At last, DEFCON…

I’ve wanted to go to DEFCON since I first heard about it almost 20 years ago, and finally the stars aligned and it was a possibility this year. Spoilers, it didn’t disappoint.

While DEFCON is no longer the insane party that you may have heard of in the past, it’s none the less three-ish days of discovery and debauchery. Everything from super in-depth talks, to scavenger hunterse, to impromptu analog synth parties in the back end of the venue last at night after most folks have gone to bed. The vibe was real.

What did I get up to?

This was a work trip for me, so I ended up spending a fair bit of my time catching relevant unrecorded talks since the content was excellent. This meant spending a lot of time in the RECON village chatting with folks who do OSINT work as a lot of this leads to discovery for vulnerabilities in my current line of work. As part of the Scav Hunt I also learned how to make a Doom map and created a Stego Stegasaurus. Beyond that, I participated in the scav hunt with a team of other friends and had a blast, though we didn’t get the black badge… maybe next year!

I also had a chance to go to several parties (as a legitimate guest, no less)!

I started the week off with HackerOne’s party at Mandalay Bay’s EyeCandy. It was… an experience. As far as Las Vegas is concerned, COVID is just no longer a thing. We were packed in like sardines - standing room only - and the music was so loud that you had to scream in someone’s face for them to be able to hear you. It was nice to see something closer to “normal” again, but it was definitely uncomfortable. We ditched after a while and found a nice quiet-by-Vegas-stanards bar to socialize at. The next night we went out to a party that Microsoft hosted at Area 15 and it was an absolute blast. MSFT had rented out the Illuminarium, which was done up floor to ceiling (including the floors and ceilings) to be like the surface of the moon. They had challenges hidden around for prizes, great drinks, great food, and I had a chance to meet some folks in industry that I’ve been following for ages (Marcus Hutchins, Jason Haddix, InsiderPHD, and others). It was fantastic.

The DEFCON first timer’s trap

I did, however, fall into the trap that many first time attendees fall into, which is trying to do too much. Three days is nowhere near enough time to do everything you’ll want to do at DEFCON. Lesson learned - next year is going to be much more focused. Scav Hunt, and time spent around 2-3 villages… and ideally ones in close proximity. Having to hike from Caeser’s Forum over to App Sec Village in the Flamingo was nearly a thirty minute walk when accounting for foot traffic. The scale of the event is just plain crazy.

I probably lost out on almost a full day of time just between waiting in lines for the Merch hall and walking between buildings. It’s definitely important to find a focus and stick with it, at least during the hours the villages are open.

What’s the plan for next year?

A few tangential learnings, and certainly some of which are tied to being a bit older and being reasonably well traveled:

• Staying at casinos still sucks. The rooms are not amazing, and the prices are absurd. The Westin is the same walking distance to the event as Bally’s, but is considerably nicer and quieter.
• The Las Vegas monorail considerably expands your hotel options, though keeps you somewhat limited to casinos. None the less, a 10 minute ride on the monorail is worth it to stay somewhere much nicer.
• Go shopping for Scav Hunt items immediately. We waited until Saturday to do so, and definitely missed the boat not only on points (due to decay), but on time.
• Go to the DEFCON parties! I had expected some of them to be reasonably “meh”, but the DJs were great, and the Chillout hall/community parties (QueerCon/GothCon) were bumpin'.
• Talk to more people. Everyone has something cool they’re working on, wants to learn about, or wants to teach. It’s the only place I’ve ever been where walking up to strangers is almost always a rewarding experience.

And lastly… book travel and hotel more than 3 weeks in advance, even if it’s on my own dime.

And in closing…

Don’t think about going to DEFCON. If you’ve watched a talk, or heard about a village, and it sounds even remotely interesting - GO TO DEFCON.