 We're Hack 5, I'm Darren Kitchin here with Shannon Morse and a very special guest, it is none other than Dark Tangent himself. Hey Jeff, how are you? Hey, I'm excited to be here. I've watched your show for eons and we've never actually met. I can't believe it's been 30 Defqons and that hasn't happened. No, no, but I feel like I know you through your YouTube, but I definitely know Shannon. Yeah, we actually did a panel the other day, it was the Defqon 101 panel. Thank you so much for the kind introduction and it was great to finally meet you in person. Yeah, it feels like I think with COVID, I didn't realize when I got to Defqon, like a weight lifted off my shoulders. Yeah. Then I didn't realize she was there and soon as I got around like my people. Yes. It was like, wow, I didn't realize that that personal contact is just we are such social creatures. I had the same feeling. I'm definitely an extrovert. I know I'm the weirdo being here. I'm the extroverted one. But it was so interesting coming back to Defqon 30 after being away for such a long time. I actually saw some of my friends in person and I started bawling my eyes out and I didn't realize how much. You didn't know that you had that? I didn't realize I missed them so much until I came back and I feel like that's one of the important roles that Defqon plays in our lives. As hackers and as information security experts, we're kind of a more than a community in a sense. Yeah. Many of which came to my wedding, like we're a family. It's a weirdo family. It is a weirdo family. I think maybe that's a difference though between sort of the hacking culture and the infosex culture a little bit, where infosex sometimes can become kind of transactional career advancement. And with Defqon or with hacking conferences, it's a little less about career advancement and more about learning the thing, do the thing. I agree. Yeah. I think that's maybe a different mentality. Getting into the scene early on, that was one of the biggest draws for me and I would love to hear your personal story on this. But the thing that I found as a kid on IRC in the 90s was that finally there was a place where it felt like I belonged. And there's been this sense of community that even, you know, now 20, 30 years into it, you really still have that kind of family feel of like, this is where your brothers and sisters are. And I'm curious to hear from you because, I mean, obviously doing so much to shepherd the community, how that was like before there was a Defqon for you. Yeah. Well, so in the lore of Defqon, there are all the hacking conferences before me. There's about three or four. There's like Summercon and Bohocon and Pumpcon was just starting basically the same year and they're all invite only. And I was young and new and I didn't have the invites. So when I did Defqon, I wanted to make it open, not closed. But that's the fork in the road. If you become open, you can't really turn people away. All people who are interested can attend. There's no gatekeeping there. So you don't know who's going to show up, right? So you've just got to try to set the tone and hope you're... And people in those early days, there's so full of promise of what the internet could be, the utopian world it could build, that everybody wanted to figure it out and they all showed up. You know, 100 people one year, 200, 300, 600, you know, and they took off. And I think early days finding a home like just resonated because before then we were these weirdo internet people. But then since we planted our flag early, there was a structure as new people came along to kind of find their tribe. And if you look at Defqon, you can be a hardware person. You can be a social engineer. There's a million little communities in a community. Yeah, absolutely. So speaking of gatekeeping and accessibility, something that I noticed very early in the scene was that there was still that mindset of kind of like the bravado, the I'm-leet and I'm not going to share with you. RTFM. And I've got to be honest. As a kid, I really wanted to go to some of the very early Defqons and try to convince my mom. You know, with the other phone freaks I hung out with in pound 2600 and stuff. And obviously couldn't go as like a 13 year old. Right. But now you do see 13 year olds on the floor. Yes. And you walk the conference and you see how accessible it is and how there are so many games and contests and villages that are like, hey, try this lock pick out or try, you know, all these different things out. Has that been part of the fabric and was that part of the foundation of starting Defqon, going to your statement about how they were all previously invite only? Right. I think a couple of things happened. It became more accessible, less secretive when we started doing it publicly. And then later on when the search Alcavista and then Google and then Amazon, all of a sudden you could search on security. And so the amount of time you would spend as a hacker trying to figure out the secret was reduced because you could find it faster and you had more time to actually do the thing. When I was young, we were young. Like half my time was trying to figure out who knew the answer and convince them to tell me the answer. When that shrinks to like 10%, it gives you that much more time to come a little jealous of the current generations where they can do the thing. Absolutely. And they've got frameworks, you know, and mentors. Mentors are so important in this industry and being able to get into, you know, hacker education, hacker research, one of the things I've noticed through the weekend, interviewing with tons of different villages, which by the way, thank you for that opportunity, is how welcoming each of the villages is. Every single one that I talked to mentioned that even if you come in there and you've never done blue teaming, you've never done love picking, whatever it might be, you can go in there and find somebody that you can talk to. Yeah, they're so excited to find other people like them. Yeah. So I think the other difference is we really started about 10 years ago or 9 years ago, we really started to double down on is DefCon hacker. Because in the early days, everything was a hacking conference. But then InfoSec grew, careers, we got jobs, all these fantastic opportunities. We could do this as a job, not a hobby. But naturally then, all the cons started to look like InfoSec cons. Yes. Because who's the sponsor, the product manufacturer, right? And so it just naturally had that gravity. But because we existed before there were sponsors or whatever, we had to figure out how to make a con that worked with none of that. And then later on, as the industry grew up, we didn't need to take the sponsor money because we'd already figured it out. So we fortunately had charted this path where we could stay more hacker where less people could influence us. Right. Well, now here we are 30 years later and it's like, what's the difference between hacker and InfoSec? We think about it every year, but I really think it's sort of joy of discovery, like spontaneous sort of exploration. It's things that are not, like you don't necessarily get an InfoSec. It's not become better to some, it's a response tool. It's more like, oh my God, that's how satellites work? Yeah. Right, the company's not going to pay you to go learn how the satellite works. But you've got this innate curiosity that we're trying to feed. And so a friend of mine years ago said, well, I send my team to Black Hat to learn how to be better at their tool use, but I really send them to DEF CON to learn how to think. Yeah. And I think that summarized like mindset versus... Yeah. Hacking is a way of thinking for sure. What I'm really curious about is how, as our scene has matured into an industry, as hacking has become, you know, evolved into InfoSec, how do we preserve the origins of InfoSec? I know that archive.org does good work. I know that text files. In fact, I even have text files from the BBS scene that I wrote, preserved sadly, poorly. What can we do as a community to ensure that as it continues to evolve, that the essence of the seeds that planted originally to start this stick around? You know, it's a really good question because we're terrible at preserving our own history. And I noticed this on the hacking conference world, so I started a project called infocon.org, and went and found every hacking conference I could find and preserve the videos, and I keep updating it. I know there's been a few books blowing up the phone, trying to, or exploding the phone, I think it is. Yeah, it's a good freak one. Yeah, I'm freaking, but there's not that many good books on the history. And I've heard that there's two or three that people are trying to write before they get too old and forget all the stories. So I really hope some of the old timers write that. I would love to contribute to anything anybody's writing out there if you want to talk to somebody about our early days. But if we don't do that right, it'll be lost. Yeah. It's just so fun watching Hacker Jeopardy when they ask, like, this happened 30 years ago, and people, they either get it or they're completely lost. And then you've got all of us going, oh, my God, that was 30 years ago, and you're like, what happened? Terminator 2, 30 years ago. Going into DEF CON 30, it's, for me, even coming back here after three years, it's a bit overwhelming. Do you feel like DEF CON in general has changed a whole lot, even given the past three years? Oh, definitely. Yeah, and I think it was, you know how in your own personal development, there's different stages, and you look back and you go, oh, that's when my perspective changed. Around DEF CON 3, people weren't coming up and telling me things that happened at the con that I didn't know about. And I was like, oh, my God, it's bigger than I am. Describe that feeling to me, because I might know a little, I'm starting to know a little bit about that. It's gotten bigger than me. What does that feel like to you? So then you're like, oh, my gosh, that sucks. I'm not going to, like I put in all this energy and I don't get to learn. And then you're like, but it's kind of like, it's bigger than me now. Yeah. It's larger than me. And people are, I mean, all these experiences, and I don't have to be there to partake with them. When you noticed that, did you feel like you were giving up your baby? It was. Yeah. And it took me a couple years to really, because at first I was like, tell me everything that I missed. And then after a while, you're like, you know, I'm okay. There's too much going on. Yeah. And then when you hear those stories secondhand, you're like, that's awesome. You know, that people really did that in the shower. You know, okay then. Wait, what? I haven't heard that story. And hopefully nothing involving Quickset cement. No, no. We did have some cement in the toilet one year. Yeah. In fact, I really appreciate coming down the escalators this year. You see the big old placard for the Alexis Park. Yeah. Oh, yes. We had to go. So good. We originally were going to do a giant rug and we figured somebody would roll it up and walk off with it. They probably would, yeah. So we did a decal on the floor. I've seen people steal sofas from some of the sweet parties. Yeah, that happens. I really wanted to do this year closing ceremony like a confetti cannon. But then you have to pay to clean it up. Oh, yeah. So I was trying to figure out how to make each piece of confetti collectible so the people would take it with them. Wait, so can we spoil it? Is that actually happening? No, but I wish we could. Maybe next year. So if I ever do a confetti cannon, I'm going to make each piece collectible so the attendees will clean it up. Yeah, it really has gotten so much larger. I haven't come to at least the last 10 years. And what are the kind of thought processes that go in your mind when you're thinking about as the attendance rises and keeping the cohesive nature of it? Because I know we've gone from small little hotels to slightly larger hotels to multiple hotels. And now we have a whole convention center. That's crazy. So I think what's going on is DEF CON is always a reflection of the community. Because we can't force the community, right? We can just sort of steer the super tanker or kind of try to direct the orchestra. But really, they're doing what they want to do. So we try to set the tone. We try to set the example. We did this with our Code of Conduct. Yes. We did this with our transparency. Thank you for that. First conference to do a transparency report. And so the thinking there is we first create our Code of Conduct to create standards. And then we report, are we following them? To try to force us to follow our rules and then hopefully other people like that they imitate us and then hopefully other people are helped. So every once in a while we do things to try to elevate the community or provide some direction. I don't say it's, what do they call it, something signaling, a virtue signaling. No, I don't either. Absolutely not. In fact, I'm glad you mentioned Code of Conduct policies because I feel like a lot of other hacker conventions look to DEF CON to figure out what they should do in the future. And when you created that policy many others created their own COCs. It was okay for them to follow. It was okay, yeah. It was more comfortable for them. It became our standard opportunity to ask for that when we would sponsor conferences. It was like making a new protocol. Yeah, no, when we wrote that we had an eye for other people hopefully copying. But so when you're being kind of told whichever way the community is going people will lament, oh it's not like it used to be. It's changed. It's like, yes, look around you. Look at the diversity. Look at how the workplace has changed. It's not just network engineers anymore. Technology is in every industry. So therefore people from every fucking industry is going to be here. Sorry, but it's almost like you're a victim of your success. You wanted people to understand what you're doing and now they all do. And so now they're all here. Yeah. Straight up, I used to work in restaurants. I graduated in hospitality administration. So I could run a convention, but I didn't know a thing about hacking before I came to DEF CON and started working with Hack 5. Unlike the dark tangent who obviously, you know, aspired to create the nation's largest hacker company. Yes, of course. From day one. That was hilarious. Like, do you want it, other than the birthday story, do you want to like give us kind of the little nugget of how this came to be for you? Well, so originally, like you, I was a phone freak and then later a little bit of a hacker, but no, red boxes. Not a great hacker. I was an okay hacker. And then... You didn't get caught, like Darren did? No. I never got caught. But I ran this Bolton board and I was the U.S. hub for like 12 different hacking networks on Fido Network. It wasn't on Fido, but Fido Compatible Network. And when one of those networks was going away, PlatinumNet, we were going to throw a boy in a wave party. But all the... Here's a Canadian network, but all the users are mostly in America. So he's like, let's throw a party, but we got to do it in America because that's where everybody is. And I said, okay, great. Well, where could we do it? Maybe boss Vegas. And then all of a sudden, his dad took a new job, he disappeared, and I've never heard from him since. But I had already had like one foot in, I'm throwing up. So I was like, well, if we're doing this, I'm going to invite everybody, not just that network. Yeah. I'm going to invite everybody on IRC, pound hack, pound freak. That's what I was, pound freak. Yeah. Downnet, Fnet? Fnet. Yeah. All right, downnet. On Usenet, I was sending faxes to everybody. I mean, I was like spamming everybody that I could for free. And it just turned into this party, right? And you quickly realize, like I didn't really sign up to become a conference organizer, but you have to learn how to do it. And so I went looking for books on, well, how do you do this? There are no books on this. So you have to learn as you, you know, as you play the game. And so it's like, kind of a little bit like hacking, like the way you order things, optimizes the cost, the way you do ship things, it's the same kind of puzzle mentality. Yeah. It's very logical. When we first started getting into e-commerce, I look at like all of the regulations and all of the hoops that we have to jump through for EAR and everything else. And I'm like, ooh, a complex system. What can I do? I get to understand this and find the optimal way to approach this problem. Yeah. And that's like hacking isn't just like Unix systems. Right. It's a mindset. And I love hacking logistics. And when you see, when you're paying with a credit card and they're like, oh, you got a sign and I'm like, oh yeah, they're going for the extra 0.1% discount for the extra in-person profit. You know, like you can see the process. It's true, it's true. And when they don't, you're like, wow, they must be making so much money. They're not trying to max out their, you know, piece of whatever, gonna change for you. Yeah. It's really fascinating. That hacker mentality is kind of what we try to teach. And as the community has grown and there's been more people, you can't just get into a room and meet everyone. So it's been a big challenge over the years is, how do you help people find their tribe? Yeah. And when the villages, the original villages were Wi-Fi village and hardware hacking, and now we have 30, yeah. I mean, the conference is, the villages make the conference. You've got the tracks, but because you put the, the talks online, you can actually go and enjoy that not having the fear of missing out on the talks. It's wonderful. And it's kind of like going to Burning Man and realizing like, no, this is actually like a bunch of nerds descending on somewhere. Yeah. And they're making this. How does that feel when it's like delegated like that? Yeah. So what we do is, instead of, you know, villages and contests and events, and now we're just thinking among the creators. Yeah. These are the people creating the content that people want to see. It might be a two-day contest. It might be a one-day village. It might be something, but they're the creative energy that some, and we have about a thousand of them it takes to put on a death march. And about a thousand creators to make this, and about 500 goons to help act as the oil. And so it's about 1,500 people to make this kind of experience. And, Oh, go ahead. And so we spend a lot of time trying to figure out how do you take 20 something, 30,000 people. And then you're like, okay, hardware. Hacking Village. Voting machine. And next thing you know, you're sitting down with 10 people with the same interests. And you're like, oh, that was really cool. I met some, oh, okay, locks. High security locks. You know, now you're at a table with those people. And we just spend a lot of time giving off ramps. So even though there's a huge mass, how can you find your people? Yeah. And we think about that a lot. It might not be visible to anybody, but that's our secret social engineering strategy. Yeah. So Jeff, as the guy behind the convention, what is one tip that you will give to somebody who's coming from a completely different background and wants to go to DEF CON just to see what it's like? Yeah. The number one thing is you go up to somebody and say, I don't understand what this is. Can you explain it to me? And people are so excited that you care about the thing that they care about. And they just want to share their passion with you. And as long as you're thankful and you're like, you know, open in and don't fuck the talk to you all day. Yeah. It's true. Now that we're on DEF CON 30, I feel like it's so exciting. It's so good to be back. And congratulations on 30 years going. 30 years going strong too. Yeah. Where do you want to see DEF CON going from here? I feel like there's just onwards and upwards. Also, by the way, Caesar's Forum should have asked you before building this place about Adigan as second floor so that we have twice as many ballrooms. No. We signed the when we were about to sign signed the agreement movie from Paris Bellies. Yeah. They showed us the plans that originally had two floors. Really? That originally designed up two floors. I freaking knew it. These should have done it. It was. And then, remember, they've been bought so many times that they're in the process of being bought by another group. Yeah. Yeah. And they tried to shave all their costs and they decided oh, one floor. Well now, no, I don't want to go there. Please don't do that. No, no, but there are other. CES is there. It's terrible. No. So the thing about that is there are places that are bigger, but we need air walls. Yes. We need to divide and those giant technical centers have no air walls. Yeah. So you can literally go broke trying to put those spacer walls in so we are stuck in only a certain time. So true. So does that mean that as Defconn grows, it hits a capacity or what do you think? What do you think? Right now, thinking at some point they have to be fragmented. Not, like to say it's not already with all your DC insert area code here or NPA here. Yeah. So we have the Flamingo, we have the length and harrows and so we try to localize things like all the workshops are one location. So I could see if we really had to keep growing, we had to add another property. Yeah. You know, I would hate to have people walk across the street to Cesar's, but if you did go to Cesar's Palace, that's another giant place. I think Vegas can provide. I just don't want people to walk any more than they have to. And I really love this street of food behind here. Yeah, I do too. You can go out here and have an In-N-Out Burger and it feels like home. It's great. What's your step count for the weekend? Yeah. Well, funny you mentioned that I turn off all the wifi and Bluetooth on my phone. Wait, why would you do that, Jeff? Don't turn off the wifi. I think it's something like some Bluetooth ducky and wifi, ducky, rabbit, what about the zoo? We have a petting zoo. Yeah. When can we bring all the animals for the petting zoo, Jeff? So instead, I won't know, I'll turn on my phone and everything. I'll sink it and I'll be like, oh, that's what I do. Well, if it's anything like me, it's probably about 10 miles. Yeah, per day. Yeah, it's pretty crazy. So when do you start planning for DEF CON 30 wonderful? About a month. Yeah. About a month, I believe. And then around the first of the year we start announcing all our calls and then it really like for us in the back end about a month from now for the rest of the community, probably six months from now. So I really got to know where do you go in September to recharge? Well, after this I'm going to Singapore. Ooh. Yeah. So that'll be nice. I hope it's on vacation and not work. No, no. I've been living there. I got trapped there for COVID. Oh. And so now the family's there. Oh, nice. Cool. Yeah, you're going home. Yeah. Which is weird though, which is it's on every day. The sun sets and rises about the same time every day. Like nothing changes. And it's also like a cyberpunk novella at night. It's crazy. Yeah. All the light and everything. And so then I come back here and I'm like, I'm at North Lexa, Seattle, where I'm from and it's like, I can wear a jacket. Oh, I have got clothing options. And so that sameness there and then you come back and you're like, you have all this variety. It's just one other thing I want to mention about 30 this year I thought I kind of had it under control emotionally. And you know, we had Defcon 29 last year and I was pretty good felt really good to see everybody last year. But I was on the escalator coming down and I saw everybody and I saw how much energy and how much positivity and all of a sudden it felt like this invisible weight was lifted on my shoulders is a weight I didn't know I had. Yeah. And then I got down and I was around people and I was like, oh wow. Like, how did I survive before? You know, there's like the colors have been turned down and I didn't realize it. Now that I've been around everybody, it's like really energizing. I don't know maybe it's just because I've been so far away in another country, but whatever it was, it just awesome. Yeah. Oh. Well, we're just honored that this is, that our community is still here and that it's so strong and it's such a great feeling. I think you're stronger than ever. Yeah. Which is amazing. Every year we did Defcon and we were like, okay, that's it. That's as many people in the world that are willing to get in an airplane and come to Las Vegas. There's more conferences than ever. Yes. There's more hacking things than ever. At some point we max out and even with a thousand B-sides and other events and InfoSec still keeps growing. Yeah. Which just tells you there's this insatiable first demand and I'm sure like. It's not just the demand for the talks and the villages. If you look around it's the people. Yeah. That's what makes it for me. I'm sure you've seen it probably with your YouTube channel like just more and more viewers as people are just. It's crazy. They want to know. Yeah. When I first started on this channel I never would have thought we would have. How long do you know? You're in the million, right? We're almost to a million. We're over 800,000 now. It's weird too because it's the longest running show on YouTube technically. It's crazy. But also still not just shy of a million subscribers. We're niche. That's okay though. We're niche. It's authentic. We're a million. I think DefCon, we got our 100,000 subscriber a little more. I think we're around maybe almost 200,000. Right? I mean you're... All right. Everybody go subscribe to DefCon. Go subscribe. Yes. Also I really got to know what again is that website as it's like so important to preserve our culture. Yeah. Infocon.org. And the community this is so awesome. A guy sees Infocon.org and says, that's amazing. And he creates InfoconDB.org. He takes all my data and he created an inverse database of all the speakers and their bios. So you can do a reverse lookup. That's so smart. You can do a reverse lookup and you can say Dan Kaminsky, Black Hat 27 and it links to the video on Infocon. And now, I mean it's just An IMDB for hackers. Awesome. And it's like So cool. He did that for years and we'd never met each other and we ran into each other and he's like, oh I'm the InfoconDB guy. Awesome. Why are you doing that? It's like, I wanted a project with all the scripting language and he figured he could learn how to do it by doing this new project. That's a great way to do it. Because we can is the best way to hack. Yeah. Right. So there's more content than ever. There's more community than ever. All you got to do is have the courage to come out. Yeah. And where can people find out more if they want to join if they want to go to Defconn in the future? So Defconn.org obviously and we have a pretty good community on Reddit. A lot of supportive people. We got our Discord for the people who can't make it here. We really try to support the community year-round with the Discord. I'm not a big fan of the Discord privacy policy. Yeah. Same. So maybe in the future we'll think about maybe doing a Masterdown or something. Yeah. But we didn't have time for 30 this year. But I'm always curious in the community what they would want to see. Yeah. Well, I miss IRC and Usenet. What was it? Undernet? Or one of them? Yeah. Yeah. All right. Got down that dropped. Undernet's gone. Yeah. I'm blanking on the one you're talking about. Yeah. But they had Someone's yelling at the video right now. They had a weird takeover split. It just seemed like things aren't we're not happy in IRC land for a while. Which is weird because I heard once there was drama on IRC. No. There was a conference that over 30 years has also never had that. No drama. No hotel damage. Nothing. No hiding. Yeah. Nothing at all. Yeah. This year. That never happens here. I'm sure your insurance premiums are wonderful too. There's somebody who every year counterfeits the badges. Yep. And at first we were very upset and then we were like your counterfeits are so good you should give a talk on how you create something. And then I go to a certain temperature and then I peel off the thing and I get this shiny reflection to make it look like a hologram. I'm like how did you figure that out. So there's like a whole another aspect of physical security and tamper evidence that you didn't even know existed until the guy's telling you about melting the record. And it's just so cool that you can spontaneously learn that stuff. Yeah. I can't imagine you know the next 30 years I can't even like what what can you even imagine for DEF CON 60. I mean I know there's going to be some weird network satellite orbital data center cloud hacking. I mean there's just you know under seas probe something or other. We're going to be like hacking our holograms. You know soon as we're on this AR VR it's all going to be about how to make prompts pop up for stuff that's not supposed to pop up. 100% you know it's going to be in AR and have an experience right next to somebody that's not having that experience. Yeah. It's going to be I'm really looking for the AR world. I don't really care for VR. Yeah. Well we'll be here next year with our Google Glass on hopefully making that happen. I'll bring my glass yeah. No I won't I promise. Yeah. Right. Thank you so much. Yes thank you so much for joining us today. I really appreciate for making this convention. Thanks for having me an excuse to meet Jen. Aw. Thanks for making such a place where all hackers belong. We hope to see you guys next year if not online. Yes. We love you. Take care. Trust your technolest. I'll talk my last.