Jack Daniel: Impromptu Talk on B-Sides

Thanks everyone. Appreciate the opportunity to chat. Um I will talk about bides anytime and anywhere. The fact that I get to do it at one of the largest bides in the world is very cool. Um so I'm I'm happy for the opportunity. Um interesting. We'll do a little bides history. Five years ago today, do you know what Bides was? Nothing. Was not even an idea yet. Not even an idea yet. Want a little context on that? This is event number 122 globally. We have not had events in Asia yet, but we have several scheduled for this year. Um, the folks in Sa Paulo, Brazil do two or three a year. This has become one of

the largest ones annually and it is a fantastic event. I'm thrilled I get to be here. Uh, but five years ago right now, people were wondering whether or not Black Hat and Defcon were going to accept their talks. And that was five years ago is when the security community on Twitter was really starting to congeal and a bunch of us stayed in touch with each other between getting drunk. I mean going to conferences uh and that's how we communicated and expanded the community. It was one of I mean Twitter's stupid don't get me wrong. It's it's it's it's horrible. It's stupid but it's also done some fantastic things in our community. Well people started whining about their

talks being rejected. Well, everybody complains about their talks being rejected. A group of us looked at who got turned down for what and why. And what we realized is a lot of the talks that got turned down should have been turned down. But some of them just weren't quite right for Black Hat or weren't quite right for Defcon or had restrictions that kept people from being able to do them because they wanted to be able to speak very candidly. And so a few of us had this idea and I don't know how many there were, you know, a few dozen on Twitter that said like everybody else when you're excluded from something fun, screw you guys, I'm

starting my own club. And what that we did was started our own conference. And it was not really that, you know, screw you guys. It was there's a place for edgier content. There's a place for things that are on the edge of interest where the audience may be much smaller but much more engaged. There's a place to have a conversation and let's try it. The Defcon 303 crew, Chris Nickerson and that crowd from the Denver area rent a house every year in Vegas and they just all rent the house and crash there instead of u paying exorbitant hotels. And they said, "Hey, what? Let's just do it here." and we've put a conference together. Uh we

probably had 200 people through 175 200 people through in two days uh and one evening. Talks included all sorts of folks from uh you know Val Smith and HD Moore to people you haven't heard of to uh women a gender issues women in information security panel you know almost 5 years ago. Uh, for comparison, RSA made a lot of noise about having a gender issues panel at RSA this year, four and a half years after the first one in the US, four years after the first one at Bside San Francisco. But we ran this event. It was great. If you didn't like the talk, you went into the next room, which was the kitchen, and grabbed a beer or went

out on the back patio and hit the swimming pool or grabbed a burger so that when you went into a talk, it was something you were interested in and engaged in. This is kind of cool. And then you had a conversation with somebody talking about HD Moore, talking about Warvox, Val Smith talking about psychotic, paranoid political theories, which turn out to be true. Um, all of these things happen and then what do you do? It's like, okay, the next speaker gets up. It's like, uh, I really want to see this, but they're recording, so let's go get a beer and talk. And you continue the conversation. You meet people. you have a good connection and

keep going. So, at the end of it, the demand was, we've got to do more of these. Now, this is a house that didn't even have air conditioning in the big room. We were getting black garbage bags and duct tape and taping black garbage bags over the window to cut the sun down in Las Vegas in August, right? We freestanding air conditioning units. We almost burned the house down. But it was fantastic because you had conversations as part of a presentation or not. And there were lightning talks. Everybody gathered around the pool table upstairs and played pool and talked about things. You know, there there were conversations about PCI over the pool table. There were there were conversations about

social engineering over the pool table. That's kind of an interesting thought is talking about social engineering over a pool table, which is a sport known for suckering noobs. But that's another story. But it was like, "Hey, we're on to something. This could work. I wonder if this will scale. I don't know what we do from here. I don't I don't know. Let's try one with RSA." Um, in the meantime, somebody did a very small one. It's like, "Hey, I kind of like that idea." And they did one in Mountain View, California, and it it took off and they decided they wanted to go a different direction, and it was a launchpad for another event. That's

happened numerous times in the history of bides too is that folks have come to us they've taken the model which we freely hey if you want to do a bsides we have these ideals these ideals are the people that give us money so that you can eat drink and be here for a very low cost or free depending on the event. The lowcost thing by the way if there's not any charge the no-show rate is unmanageable. It's amazing what having a nominal fee does for both a shoestring budget economically run place, but also the the no-show. And the problem with no-shows is you're buying food. Um, and so that's it's effectively free. You know, you're you're getting your money's

worth. But these events, um, the word sponsor is used at all sorts of big events and corporate events, uh, when the word vendor is more appropriate. But at Bsides, we want people that are part of the community that will engage you in a conversation, which is not simply, you know, scan you. Would you like me to schedule an appointment with an engineer next week? No, we actually people want to have conversations. And so sponsors make it work. People who present make it work. The volunteers and organizers. The magic is that the one in Las Vegas was a handful of us that were going to be there anyway. Now, we weren't local, but we made the event happen. The folks in

California and Mountain View were local. They wanted to make it happen. They made it happen. In San Francisco, a local team of people in San Francisco made it that way. Well, the one in Vegas felt like we were in Vegas. Not just because it was a thousand degrees. One in San Francisco felt like San Francisco because we're in a co-working space in S where the taco truck pulled up for lunch one day. You know, it was it felt like San Francisco. This kind of feels like London. Um, it's pretty sweet and it's very flexible, but we have these ideas sponsors, not vendors. I know that's semantics, but it really means something. We want people to be engaged,

everybody to participate, and that's why I think it's really taken off. So we did one in San Francisco and then there was one in uh Austin, Texas and one in Denver and then the first year came up, first anniversary and we had another one in um in Las Vegas and from there it's simply accelerated as I said I believe this is event number 122. U think by this summer's Las Vegas one we're going to be close to 135 137. It doesn't really matter what the score is though because there have been this is the fourth London. There have been ones in Vienna. There have been ones in Alers, Cape Town, South Africa, Sa Paulo, Gold Coast of Australia,

um all across the US and Canada and they all reflect the local community and they bring people together. A lot of bides events have created local security communities. The one in Detroit has actually created the Michigan security community myc which has changed the way people work. It has changed the connectivity of the the groups and that's the magic. It's the power of it. You come in people ask what people ask me all the time about exor organizing one. I want to organize an event. It's like cool. How do I measure success? Okay, really simple baseline. You do not measure success by headcount. It is cool to have a big event, but you do not measure success by money spent. You

measure success by did you lose money on the event. That's actually not the first one, but as an organizer, uh, did you lose money personally on the event? Um, generally we scare people enough that they do it. But the way you tell if the event was a success is were people happy? You cool leaving? Yeah. Do you see any talks? No. Really? Uh, yeah, but I caught up with this guy I used to work with and it turns out he's doing this thing and I'm doing this thing. Oh, cool. See any talks? Yep. Watch talks all day. It was great because I didn't have to work the booth at whatever vendor con I would normally be trapped

at. I saw talks all day. I talked to people. I remember I used to know how to do security stuff. That sounds kind of personal. That's that's not autobiographical at all. But don't set expectations for you know does it work for you to make you connect with people did you reconnect with people did you we've launched and accelerated a lot of careers because people connect with people we would really like to believe that infosc is a meritocracy and our skill set drives us forward and that's what drives us forward and I would hope that everybody gets driven forward with their skill set however However, sometimes you need to know who to show your skill set to to

move forward. Is that a polite way of saying socially engineering your way up the corporate ladder? But that's that's it. So, these are things that Bides really stands for is making connections, sustaining connections. Another thing that this is one of the events that really does I think they all do extremely well is take people and get them more comfortable speaking. The mentorship program, the rookie tracks are phenomenal because that ability to communicate, even if you don't want to, if you're uncomfortable in audiences, you don't want to be able to just stand up and speak. You're not the idea of standing up in front of six or 800 drunks at Defcon terrifies you. It should. But the ability to have someone

help you polish your content, your delivery, and share an idea with an audience, a manageable sized audience, get constructive feedback somewhere where people will correct you if you're wrong, but in a conversational way. You know, they'll they'll sit down at the party tonight with a beer and say, you know, you should have gone at it this way. It's fantastic because that skill is something that you need to function because it turns out that very few organizations have as their core competency being secure. You know, they're trying to do something else. They're trying to sell something. They're trying to sell a product, a service, whatever. You have to understand that you have to make yourself known to people who communicate

for a living. And that's what, you know, management and executives do. They have to make decisions. But it's communication. Uh, it's also good if you, you know, if you do want to talk in front of six or 800 drunks at Defcon, it's a good launching post because I don't recommend doing that for your first real talk. Uh, but there are, you know, this. So, this is rolled on and on. So, this is where I, uh, you know, fast forward. So, anybody's first bides, anybody here here for the first time? Outstanding. Thank you. Thank you for coming because some events I hate going to RSA and they have like the founders circle buttons that you get at RSA and things like

that. This is a growing community and as you grow a bad analogies, right? Uh bad metaphors. As you grow a building, you have to increase the foundation. So those of you are here for the first time, welcome to the founders circle because you're adding to the foundation of this community. I get all idealistic and don't I? Um sorry about that. I have a reputation as being a miserable little bastard, which I deserve. But when I talk about bides, I sometimes become idealistic. And uh yeah, so that's it. Where does it go? Let's talk a little bit about what it takes to run these events. You know, the folks that do these, this event has been in planning since uh before the

last event here. Planning really accelerates. It's like every other project in the world. uh you can do the first 90% of it in the 14 months before the event and you do the last 90% of it in the month before the event and then the remaining 90% is done the week of the event and then you do 90% the night before. Um if you don't believe that math works, I invite you to join this team in helping run this event next year and you will understand that that math is more accurate than what you were taught in school. It's like there can't be this much left to do. Um, and if you want horror stories sometime,

listen to, if you ever get the chance, listen to uh Bruce and Heidi Potter talk about what Schmukon is. They can't have Bruce had to give up some of his hobby vehicles because the garage, the Volvo 1800 didn't fit in the garage with the truckloads of t-shirts that come into their house. A few of us are that way, but a lot of us have uh filled hotel rooms, if not garages with with stuff. But we do it because you make connections with folks. You make connections with people and they become family. Man, I'm gonna get really idealistic. There are people in the Bides community who are closer than my family. Banshee Genevieve Southwick who is my business

partner besides Vegas. She's family. A lot of that team is a lot of people in this community become very close. And one of the things that that does bringing this back into cynical old bastard mode, one of our challenges in this industry, we were talking about this earlier today. There's stuff that you know that will help other people. And so besides are a fantastic venue for sharing that information. OASP meetings, your local Linux group, whatever. There's stuff that you know that you can't tell people. And I don't care what your network admin wherever. There's stuff you know you can't tell people. Not saying break NDAs, but you meet people at bides and develop these relationships and you can say, "Hey, you

know, uh, you're at that bank and I'm at this bank and you know what? We're getting beat up with have you seen it?" And uh we're not really breaking NDAs, but we make those relationships, those trust relationships, which are a lot more reliable than buying trust from VeraSign and their certificate authority, right? You know, u and then we go from there. These events spawn each other and they're all I want to stress, you know, they really do run locally. You know, there the couple of exceptions. Las Vegas is a big exception. None of us live in Las Vegas. um some of these events back to what's success. People leave happy. Besides Memphis, Tennessee, not a big city,

small city, nice place. It's got a serious poverty. Yeah. Poverty problem. Um very good barbecue. Uh some great music and a lot of poverty. Uh they have a lot of technology there, but nobody ever gets together. So the first time they did an event, it was 24 people. If you take out the speakers, they were like 15 people that were participants. I want to stress that, not attendees, but of that team that provided insight and motivation for an event in Jackson, Mississippi, which provided insight and motivation for an event in New Orleans, which the second year in Memphis went all the way up to 40 people, which provided insight and inspiration for bides in Nashville,

Tennessee, and Huntsville, Alabama. So, was 24 people in a community college and then 40 people in a community college that amazing? Well, the effect has rippled throughout the higher ed community in the southeastern United States because now other colleges are getting involved in hosting these things, other communities, other professionals. What happens here? We pull people into this venue and then you go back out and you get to be really candid and not have to wear a suit and tie like you do across down the road. That's um and so that participation is key. And so I like to borrow one of your heroes for trying to be inspirational. And I'll I'll wrap this up. We'll break

early. Um I like to uh to talk about that that physics dude, you know, the one that changed the the view of the world. Um he's on your money, right? What's the the the quote? standing on the shoulders of giants. Isaac Newton, right? An aside, Isaac Newton changed the way we view the world forever, right? Except and there are people like in CERN in Switzerland with the big donut thing that are shooting atoms back and forth and they're trying to disprove Newtonian physics. And there is nobody on the planet that wants Newton to be right more than they are. And I'll tell you why. I don't want to stand next to thating tube if Newton was

wrong about these bolts holding together. Right? Think about that for we're gonna disprove. Yeah. Well, I'm gonna like back up a little bit. Uh but so a couple of things that Newton said are fantastic for talking about visits. One which he borrowed from someone else is that if I've seen further, it's by standing on the shoulders of giants. Um that's cliche, right? I want you to stop and think about what that means in the context of this community. That means that you have the opportunity here to find those shoulders. By giants, I don't mean giant egos, but people who can give you a foundation. You also have the opportunity to provide shoulders to others. Take that seriously.

Take what you're given, build on it, learn from others, and then pass that forward. Provide shoulders to others. And remember that you are always standing on the shoulders of giants. Everything we do is based on somebody else. Prior history, especially in computer security, you know, you start you start rolling back to uh Gracehopper and Lady Ada and folks like that, it's like, oh yeah yeah people that did computing by patch cable because they didn't have switches, right? This we're all standing on somebody else's shoulders. Bides gives us an opportunity to both stand on shoulders and provide shoulders for others and remember that you're standing on shoulders um you know wear soft sold shoes because you are standing on the

shoulders of others uh use Google and give people credit u and the other one that I think is really interesting at bides where there are a lot of different things happening forgive me I don't remember the full quote but Newton was asked about his accomplishments late in life and he said I don't know what I've seen what I may seem to others, but to myself I seem as a small boy on the beach only pausing to look at a pebble or shell which was shinier or more interesting than the others. That was Newton's take on his own life changed the way we view the world. But the passion of that shell or that pebble which distracted Newton was what

drove him where he is. This is the kind of event and community where you can find that pebble. You can find that shell. No matter how strange or esoteric it may be to the rest of the world, no matter how much your family rolls their eyes when you try to talk about the cool stuff you learn today, this is an opportunity to find that shell, find that pebble and participate and share. And that's all I got. I'm getting all idealistic and crap now. So, I need to say thank you very much. It's an honor to be here. It's fantastic to be at Besides London again this year. It's a fantastic event. It's far from over. So, take a look at what's coming

up this afternoon. There's a break coming up next. And with that, thank you very much.