Closing Remarks

Closing Remarks

Speakers: Bruce Potter (Founder, Shmoo Group), Heidi (ShmooCon Logistics)

Conference: ShmooCon

YouTube: https://www.youtube.com/watch?v=tPbbMPjFKjA

Overview

This article delves into the "Closing Remarks" of ShmooCon, a poignant and reflective session that marked the culmination of 20 years of the esteemed security conference. Delivered by Shmoo Group founder Bruce Potter and ShmooCon Logistics lead Heidi, this talk was not a traditional technical presentation but rather a heartfelt celebration of community, collaboration, and the enduring spirit of the information security landscape. It served as both a retrospective on ShmooCon's profound impact and a forward-looking message about the future of community engagement in the cybersecurity world, emphasizing the importance of individual contribution and collective growth.

The significance of this closing ceremony extends beyond the mere conclusion of an event; it represents a pivotal moment in the history of a conference that has nurtured countless careers, fostered invaluable relationships, and consistently championed the ideals of open knowledge sharing and hacker culture. The speakers articulated the emotional weight of bringing a successful, long-running endeavor to a close, underscoring the organizers' commitment to making space for new ideas and recognizing the finite nature of even the most beloved institutions. This talk, therefore, matters not just for its content, but as a testament to the power of community in a field often characterized by rapid technological change and complex challenges.

Background

▶ Watch: Humorous "Am I hot?" microphone check intro (0:00)

ShmooCon’s journey began two decades prior, evolving from what Heidi described as a "Kinko's black and white copy" generic event into a distinctive and influential gathering for the information security community. The initial years were characterized by a search for identity, with Bruce Potter noting Heidi's early hesitation to label it merely a "hacker con" or "infosec conference," reflecting a desire for a broader, more inclusive identity. Over time, ShmooCon found its "stride," establishing itself as a unique DC-based conference known for its blend of technical talks, interactive events, and a strong sense of camaraderie.

The decision to conclude ShmooCon after its 20th iteration was not made lightly, nor was it a sudden development. Heidi revealed that the decision was cemented around the "Broadway year" theme, several years prior, and communicated to staff during the subsequent "time travel year." This long-term planning allowed for a thoughtful approach to the conference's conclusion, aiming to "teach you how to say goodbye" and do so gracefully. The rationale for ending a successful event was framed around the idea of making space for new ideas, recognizing the personal toll of sustained leadership, and embracing the concept that it is "okay to be done with a thing." This philosophical approach to organizational leadership highlights a maturity often absent in the perpetual growth mindset prevalent in many industries, providing a powerful lesson in recognizing and celebrating success while allowing for new beginnings.

Key Findings

▶ Watch: "Gourd husbandry" joke and Pomp and Circumstance setup (4:00)

The "Closing Remarks" were rich with insights into the foundational principles and lasting impact of ShmooCon, which can be distilled into several key findings:

• Community as the Core: A recurring theme was the profound importance of community. Heidi emphasized, "you are us and we are you," highlighting the symbiotic relationship between the organizers, volunteers, speakers, and attendees. The collective contributions, from participating in contests to simply being present, were celebrated as the true essence of the conference.
• Nurturing New Talent and Contributions: ShmooCon consistently prioritized bringing "new speakers into the arena," providing a platform for many to deliver their first-ever talks. This commitment to fostering emerging talent was acknowledged as a significant privilege for the organizers, demonstrating the conference's role as a launchpad for future industry leaders and contributors.
• The Power of Participation: The call to "be in the room, be a participant, make something happen — big or small" resonated throughout the session. This ethos encouraged active engagement, from tying shoes more effectively to leading complex CTFs, reinforcing the idea that everyone has something valuable to contribute regardless of their perceived expertise.
• Strategic Conclusion of a Successful Endeavor: Bruce Potter articulated the challenging yet powerful concept of knowing "when to end a thing." The decision to conclude ShmooCon while it was still successful, rather than waiting for its decline, was presented as a conscious choice to make space for new initiatives and to alleviate the emotional and spiritual weight of perpetual responsibility.
• Tangible and Intangible Impact: The talk underscored both the measurable successes (e.g., 2152 attendees, over $24,000 raised for charities, 12 new ham radio licenses) and the immeasurable impact on individual lives. Stories of meeting spouses, securing first jobs, finding inspiration, and forging lasting friendships underscored ShmooCon’s role as a transformative force in the infosec community.
• The Value of Hands-On Learning and Contests: The numerous community-run events – from ShmooCon Labs providing enterprise-grade learning to the Radio Frequencies CTF and the Crypto College Badge Contest – demonstrated the conference’s commitment to practical, hands-on education and engagement. These initiatives were highlighted as crucial for skill development and fostering innovation within the community.

Technical Deep Dive

▶ Watch: Unconventional instruments and unpracticed Pomp and Circumstance (5:00)

While the "Closing Remarks" were primarily a non-technical reflection, various segments of the talk provided glimpses into the technical underpinnings and hands-on learning opportunities that defined ShmooCon. These mentions, though brief, highlight the diverse technical engagement fostered by the conference:

• ShmooCon Labs: This initiative was described as providing an "Enterprise grade system here on site" with "free secure access." Key technical details included the widespread adoption of the WPA23 SSID by almost 50% of attendees, an increase from the previous year. The network processed a substantial 2.2 terabytes of WiFi traffic. Specific user data was even highlighted, with "sesh Gremlin running Windows 8" being the "top user" downloading 1.75 gigs of data, and OneDrive identified as the "top network destination." This environment served as a practical learning ground for attendees to interact with enterprise networking architectures and learn from experienced professionals.
• Ancient Point-of-Sale System: Bruce Potter humorously revealed that ShmooCon's point-of-sale system was a Mac Mini G4, celebrating its 20th birthday. This vintage hardware runs Mac OS 10.4 Fox and utilizes a binary-only Firefox Port released on SourceForge after Apple abandoned the PowerPC architecture. While old, it was noted as being air-gapped (or "briefly connected to the internet"), acknowledging the security implications of running such legacy systems. The potential for a future CTF targeting this system was even teased.
• MeshTastic Networking: This peer-to-peer communication system was a significant community activity. MeshTastic facilitates local text communications over relatively low frequency radio waves, enabling long-distance peer-to-peer networking. Participants were encouraged to use 3D printed cases for their radios and to "stand up nodes, stand up repeaters." The influx of "hundreds of people" using MeshTastic at ShmooCon was likened to the "Eternal September" phenomenon for existing DC-area users, highlighting the network's scalability and the community's rapid adoption.
• Radio Frequencies CTF: This long-running Capture the Flag contest challenged participants across a broad spectrum of radio frequencies, ranging from 125 kHz (very low frequency) up through infrared (high frequency). The CTF featured 166 total challenges and saw 22 teams competing, often bringing "more equipment brought in by all of the people to play the contest," underscoring the hands-on and equipment-intensive nature of RF security.
• Crypto College Badge Contest: This annual challenge focused on classic and complex cryptography. It guided participants through eight stages, starting with ancient ciphers like ROT13 (for badge decoding) and combining Atbash and Caesar ciphers (with a rotation of 20 for ShmooCon 20). It progressed to monoalphabetic substitution ciphers requiring frequency analysis and handling of nulls. A transposition cipher stage, similar to a previous Darth Null puzzle, involved using the same key multiple times and cribbing techniques with attendee roles. The challenge then moved to a Vigenère cipher with a long keyphrase, requiring the use of the index of coincidence and tetragrams (with 'Z's for spaces) to crack. The "final exam" was a one-time pad, with the "code book" derived from ShmooCon dates, applied to the solution of the first stage. The ultimate unsolved code, K4 cryptos, was presented as an ongoing challenge. This contest provided a structured, hands-on learning path through various cryptographic techniques.
• SchmooGraphy: This competition, described as focusing on "cerography" (steganography) rather than cryptography, aimed to engage the community with hidden information. The stages involved:

1. Posters with hidden encodings: Two encodings were present – circuitry (teal, four characters per poster) and Braille (layered underneath).
2. IQ file analysis: A distributed IQ file appeared as noise in the time domain but revealed a QR code in the frequency domain.
3. ISO file forensics: Two ISO files, one containing a "key" and "legacy code" acting as an index template into the other ISO, required careful analysis to extract clues.
4. Websocket-based steganography: A website connected to a websocket that sent "a ton of jpegs," but the actual hidden information was embedded in the ping-pong heartbeat messages, requiring capture and decoding of an entire image.
5. USRP and RF analysis: The final stage involved a USRP playing an IQ file "somewhat softly" at 88.9 MHz, with AM modulated Morse over an FM carrier. This required specialized equipment for recording and decoding.

These technical elements, scattered across various community events, illustrate ShmooCon's commitment to providing hands-on, practical engagement with diverse cybersecurity and related technologies, even within a closing ceremony that emphasized human connection.

Demo / Proof of Concept

▶ Watch: Pomp and Circumstance performance begins; students enter (7:00)

The "Closing Remarks" presentation itself functioned as a unique form of demonstration, showcasing the vibrant community and diverse activities that ShmooCon fostered over two decades. While not a traditional technical product demonstration, the talk proved the success of ShmooCon's model for community engagement and learning.

Key "demonstrations" included:

• Community Performance: The impromptu performance of "Pomp and Circumstance" by students and volunteers on unconventional instruments (viola, euphonium, mellophone) served as a powerful proof of concept for the spontaneous, inclusive, and fun-loving spirit of the ShmooCon community. It demonstrated the willingness of attendees and staff to participate wholeheartedly.
• Interactive Tradition: The live, audience-wide Rock Paper Scissors game was a direct demonstration of a long-standing ShmooCon tradition, showcasing the conference's ability to engage hundreds of participants in a simple, fun, and competitive activity that culminated in free tickets for the next year (or rather, the final year's winners receiving coveted red cooler bags).
• Impact of Outreach: The surprise video message from Vlaada Chvátil, creator of the popular board game Codenames, underscored the conference's ability to connect with influential figures and demonstrate the broad appeal and community-building power of seemingly non-technical activities among a "bunch of clever IT people."
• Contest Successes: The detailed recaps of various contest winners – from the Radio Frequencies CTF (winning a Zero Point Module Lego set) to the Crypto College Badge Contest (winning tickets to BSides Charm) and SchmooGraphy (winning cash prizes and No Starch Press gift cards) – effectively demonstrated the successful execution and educational value of these hands-on challenges. Each winner's recognition validated the effort put into creating these learning environments.
• Charitable Endeavors: The announcement of over $24,000 raised for Reading Is Fundamental and the EFF through T-shirt charities, along with $1,545 to the EFF and €1.2 GBP from "Saturday Night Trivia," demonstrated the community's capacity for collective philanthropy and using the conference platform for social good.
• HFC's Legacy: The heartfelt message from Hackers For Charity (HFC) detailed their 15 years of impact, from building sustainable farming systems in Kenya to deploying defensive network kits in Puerto Rico, directly showcasing how the "technical skills of hackers" can transform charitable organizations. This served as a powerful proof of concept for the real-world application of hacker ethics and skills for humanitarian aid.

In essence, the entire "Closing Remarks" was a grand "proof of concept" for ShmooCon's enduring legacy as a community-driven event that fostered learning, connection, and positive impact, albeit through a lens of reflection rather than explicit technical demonstration.

Defensive Implications

▶ Watch: Performance ends; appreciation for impromptu participants (10:00)

The "Closing Remarks" of ShmooCon, while not focused on specific defensive strategies or vulnerabilities, inherently communicated profound defensive implications through its celebration of community, skill development, and resilient thinking. The overarching defensive implication is the cultivation of a more knowledgeable, connected, and proactive cybersecurity workforce and community.

• Skill Development and Preparedness: Events like ShmooCon Labs, the Radio Frequencies CTF, the Crypto College Badge Contest, and the Lockpick Village directly contribute to defensive capabilities. Labs provided experience with "Enterprise grade system[s]" and "networking architectures," equipping attendees with practical knowledge for securing real-world infrastructures. The CTF and Crypto College honed skills in signal analysis, cryptographic cracking, and reverse engineering, which are critical for identifying and mitigating advanced threats. The Lockpick Village educated participants on physical security vulnerabilities, emphasizing a holistic approach to defense.
• Resilient Communication Networks: The enthusiastic adoption of MeshTastic networking, described as a "pretty resilient and amazing Network," highlights the community's interest in developing and utilizing alternative communication channels. In scenarios where traditional infrastructure is compromised or unavailable, such peer-to-peer networks offer a decentralized and robust means of communication, which has direct implications for disaster recovery, crisis response, and maintaining operational continuity in adverse conditions.
• Ethical Hacking for Good: The work of Hackers For Charity (HFC), supported by the ShmooCon community for 15 years, explicitly demonstrated how hacker skills can be leveraged for defensive and humanitarian purposes. By conducting "security assessments" for charitable organizations and deploying "defensive Network our neighborhood watch kits" in regions like Puerto Rico, the community actively contributed to securing vulnerable entities and building resilient infrastructure. This underscores the defensive potential of channeling technical expertise towards protective measures.
• Knowledge Sharing and Mentorship: The emphasis on "bringing new speakers into the arena" and the overall culture of knowledge sharing at ShmooCon directly bolsters the collective defensive posture of the industry. By disseminating new research, techniques, and best practices, ShmooCon helped to raise the baseline of understanding across the community, enabling more individuals and organizations to defend against evolving threats. Mentorship, whether formal or informal, further propagated these skills.
• Community Resilience and Collaboration: The creation of a strong, interconnected community is perhaps the most significant defensive implication. In a field constantly battling sophisticated adversaries, a collaborative and supportive community can share threat intelligence, develop joint defenses, and collectively respond to incidents more effectively than isolated entities. Heidi's call to "be in the room, be a participant" directly encourages the active engagement necessary for collective defense.

In essence, ShmooCon, through its diverse offerings and community-first approach, acted as a powerful incubator for defensive talent and a catalyst for a more resilient and ethically-minded cybersecurity ecosystem. Its legacy lies not just in specific technical disclosures, but in the countless individuals it empowered to become better defenders.

Key Takeaways

• Community is Paramount: ShmooCon emphasized that the strength of the information security field lies in its community, fostering connections, shared learning, and mutual support among practitioners.
• Cultivating New Talent: The conference consistently prioritized providing a platform for new speakers and participants, acting as a crucial launchpad for countless careers and contributions to the industry.
• Strategic Endings for New Beginnings: The decision to conclude a highly successful event demonstrated the importance of knowing when to step back, allowing space for new ideas and leaders to emerge within the broader community.
• Active Participation Drives Impact: Attendees were encouraged to "be in the room, be a participant," reinforcing that every contribution, regardless of scale, makes a tangible difference in collective growth and knowledge.
• Hands-On Learning is Essential: ShmooCon's diverse range of interactive events, from the ShmooCon Labs to the Crypto College and RF CTF, underscored the critical role of practical, hands-on experience in developing and refining cybersecurity skills.
• Hacker Ethic for Social Good: The success of initiatives like Hackers For Charity highlighted the powerful potential of leveraging technical skills for humanitarian efforts and securing vulnerable organizations.

About the Speaker(s)

Bruce Potter is the founder of the Shmoo Group and co-founder of ShmooCon. Throughout the conference's 20-year history, Bruce has been a guiding force, particularly in the technical and strategic direction of the event. His reflections during the closing remarks touched on the philosophical aspects of leadership, the challenge of knowing when to conclude a successful venture, and his continued commitment to fostering innovation within the community through new initiatives like "moose meat."

Heidi (referred to by her first name throughout the talk and in the metadata as "ShmooCon Logistics") served as the primary organizer and driving force behind the operational success of ShmooCon. Often described by Bruce as the "logistics" and the one "good at running the event," Heidi's role encompassed everything from managing the diverse array of community events and contests to overseeing the intricate details of conference operations. Her emotional address in the closing remarks highlighted her deep personal connection to the community, her initial struggles with imposter syndrome, and her ultimate realization of the profound impact ShmooCon had on countless lives and careers. Her dedication to fostering a supportive and inclusive environment was a cornerstone of the conference's identity.