Fort Collins · Colorado · TBA Spring 2027 · One or two days

CacheCon

On the banks of the Cache la Poudre 40°35′N 105°05′W · 5,003 ft

Taking back the conferences

A one or two day, privacy and hacker-forward infosec conference for people who take things apart or build them. Exploits, malware, hardware, radio, the surveillance that ties it together, and ordinary infosec done unusually well by whoever actually did it. One or two rooms, nothing gated, a few activities the morning of, general nerdery throughout, and hopefully a kick ass band at the end of it.

A room that is not all one kind of person Open-minded, loving people first, and after that it is deliberate. An all white, all male lineup is a failure condition here rather than a disappointment, and if that is what this turns into, it does not happen. How that gets built.

Submit a talk Why this exists

Buy a ticket coming soon · the terms are already posted

Three kinds of cache

The name does three jobs at once, and we mean all three.

A cache is what a processor keeps close, because it expects to need it again. Fast, small, and worth the trouble precisely because it is small.

A cache is also what you bury when you do not want it found, and here that is not a metaphor. Sometime in the 1820s a party of French trappers got caught out on this river, overloaded and sinking. They dug a pit in the bank, buried their gunpowder in it, covered it over and walked out light. Cacher la poudre. Hide the powder. The name stuck to the water, then to the canyon, and now to a conference held on the same bank.

And a cache is what every other conference quietly keeps on you long after you have driven home.

We are keeping the first two.

CacheCon is a day or two in Fort Collins, Colorado, for exploit writers, hardware people, lockpickers, and the privacy crowd who worked out long ago that those are the same skill pointed at different doors. It is deliberately informal. There is a river two hundred yards away, more breweries than is strictly reasonable, and a room full of people who will show you how they actually did it, rather than a slide that says they could.

Hacker, in the old sense. Curious, hands-on, and unwilling to accept a closed lid as an answer. Not a job title, not a certification, and definitely not a market segment. If you have ever opened something you probably shouldn’t have, just to see how it worked, the word covers you.

Section 02 · Field guide

Five species, one habitat

What gets talked about here.

Coleoptera segfaultii

Exploits, malware & reversing

Memory corruption, protocol abuse, bug hunting, a sample you pulled apart, and the unglamorous work of making a crash do something on purpose. Bring the crash.

× no AI talk that is all slides

Odonata protocolla

Hardware, RF & gadgets

Glitching, side channels, bus sniffing, radio you were never meant to hear, and whatever you turned up with in a static bag. The irons are on the tables.

× no product demos

Ovis disputandum

Debate

A motion that splits a room, taken up by people who hold opposite positions and can defend them. Should the CISO be technical. To password manager or not. Held in front of everyone, with somebody keeping time.

× no polite panels

Bubo panopticus

Privacy & surveillance

Who is collecting, by what mechanism, and what actually stops them. Counter-surveillance as a practical skill rather than a panel topic.

× no compliance theater

Castor aedificans

Blue, red, and in between

Ordinary infosec done unusually well, told by whoever actually did it. Detection that fires on real things, a red team engagement that changed something, an AppSec program people use on purpose. Written from scratch or assembled out of what you already pay for, both count. What it cost, what broke, and enough detail to go and do it Monday.

× no maturity models

Section 03

Park regulations

Posted at the trailhead, as they should be. If we break one of these, hold us to it in public. That is the only enforcement mechanism that has ever worked. They all come out of the mission, which is three lines long and takes considerably more than three lines to explain.

Prohibited

×
Badge scans
Nothing on your badge can be scanned. No chip, no barcode, no QR, whatever it ends up being printed on. Nobody can scan you because there is nothing on you to scan.
×
Lead lists
A ticket is a single-use code emailed to whoever bought it and the badge is written at the door, so there is no list of who registered to maintain, enrich, rent, sell, or hand over so that a sponsor can be introduced to you. Sponsors get a table, a sign, and whoever chooses to walk up to it, and they are told exactly that in writing before they are allowed to pay us.
×
Pay-to-speak
No slot is for sale at any price. If you ever find out otherwise, say so loudly, and we will have deserved it.
×
A conference app
The schedule is a web page and a sheet of paper. Neither one needs your location, your contacts, or a push token.
×
Recording without consent
Talks are recorded only where the speaker has said yes. Hallways, the Island and the bar: never.
×
Photographs without consent
Consent is a conversation, not a colored lanyard. Ask the person. That covers wide shots of a full room and it covers the Island.
×
Closed circles
Four people who already know each other, standing in a ring with their backs out, is not networking. Leave a gap in the circle. Somebody will walk into it, and that is the entire reason they came.
×
Being an asshole
Disagree as hard as you like, that is the point. Go at the person instead of the idea and you are out the same hour. The whole rule is one line.

Expected

✓
Come as whoever you like
Purely anonymous, a handle, or your own name with a headshot and a bio. All three are equally fine and none of them is the default. The one thing you cannot be up there is a brand: no logo on the slide, no vendor deck template, no pitch in a talk’s clothes. Say where you work if it matters to the story, just do not show up as their mouthpiece.
✓
Show the work
Slides are optional. A demo, a repo, a capture, or a wiring diagram is not.
✓
Speakers get looked after
Keynote travel and lodging covered. Everyone else: your ticket, the speaker dinner, and something to take home. We are a first year conference with no money, and we would rather tell you that now than promise you a flight and take it back in the spring. TBA
✓
A room that is not all one kind of person
An all white, all male lineup is a failure condition, not a disappointment. If that is what this turns into, it does not happen. Fort Collins is a very white town and saying so out loud is the first half of doing something about it. The second half is in the CFP.
✓
You get introduced
Staff, volunteers and speakers all have the same second job here: spot the person standing on their own and go and fix it. Not a greeter at a desk, an actual habit, and one we will be explicit about with everybody working the event. If you came alone, knew nobody, and went home having met nobody, we failed. Tell us so.
✓
Amateurs welcome
Hacker means curious, not employed. Students, hobbyists and the between-jobs get in at cost or gratis.
✓
CPE evidence, handed out
A signed certificate of attendance with the hours on it, at the door. We do not grant CPEs, nobody at a conference does: your certifying body awards them when you self-report, and this is the paperwork it wants. People need the hours, and being sniffy about that just sends you off to buy them somewhere worse. We hand them out and then stop thinking about them, because the schedule is not built out of seat time.
✓
Stay after the talk
Forty-five minutes on, fifteen minutes after, and the fifteen is the part we protect: the conversation, the tinkering, the disagreement that turns into somebody opening a laptop. If there are two rooms they stagger long and short sessions so that time actually exists rather than being the thing that gets eaten when a talk runs long. Speakers are expected to still be in the room for it, and to want to be.

Section 04 · This is the privacy policy

Leave no trace

Seven principles every Colorado kid learns before their first overnight. They turn out to be a complete data policy, so we did not write a different one. This is the policy. There is no longer document behind it.

Plan ahead and prepare
“Know before you go”
We decided what to collect before we built the form. It is: one email address to send your code to, the code itself, and which ticket you bought. No name at all: the badge gets written at the door. That is the entire list, and it is here rather than buried in a policy you would have to go and find.
Travel on durable surfaces
“Stay on the trail”
Static HTML on a box we run. No analytics, no tag manager, no CDN, no embeds. The fonts are served from this domain, because loading them from Google would hand your IP address to Google on every single page view, which rather gives the game away.
Dispose of waste properly
“Pack it out”
Registration data is held for one year, and then it is gone. One year rather than one week because CPE claims turn up late, and if you bought a ticket and need the paperwork a second time, the email address and the code are what we would check it against. We hold those either way, so taking the signed certificate at the door saves you having to come back and ask rather than saving us from keeping anything. Note what that record cannot do, while you are here: there is no name in it and a code can be passed on, so it shows what was bought and never who was in the room. Nothing is archived, nothing is anonymized and quietly kept for analysis.
Leave what you find
“Take only photographs”
We do not scan you, sell the list, rent the list, or “share it with selected partners”. There is no CRM behind this website. Sponsors are told all of this in writing before they are allowed to pay us.
Minimize campfire impacts
“Keep it small and contained”
No app, no push notifications, no engagement metrics, and no gamified scavenger hunt that is really a booth visit tracker wearing a costume.
Respect wildlife
“Observe from a distance”
Photo consent is a conversation, not a colored lanyard. Ask the person. If you did not ask, you do not take the picture and you certainly do not post it. That covers wide shots of a full room and it covers the Island. A lot of people here have good reasons to stay out of frame and you do not need to be told what they are.
Be considerate of others
“Yield on the trail”
There is a code of conduct. It is short, it is specific, and it is enforced by named humans who will be in the building and whose faces you will know by lunchtime.

Section 05

One or two rooms, nothing gated

One room is what a first year conference can pay for on its own. A second one running alongside it is one of the things sponsorship money goes toward, and it is the honest answer to what that money is actually funding: another eight or ten talks and the workshop space to run them in. What money changes is how many rooms, never where they are. Walking distance from Old Town is not on the table at any price, because a venue you have to drive to is a venue the people who live here will not come to after work. Rooms are named for places up the canyon. A third space, the Island of Misfit Toys, runs all day with no schedule at all and gets its own section below. TBA, the schedule lands once the CFP closes.

●

Greyrock

The main room. Talks back to back, plus the debates, all the subjects mixed together on purpose rather than sorted into streams. Named for the mountain standing over the north rim of the canyon, which is the one nearly everybody in this town has climbed at least once and complained about the whole way up.

Talksopen to everyone

●

The Narrows

The second room, if we get one. Longer hands-on sessions and workshops, where the thing you came to learn is in front of you on the table instead of on a slide. Whether this one runs comes down to who helps cover it, and we would rather say so now than quietly drop it from the schedule later.

Workshopsif funded

Nothing here is gated. No track is advanced-only, no session needs a prerequisite, and nobody checks what you already know at the door. If a talk turns out to be over your head, that is on the speaker to fix, not on you.

Section 06

The other half

Half of what you get out of a conference happens between the talks. We schedule for that on purpose instead of pretending it is a happy accident.

The Island of Misfit Toys

One room with everything in it, open the whole time. Loaner picks and progressive locks, irons and a scope and a pile of components, and the CTF running the entire time with no cloud account, no work email and no leaderboard that follows you home.

It is one room rather than separate villages for two reasons. The honest one is that we do not have the space. The better one is that villages let you spend an entire conference inside the thing you already do. Put the picks next to the irons next to the CTF and you end up sitting down at a table you had no intention of sitting at. Wandering into somebody else’s domain is the whole point of this, and the hope is that you go home having actually learned something new, rather than having had your existing expertise confirmed back at you for the duration.

Mayhaps somebody will be leading a build of a guitar pedal noise box, and that somebody would be one of the organizers. Bring a thing that does not work. Leave with a thing that does something, which is not quite the same claim.

/dev/urandom

One session, doors shut. No recording, no photos, no names taken, nobody introducing themselves by employer. A vendor is drawn at random from the hat and the room says what it actually experienced. Then another one gets drawn. Nobody picks the targets, which is the point: this is not a pile-on convened against anyone, it is whoever comes out of the bag.

What gets said in there is first-hand experience and honest opinion, spoken as such. The handful who genuinely behave like partners get named out loud too, and they have earned it. Everybody in this field already knows which is which. Almost nobody can say so with a badge on and a logo behind them.

The activities

Guided local outings around the conference. Horsetooth and Arthurs Rock are the likely ones. Those trails can be perfect or a sheet of ice depending entirely on the week, and that is a real caveat rather than a polite one, so nothing gets named until we can see the ground.

There may well be a snowboard trip at cost for anyone who wants one, because the mountains hold their snow long after town has given up on it. Exactly what runs is TBA. That something runs is not.

Hopefully a kick ass band

To close it out. A small room, a late finish, and loud enough that you will stop talking shop for forty minutes, which is the point. Nothing about it requires a drink in your hand. Whether it happens at all comes down to whether that line gets covered, so it is a hope rather than a promise.

To partake or not to partake

Beer will be flowing the whole time, and Fort Collins earned that reputation honestly. Nobody has to drink to belong here, though. There are decent non-alcoholic options at everything we run and a table at the social where nobody is drinking. Nobody will ask you why, and nobody should keep offering.

If you do partake, two local facts. You are at 5,003 feet, and everything lands harder up here than it does at sea level: the beer, the thin air, and the morning after. Drink more water than you think you need, especially on day one.

Cannabis is legal here for adults, as it now is in a good many states. If you are visiting from somewhere that still hates freedom, be warned that ours is strong. The edibles especially, because they take an hour or two to arrive and people who do not know that go back for a second one. Start with a fraction of what you think you need, buy from an actual licensed dispensary, and keep it indoors, because consuming in public is still illegal in Colorado. Do not drive on any of the above. Do not become a clown, and definitely do not become a hospital visit. That genuinely happens to visitors every single year.

Section 07

Talk at it

The CFP is open and it is read by people, not scored by a rubric.

We want the thing you actually did, including the part where it did not work for three months. First-time speakers are not a risk we tolerate, they are a category we go looking for. Nothing on the schedule is gated, so pitch the talk you would want to sit in, not the one you think clears a bar.

Read the CFP

Getting there

Fort Collins

Where: Fort Collins, Colorado. Sixty-five miles north of Denver, at the mouth of the Poudre Canyon. Elevation 5,003 ft, so drink more water than you think you need on day one.
When: TBA, spring 2027. One or two days, and on weekdays: Monday, or Monday and Tuesday, or Thursday and Friday. Weekdays because the room is affordable then, and because this is work rather than a hobby you should have to spend your weekend on.
Venue: TBA. Walking distance from Old Town is the one requirement we will not compromise on.
Flying: Denver International (DEN), then a shuttle straight up I-25. Roughly seventy minutes if you miss the traffic.
Outside: Horsetooth is twenty minutes west of Old Town and Arthurs Rock is a little past it. Those trails can be perfect or a sheet of ice depending on the week, so nothing gets promised until we can see the ground. The mountains keep their snow considerably longer.
Tickets: Terms are posted. TBA, and these are a draft rather than a decision. $25 if you are paying for yourself, $99 if your employer is paying, and low cost or gratis for students and the between-jobs depending on how the numbers land. Priced to cover the room and the coffee, not to build a margin.

Section 08

Get involved

A first year conference is mostly a pile of jobs nobody has claimed yet. If any of this sounds better than sitting through another vendor keynote, say so and it is yours.

Volunteer on the day

Registration, wrangling rooms, running the Island of Misfit Toys, keeping the schedule honest, pointing lost people at coffee. You still get to see talks and you get fed.

Help organize it

Reading CFP submissions, chasing a venue, working out food, standing up the CTF, finding a band that will play to a room of hackers on a Tuesday. This is where the real shortage is, and it is the part that decides whether any of the rest happens.

Know a thing

A room that would host this. A sponsor who actually behaves. A band. A person who should be speaking and would never submit on their own. All of that is worth an email.

hello@cachecon.com

No form, no portal, no signup. It is one person reading a mailbox, so expect a reply from a human and not immediately.