![\"\"](\"http:\/\/breanneboland.com\/wp-content\/uploads\/2017\/06\/defcon_crowd.jpg\")
<\/p>\n<\/p>\n
Via Flickr<\/a><\/p><\/blockquote>\n
I decided to go to DEF CON last year on a lark. I went to a <\/span>WISP<\/span><\/a> lockpicking event last June with a friend and coworker, who informed me that she was considering going, and oh, hey, did I want to come with? I\u2019d heard of it before, but not in detail and not quite in the right context to make it sound like something I\u2019d want to attempt. This time landed differently, though. (I blame having recently learned to use a handcuff shim.) I spent the evening after the event looking up flights to Vegas, hotels, and other research that suggested this was not a financially responsible move and not really very good timing either. Still, it stuck in my head, and I had to pull myself away from Kayak and its ilk and make myself go to bed later than was ideal.*<\/span><\/p>\n
The next day, I mentioned it to a different coworker, who has a good balance of fun and financial responsibility. Since we were less than a month out from the event and I had neither transportation nor a place to stay, I expected her to talk me down and suggest that I try next year.<\/span><\/p>\n
Instead, she told me she was going, and did I want to share a room? And that was phase one done – resolve achieved, bed secured, posse acquired, and only the small matter of airfare and time off to deal with. Fine fine.<\/span><\/p>\n
Phase two was one I\u2019ll call, \u201cOh, you\u2019re doing to DEF CON? That\u2019s\u2026 interesting.\u201d This phase happened after reservations were in place, when I told friends and colleagues in tech what I was planning. The reactions tended to be similar: a mix of understanding why I\u2019d consider doing such a thing and affectionate concern based on knowledge or experience of some shitty person or people in their past. These reactions came in a few flavors:<\/span><\/p>\n
\n
- I went a few times but then had to stop [insert ominous look here]<\/span><\/li>\n
- I wouldn\u2019t go there if you paid me, not any amount<\/span><\/li>\n
- I hope you enjoy yourself, but be careful (and you\u2019re not going alone, right?)<\/span><\/li>\n
- You are not allowed to take any work assets with you on this trip<\/span><\/li>\n<\/ul>\n
(This last one came from one of our bosses. We complied.)<\/span><\/p>\n
Research nerd that I am, I looked up \u201cHow to DEF CON\u201d but largely found articles aimed at, well, stinky boys. (#NotAllStinkyBoys, I know, but you should talk to other, more prominent bloggers about that if you want to shift those optics.) I did come away with some good, more general advice, most of which echoed what had been said to me already. Things like:<\/span><\/p>\n
\n
- Turn off the wifi on your phone<\/span><\/li>\n
- Probably just keep your phone on airplane mode when you\u2019re in the thick of things<\/span><\/li>\n
- Maybe keep it in a <\/span>faraday bag<\/span><\/a>, while you\u2019re at it, come to that, and still wipe and restore it when you get home,\u00a0because you never know<\/em><\/span><\/li>\n
- Just leave it at home, assuming home is in another state<\/li>\n
- Trust no ATM in proximity to the conference (though casino floor ones <\/span>might<\/span><\/i> be ok, heavily monitored as they are – but if you can get by without, do that)<\/span><\/li>\n
- Don\u2019t bring your laptop; bring a burner if really must<\/span><\/li>\n
- Probably bring a burner phone too, really<\/span><\/li>\n
- Bring enough cash to exist on, if you can, and maybe don\u2019t muck around with credit or debit cards (though opt for credit if you must, because they have fraud protection)<\/span><\/li>\n
- It\u2019s more about people than the sessions<\/span><\/li>\n
- Go to parties and side events and games and whatever else crosses your radar. Here’s a good place<\/a> to start getting a sense of what’s possible for the 2017 one.<\/span><\/li>\n<\/ul>\n
All good and well, sure. What I didn\u2019t find was advice to match the portents from friends based specifically on my situation as a woman heading to DEF CON. So, in the way of the semi-reformed content marketer that I am, I decided to put together my own resource. So, here you go: how I, a woman, an engineer, and a hard introvert with a low tolerance for dickheads, recommend approaching DEF CON.<\/span><\/p>\n
Packing for DEF CON<\/span><\/h2>\n
The Las Vegas setting of DEF CON means that you\u2019ll be walking between ovens and refrigerators most of the time. This is a great recipe for feeling a little uncomfortable and a little gross during most of your waking hours, but you can plan around this.<\/span><\/p>\n
For general packing, here\u2019s what I recommend.<\/span><\/p>\n
\n
- Bring <\/span>twice as many pairs of underwear <\/b>as the number of days that you\u2019re staying. Even when it isn\u2019t warm in those big event spaces, it\u2019s still <\/span>close<\/span><\/i>; you will appreciate the option to swap out layers without taking anxious inventory as you near the end of your trip.<\/span><\/li>\n
- Wear <\/span>clothes that breathe<\/b>. Beyond that, of course, wear what you want. Some women find it useful to go stealth in a hoodie and jeans; I found it oddly fun to be as dressy there as I sometimes am in normal life – but I also appreciated having options depending on the feeling of the day. Decide what will be more likely to make you feel comfortable in the context of a very busy, very distinctive conference, and you\u2019ll be fine.<\/span><\/li>\n
- Excedrin<\/b>. I\u2019m headache-prone, so that\u2019s a given for me.<\/span><\/li>\n
- Sleeping pills<\/b>, if you roll that way. I like an OTC sleeping pill when I\u2019m not sleeping at home. This last year, I, a person who lives alone for sanity-keeping purposes, shared a hotel room with three other people. It was worth cutting off any booze around ten so I could safely tranq myself to sleep and be both smart and sociable the next day.<\/span><\/li>\n
- And for your day-to-day pack, I suggest <\/span>a not-small water bottle <\/b>(at least 750ml), more <\/span>snacks<\/b> than you think you\u2019ll really need, a <\/span>hand fan<\/b>, and a <\/span>notebook and pens<\/b>. You will learn about all sorts of weird shit, plus Twitter handles to follow, sites to look up, rad repos, and talks of yore. Have an analog way to record them for later.<\/span><\/li>\n<\/ul>\n
Planning And Attending<\/span><\/h2>\n
Secure your tech.<\/b><\/p>\n
See the earlier suggestion about burner laptops and\/or phones and\/or faraday containment devices. I learned while I was there that Bally\u2019s told their entire staff to keep their phones off while working that weekend. I originally went on airplane mode for the first couple of days until coordinating with my friends got very annoying; then I used cell data only. Things went fine, but I plan to get a burner in place for this year. Figure that you\u2019re going to be going fairly analog in the middle of a tech-centered conference, plan accordingly, and you\u2019ll be fine.<\/span><\/p>\n
An exception is if you want to participate in a CTF event or a tutorial – you\u2019ll want a proper laptop for that kind of thing. Consider a Chromebook with Kali with no stored login information, with a plan to wipe it when you get home. And if you\u2019re not sure of what a CTF is or are feeling a little daunted,\u00a0<\/span>this writeup<\/span><\/a> of a rad engineer\u2019s first one is pretty exciting. <\/span><\/p>\n
If you do decide to bring a laptop, you can take your chances with official conference internet. Bear in mind that you need to set it up beforehand; <\/span>go here<\/span><\/a> for more details. <\/span><\/p>\n
Walk fast, or make plans based on geography rather than strictly interest.<\/b><\/p>\n
I don\u2019t know how the rest of you manage to get to the talks you want, if they\u2019re far away from each other. I sped across the Bally\u2019s gaming floor over and over, from front to back, from side to side, from Vegas to Paris and back, going from a far-off upstairs meeting room to an upper-floor set of executive suites to a trio of enormous function rooms off of hallways made to look like a more restrained Versailles. I was a little more session-motivated than most people seemed to be (including the friends I traveled with), but the time between sessions made that difficult. If I didn\u2019t walk fast and didn\u2019t <\/span>enjoy<\/span><\/i> walking fast, I would\u2019ve seen far fewer things.<\/span><\/p>\n
Figure out where the water fountains are.<\/b><\/p>\n
And keep that big-ass water bottle full. Plan on refilling it every couple of sessions. I\u2019m not sure what it is about being around so many other people in close proximity that brings biological needs so much to the forefront, but it does. Routine dips in hydration or blood sugar become so much more pressing, even while surrounded by water fountains and stores only too eager to sell you supplies. Plan ahead, and your brain will work better for you.<\/span><\/p>\n
If a party sounds cool, just sign up.<\/b><\/p>\n
Lots of companies and villages and groups have parties, minicons, and other events. If you happen upon one that sounds good, and they request an RSVP, just do it (unless it\u2019s a tutorial with a small capacity – then be cool, please). Everyone is dashing between five things most of the time while they\u2019re there; might as well ensure your name is on the list.<\/span><\/p>\n
Research sessions ahead of time; do multiple-choice selections in the moment.<\/b><\/p>\n
(If you care a lot about sessions, of course.) To ensure you see more of what you want to see (because you will not see it all), I\u2019d suggest culling possibilities ahead of time. I liked the app for this, as it shows you everything across the villages and the main con itself, and it lets you add competing sessions to your schedule for easy picking. There\u2019s also the physical book you get when you check in – and the conference website, of course. Note everything that sounds interesting. Particularly if you\u2019re new, you\u2019ll probably learn something regardless of what you select.<\/span><\/p>\n
However, let the final selection come in the moment, when you\u2019re on one side of the conference space and you have to choose between staying put and sprinting across a casino floor; when it\u2019s 20 floors up, and the lone functioning elevator is not behaving; when the line for a session is full 30 minutes before the doors open. Give yourself a few options for each timeslot and then let the conditions of the moment dictate what you actually try to do.<\/span><\/p>\n
My favorite sessions fell into a few categories:<\/span><\/p>\n
\n
- Social engineering<\/span><\/li>\n
- How to break shit (the Bluetooth lock session<\/a> was a highlight)<\/span><\/li>\n
- Fun with Python<\/span><\/li>\n
- Feds answer questions<\/span><\/li>\n
- Where current events and infosec meet (like the one where a nice Danish man talked about the Ashley Madison hack and online information hygiene)<\/span><\/li>\n
- Mostly we\u2019re fucked (that is, the intersection of \u201chow to break shit\u201d and IoT things)<\/span><\/li>\n<\/ul>\n
I\u2019ll likely stick to those same themes this year, but I\u2019ll try to go outside of them too.<\/span><\/p>\n
Be open to new things.<\/b><\/p>\n
Skills, smells, weird social skills and experiences. There aren\u2019t a lot of spaces like this on earth, so roll with it when it makes sense. You can be in predictable company later.<\/span><\/p>\n
This was a big part of what friends in the know warned me about. It seems like everyone who\u2019s gone enough times has a story of someone acting like a most memorable piece of shit. I had a couple brushes with annoying sexist nonsense, but clearly not enough to dissuade me to come again this year. (My current prediction is that I\u2019ll get to come three times before something really obnoxious happens, enough to make me say the hell with it and stick to B-Sides, but I look forward to being proven wrong.) However, fucked-up things, of course, aren\u2019t necessarily tied to gender. A male colleague of mine stopped going around DEF CON 12 when he saw someone dancing drunkenly with a live firearm at a party. We all have our limits.<\/span><\/p>\n
Don\u2019t go to pool parties.<\/b><\/p>\n
(This is clearly highly subjective, and the friends I went with may likely disagree, but.) Not all dudes (#NotAllDudes) werewolf out at these very guy-centered events with bars, but enough do that I don\u2019t find it worth it when I could be doing anything else. If you also have a certain ungenerous tolerance for risk, go literally anywhere else, because if <\/span>that<\/span><\/i> place sucks, you can leave much more easily than if you\u2019re in a wet swimsuit. My tolerance for uncertain behavior in social situations out of my control has a pretty hard limit. This is outside of it. You can, of course, decide based on your own \u201chell no\u201d scale.<\/span><\/p>\n
If you can go stealth, eavesdrop on non-conference folks.<\/b><\/p>\n
There are people – unfortunate people, innocent people, sweet summer children – who planned their Vegas escape not knowing what they\u2019d be encountering. They thought they were there to see Cirque and eat crab legs, and they ended up navigating hordes of goons for 14 hours a day. They are hilarious and wonderful. I recommend lingering by customer service or at the buffet to overhear what you can. I felt considerably more badass after overhearing a few minutes of speculation of just what the hell was going on with all the people with skull badges between a clerk and a customer at the Paris casino loyalty club desk.<\/span><\/p>\n
Seriously, stretch.<\/b><\/p>\n
Even (especially) if you find yourself in the same room for several sessions in a row. Get up and stretch, especially your quads. You\u2019ll have several days of this. Take care of yourself.<\/span><\/p>\n
Shopping<\/span><\/h2>\n
It\u2019s worth it to stop by the vendors. The stuff for sale last year typically fell into one of three categories: learning, mayhem, and novelty t-shirts. The first two are pretty alluring to me, and I saw things for sale that one doesn\u2019t typically see anywhere else. It\u2019s worth budgeting for, ideally in cash.<\/span><\/p>\n
My souvenirs from last year included a pen testing book from No Starch, a couple handcuff shims (you never know), two clear padlocks, and a set of lockpicks for the friend who watched my cats while I was gone. I was pretty satisfied with this, and this year I\u2019ll probably budget for an Ubertooth or something else similarly fun and shiny.<\/span><\/p>\n
It\u2019s normal, with conferences, to be tempted to wait until the last day to go buy things to try to catch discounts, but at DEF CON, stuff will sell out. If there\u2019s something you really want (and really <\/span>don\u2019t<\/span><\/i> want to buy online with a credit card), just get it the first day. Nothing is overpriced if you\u2019re satisfied with what you bought and happy with the experience. <\/span><\/p>\n
One exception is if you wear a smaller t-shirt size. Sizes L and bigger sell out pretty fast, so if you wear one of those: buy sooner. If you\u2019re more of a small or medium: late Saturday or anytime Sunday is a fine time to get your smaller DEF CON shirt with a little break in price. <\/span><\/p>\n
What I\u2019ll Do Differently This Year<\/span><\/h2>\n
I was pretty satisfied with how last year went, particularly considering the warnings I got. That said, there are a few things I\u2019ll keep in mind when planning my 2017 trip.<\/span><\/p>\n
Get there on Wednesday night.<\/b><\/p>\n
Last year, my friends and I used the typical metric of nonprofessional, more culture-centered conferences and planned to arrive on day two. This meant we had access to zero workshops, missed a bunch of DEF CON 101 stuff, and spent more than a day with the flimsy temp badges they give out once the rad ones are gone. It was not an unreasonable approach, but it was wrong and a bit of a bummer. This time, we\u2019re getting in on Wednesday night.<\/span><\/p>\n
Figure out parties and villages to visit ahead of time.<\/b><\/p>\n
Last year, though I was told about this, I didn\u2019t quite get how much of DEF CON is in the side events. Deep down, I am basically Hermione, so the idea of paying for a conference and not going to as much of its official programming as I reasonably could just did not compute. This time, I\u2019m going to ask my friends to help me be more fun than comes naturally to me sometimes.<\/span><\/p>\n
Tell people who say stupid things to fuck off.<\/b><\/p>\n
I\u2019m really only thinking of a single situation here, but I was still in \u201cI\u2019m new, I\u2019m a guest in this place and trying to learn it\u201d mode, so I didn\u2019t say anything, and clearly it still bothers me. So: I\u2019ll say something next time. If someone else feels safe to be a little obnoxious, I\u2019ll remind myself that I have the privilege to risk the same. There were 22,000 people there last year. I can tell someone acting like an ass to get the hell away from me, and I\u2019ll go try my luck with the other 21,999.<\/span><\/p>\n
What I\u2019ll Repeat<\/span><\/h2>\n
Roll with a group of women.<\/b><\/p>\n
Our lady quad occasionally picked up other lone women like an awesome Katamari, and it was a great way to meet interesting people. It was easier to take chances and drift away for a few hours because I knew I could rejoin my group of understanding friendlies whenever I needed to. (If you\u2019re a woman going solo to DEF CON, feel free to say hello. We would love to meet you.)<\/span><\/p>\n
Revel in the very short women\u2019s bathroom lines<\/b>, because <\/span>when do I ever get to experience that otherwise<\/span><\/i>. (Infosec and infosec-adjacent conferences, that\u2019s when. I don’t like what it’s a symptom of, but I’ll take a very small bit of ease in the meantime.)<\/span><\/p>\n
Stay nearby, but not in the conference hotel itself.<\/b><\/p>\n
I liked being able to use wifi when I tucked in for the night (though there are <\/span>reasonable arguments<\/span><\/a> that even this is not a great move), and there was something calming about leaving the middle of the action and being able to turn off my situational wariness.<\/span><\/p>\n
In Conclusion<\/span><\/h2>\n
I\u2019m an engineer with a love of people breaking shit, making shit do what it was not originally intended to do, and smartasses in general. I liked DEF CON. I\u2019m looking forward to it again – enough to deal with Las Vegas in bloody July. However, it\u2019s very much its own weird animal. It\u2019s a self-selected group that\u2019s different than any I\u2019ve ever circulated amongst before. But, like most groups of humans, most people are benign, some are interesting, some are \u201cinteresting,\u201d some are lovely, and some are viruses with shoes. I\u2019d say, in going to DEF CON, your chances of having something unpleasantly memorable happen are higher than among the average population, but not so high that it\u2019s worth skipping if you also like the things I listed above.<\/span><\/p>\n
There are situations, though, that don\u2019t fit neatly into the suggestions and categories I set out above, so I\u2019ll leave you with some miscellaneous observations from my notebook to place you in the setting in a more immediate way.<\/span><\/p>\n
\n
- 98.6 degrees in here, and a pervasive recurring smell of farts and accumulated humanity.<\/span><\/li>\n
- Opinionated, reality-divorced emitters of skin clouds and biome signature<\/span><\/li>\n
- Apparently a room full of dudes will not understand why you shouldn’t text your dick to someone<\/span><\/li>\n
- The current version of the US military interrogation manual is online and freely available<\/span><\/li>\n
- 3 pm: am <\/span>mostly<\/span><\/i> sure I am not the source of the back row funk cloud here. 3:30: rest of row left. Less sure, although funk cloud also left, so\u2026<\/span><\/li>\n
- Being a woman with a wordsmith background and a tendency to observe behavior may make me an ideal mole-type. Stereotypes help us defend ourselves (or have), but we can still exploit that shit.<\/span><\/li>\n
- Social engineering as a woman, at a talk by women, for surprised men<\/span><\/li>\n<\/ul>\n
However, I hope, if you\u2019re tempted, you\u2019ll just go for it. Come say hi if you do. And, while you\u2019re there, try to sleep enough, don\u2019t get too fucked up and hungover, and keep your water bottle full. And, with luck, I won\u2019t be back here in August or in another year or two, writing about how all the warnings were right. With luck, you’ll have a good time too, if you decide to go for it.<\/span><\/p>\n
A Little More Information, if You Want It<\/h2>\n
If you\u2019re still figuring out how to do this, here are some more resources for you.<\/span><\/p>\n
<PennsylforniaGeek\/>: The Road to DEFCON<\/a><\/p>\n
This is the detailed post I was looking for last year. You get to have it, at least.<\/p>\n
Reddit: a good breakdown of likely costs for the whole event<\/span><\/a><\/p>\n
There are ways around some of these things, of course. I used Southwest points for my flight this year and am splitting a nearby Airbnb with friends, so we have more room for less money. Last year, I tried to have one good, robust meal out per day so that I wouldn\u2019t feel too messed up from Clif bars and breakfast buffets. Figure out what you need to feel like a functioning human; budget for that. Find a roommate online if you’re broke and brave. There’s a good chance you can make this work, if you’re willing to hustle a little.\u00a0<\/span><\/p>\n
An outsider\u2019s view of what all the fuss is about<\/span><\/a><\/p>\n
It gets fucked up sometimes.<\/span><\/a> One of my remarkable bits of good luck is that malignant dudes mostly let me live my life. Other women are not so lucky. This post gives you an idea of what another side of the experience, quite different than mine, can be like. Take care of yourself, please. We need you.<\/span><\/p>\n
Linked above, but worth repeating: <\/span>an overview of how wifi works and what a Pineapple is<\/span><\/a>, with a list of event-specific precautions on slide 17. <\/span><\/p>\n
<\/p>\n