a buffer of recent history so they don't lose conversation when disconnected.

I confess I don't know what scale this has been tested but I feel it deserves a mention. We have 500 users max on a small k8s pod, but it is a simple and cheap enough daemon that I would expect scaling to 10k+ users should be straight forward by round-robining a few beefy leafs with plenty of ram to host backlog. As always IRC allows easy guest user access without having to deal with trackers etc. I suspect the hardest part of scaling would be educating goons how to kick/ban abusers etc.

For the road better traveled with easier e2e support for potentially sensitive private messages, https://element.io has demonstrated their infra can scale decently to hundreds of thousands of users. Granted the main matrix.org server tends to get slammed from time to time which is why people often host their own servers, or pay their team to spin up services for them for any desired number of users as they did for mozilla etc.

If you choose to spin up your own matrix server (or in the interest of preserving limited resources pay element.io to spin one up for you) you can turn on guest user access and anyone can pop in and out just like IRC or Discord as well.

You could also turn on the IRC bridge mirror chats between your own ircd, freenode etc for maybe some mainline channels then people could use IRC or matrix as they prefer. FWIIW #!:matrix.org and #! on Freenode have been bridged for over a year with no significant hiccups.

As for platform compatibility, I don't know much that has a better compatibility story than matrix or IRC. I can't think of a platform you -can't- readily access either of them on via web, mobile, mobile web, desktop, terminal, etc all with open source apps.

Happy to elaborate further if there is interest, or if you feel I really missed some key point earlier in the thread by all means point it out.

If -voice- is a big requirement as some hoped for, I would second mumble as neither IRC or Element are designed for that. Mumble also has very wide platform support.

I don't want to make any of the above to be read in a voice that implies I am suggesting it is -easy- or being dismissive of the immense task of moving an IRL conference online for the first time, but what things worth doing are easy? We are hackers after all.

Thanks for hearing out different ideas if nothing else :)

**cryptoengineer** · August 8, 2020, 12:27

I can't find a place for general feedback so I'm adding this here.

This is my first DEFCON. It's anomalous, and I'd really like to be in Vegas for the experience. Nonetheless, I'm having a very good time.

BUT:

Some things are harder than they should be.

I'm actually trying to learn stuff - the talks, workshops, and presentations are the main reason I'm here.

However, navigation is a nightmare. I realize that villages each do their own thing, but the inconsistency is maddening. Some have schedules on the web site, but no links. Some expect
you to pick up links from Discord channel, but don't call that out or identify it.

At very least, each should have a clear, easy to find schedule, with links to each item presented, once its available. A lot of the time, I have to go to YouTube and search on the talk title.
(AppSec Village, I'm looking at you).

I'd prefer that talks be put up on Youtube - some villages seem to be running an hours long Discord stream, with multiple presentations. These don't seem to get preserved for later viewing.

A master schedule, with all events listed by time, would also be very helpful.

**number6** · August 8, 2020, 13:04

I've moved the posts from the platform discussion thread ( https://forum.defcon.org/node/232087 ) to here:

Please provide feedback on how DEF CON 28 SafeMode was for you. Constructive criticism welcome! How would you make DEF CON better?

**The Dark Tangent** · August 8, 2020, 16:16

I'm finding people don't know about https://info.defcon.org/ or the HackerTracker or other ways to get a handle on the schedule. That needs to be improved for sure.

**ehbehceh** · August 10, 2020, 21:47

It might be worth defcon considering creating an Accessibility statement and other Accessibility guidance with regards to its online and IRL activities. In looking about I noticed that there wasn't actually anything I could find on disability access, either on forum, info.defcon.org, discord guidance, infobooth chat or really much of anywhere. There was a number of 'help' and 'FAQs' placed around, but I couldn't find an actual statement that made clear defcon's thoughts and guidance/information on disablity access.

As a disability access auditor, and a disabled person myself it seemed a shame that defcon hadn't put in place things like captioning guidance, or alt-img descriptions for screen readers (amongst many other things) as a point of order and was instead relying on other platform's ideas of accessibility which have varying levels of success.

(Just want to add that considering how defcon was done, it was done very well for access - but access can always be better. Also, 1st defcon for me - really enjoyed it in general and just want to leave some maybe helpful feedback!)

**KaiserZr** · August 10, 2020, 23:04

I will start off with that this was my first Defcon ever, so I have nothing to compare it to. Despite the circumstances of how this came about with Covid, Defcon was everything I hoped it would be. I learned a lot and got to meet some very awesome people. Everything from discussing the greatest hacker ever (Gregory D Evans...jk), to awesome workshops hosted by the villages (thanks RTV, BTV, and PHV) and voice over of Doki Doki Literature Club (then cracking the puzzles built in the files of the games with Kevin and several other people in Pool 1 (or was it Pool 3 at the time...I slept since then).

While I was made of aware of the info link to the schedule I was lucky enough to see a Goon mention in chat very early on so I never had to search for it. So if there is any brief constructive criticism would be that should have been made a bit more visible. Other then a few minor issues with Discord that were corrected pretty quickly it went well.

I want to thank every person who answered any noob question I had about various things (soldering, breaking into the infosec field, etc) and just being awesome people in general. I was apprehensive about coming to defcon even before Covid, though I had already planned on it, due to social anxiety. Yet the community that I found in the Defcon discord was friendly and welcoming. It was more than I could ask for, and I will be at Defcon next year too.

Finally, thanks to every Goon and every person who put time into helping set Defcon up even in the situation the world is in. I will never forget this.

**abaranov** · August 10, 2020, 23:22

I don't think I can put all of my thoughts into one post so I'll post things as I think of them. The most important thing to me, as someone who has been a passionate security person and a "hacker" - but based overseas, I have always watched Defcon from afar and wanted to participate but never been able to. This year, I finally was able to participate.

For me, just this was a huge boon and I am so grateful. I helped manage a village, I spoke at two villages, did some games, did parties, played Jackbox, sat up until all hours listening to stories, debating, chatting, learning. I did workshops, CTFs and managed to get some talks while they were still fresh and I was able to get hold of the speakers and get my questions answered.

I was accepted into the community even though I was so distant.

I managed to arrange some of my Australian crew to do some talks in my village and get some international recognition. I hung out with old friends from South Africa and saw them and some of my new Australian friends volunteering and being involved.

TL;DR: For me, this was my first opportunity to "do defcon" and it was the greatest thing ever. There is plenty that can be fixed but just that it exists is amazing for me.

**TheRealProcyon** · August 11, 2020, 03:34

this was my first def con and possibly my last, unless my future turns out great. Anyway, I really enjoyed being able to be part of such a huge community. Even though I didn't watch talks I felt like I was actually in real life there. Even though some people said they didn't feel that way, for me I imagined what it would be like with all stories I heard and that's how I felt I was there. It just feels great that I was able to join. Sadly enough that may never be the case again. Hence it would be great if this community could stay up even if it would be having less channels. Having access to streamed talks would be great but sadly enough I heard something about a contract so I understand if that is not possible. Still it was an awesome experience and I really hope this community stays up and that even those that are unable to come to Vegas could have some sort of participation in Def con in coming years.

**Thmyris** · August 11, 2020, 04:20

Originally posted by TheRealProcyon View Post

this was my first def con and possibly my last, unless my future turns out great. Anyway, I really enjoyed being able to be part of such a huge community. Even though I didn't watch talks I felt like I was actually in real life there. Even though some people said they didn't feel that way, for me I imagined what it would be like with all stories I heard and that's how I felt I was there. It just feels great that I was able to join. Sadly enough that may never be the case again. Hence it would be great if this community could stay up even if it would be having less channels. Having access to streamed talks would be great but sadly enough I heard something about a contract so I understand if that is not possible. Still it was an awesome experience and I really hope this community stays up and that even those that are unable to come to Vegas could have some sort of participation in Def con in coming years.

I can only +1 this. I made a similiar post on youtube, gonna copy paste it here and add some more words.
"Im from Turkey and defcon was pretty much impossible for me to attend in person because of travel expenses. Also a big thank you for making the covid forced online event completely free. This is my first defcon and probably the last, but I'm enjoying my time a lot with all the talks and live events."
I watched as many talks as I could and attended in training sessions and ctfs. Even though it's forcibly transferred to online, DEFCON is still HUGE. In the 3-4 days I only had time to participate in 1 village only. And I only saw less than half the events of that village. The content was PACKED!! Thanks a lot to all the organisers and presenters who made all of it possible.
I can only imagine how hard it was to organise all of this. Even though there were some rough edges like others have mentioned I believe it was the best event humanly possible, with no experience of any sorts beforehand. So my only wish is that this experience doesn't go to waste and can be used for next year even if it's only for a very small part of DEFCON. Pretty please? :D

A small comment on discord:
Everyone who looked up the privacy policy of discord at the date of its birth knows they store and monitor everything. While I can understand people not liking the idea of installing proprietary software on their computers or even using one, let's not forget accessibility is a real issue. It has to be easy to pickup and get going for the average user. And discord provides this ease of access. So compromises have to be made and using discord from a web browser for 4 days is not that bad, let's be honest. You could just make a throwaway account.

**wonderingraven** · August 11, 2020, 08:14

Being able to come to Defcon in person for so long, I watched how big this has really gotten over the years, this was a good change up for what is currently going on.
Problems I seen so far was it was easy to get lost in the villages or miss out on the talks and demo's easier than you expected, but I did make most of the track1 with no problems.

But I felt it was easier to socialize this way, in person I always felt like a fly in the wall.

Best thing tho, out of all the years I never got to see the closing ceremony due to being pushed out from being at full cap.

**CrazyAl369** · August 11, 2020, 21:21

Defcon 28 was the first Defcon I've attended. I remember making plans with my friend from college that is also a computer science major about going to our first con for about a year now. We were bummed out when we heard about Defcon 28 being canceled back but we knew that it was for the best. Then we heard about Safemode and thankfully it happened.

I'm not the most social person, so naturally, I really enjoyed Safemode. I started to watch the Village Talks and I ended up learning a lot more than I thought I would. The Biohacking Village talks really stayed with me after Defcon 28 was officially over. I started to have a lot of conversations recently with my family and friends about the issues discussed about the lack of security in healthcare devices. I’m really appreciative of the Village Talks in general because I can’t even imagine the amount of research that goes into the presentation. The Village Talks made a huge impression on me.

I feel like a noob because I wasn't aware of Hacker Jeopardy up until 20 minutes before it was about to happen. That was one hell of an experience that I wasn't expecting. You got a lot of very smart people competing in Jeopardy for Hackers while drinking some nice beverages with categories like "Are You Smarter Than An CISSP" and "Internet of Cats". Brilliant!

Hanging out in pool one was awesome! All the crazy stories and cool people that were there. I'm already excited about next year's Defcon whether it is in Safemode or in person.

I just want to conclude my comments by saying Thank You to The Dark Tangent, all the Goons, and everyone else who made this year's Defcon possible!

Announcement

Safe Mode Thank You and Feedback Thread

Safe Mode Thank You and Feedback Thread

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment