What we want

Work you did with your hands. A bug you chased, a lock you opened, a protocol you read until it gave up, a board you glitched, a surveillance system you actually measured rather than speculated about.

We would rather have a rough talk about real work than a polished talk about a survey. If the ending is “and then it turned out I was wrong about the whole approach”, that is a talk, and it is usually a better one.

That very much includes ordinary infosec. If you built the detection pipeline, wrote the tool, or stood up the program, come and say how, what it cost and what you would do differently. Builders of code and builders of programs both count, and a talk that lets somebody go and do the same thing on Monday beats anything clever.

First-time speakers: you are not a risk we tolerate, you are a category we go looking for. Say it is your first time in the submission and you will get a dry-run slot with someone who has done it before, weeks ahead, over video.

What we don’t want

• Anything that is, underneath, a product pitch. We will spot it. Everyone will.
• Predictions about the coming year. Nobody has ever learned anything from these.
• “Building a culture of security awareness.”
• A talk that cannot be given without the vendor’s slide template.
• Anything where the demo is a recording of a dashboard.
• Theory with nowhere to land. If nobody in the room can act on it, it wants to be a paper rather than a slot.
• A generic AI overview, or another hour on defending your AI agents, unless it is novel, demonstrable and cool as hell. Breaking a model is a different matter entirely and is always welcome.

Who this is for

Open-minded, freedom-loving people.

That is the first filter and most of the entire filter. If you like taking things apart, and you do not much care for being told what you are allowed to look at, you are already most of the way in the door.

An all white, all male speaker lineup is a failure condition here, not a disappointment to be noted in a wrap-up post. If that is what this turns into, it does not happen. I would rather cancel a first year conference than run one that looks exactly like every other one.

So plainly: we want representation. Women, people of color, trans and queer folks, disabled hackers, and anybody who got into this without the degree or the clearance or the job title. Wanted here, actively, not tolerated and not counted.

The honest part. Fort Collins is a very white town. That is a demographic fact and pretending otherwise would be silly. It is also, in my experience, a genuinely accepting one, which is a different thing and does not get anybody off the hook. What it means is that a room which is not all one kind of person has to be built deliberately and early, by me, rather than hoped for and then apologized about afterward.

What that looks like in practice:

• I go and ask people directly. A submission pile does not diversify itself and waiting for one to is just a way of blaming the pile.
• The anonymity options below exist partly for this. Handle, no bio, no photograph, if being visible in this industry costs you something it does not cost me.
• First-time speakers get a dry run with somebody who has done it before, weeks ahead, over video.
• If travel is the thing stopping you, say so in the submission. I cannot promise it yet and I will not pretend otherwise, but I would much rather know and try than have you quietly not send anything.

Yes, this is in tension with the anonymity below. A lineup where people can be fully anonymous is a lineup nobody can audit from the outside, and the first review pass is name-blind on purpose. Both are deliberate, so here is how they actually fit together.

The work happens before anything is submitted, not during selection. I go and ask people. That fixes the pipeline rather than the scoring, which is the only honest place to fix it if the review is going to stay blind, and blind review is worth keeping.

Anonymity stays the speaker’s call and never mine. Be visible if you want to be visible. If you would rather not be, I am not going to out you so that my schedule looks better to strangers. That is using a person as a prop, which is the exact thing this section is supposed to be against.

The cost of that is real and worth stating: if enough people pick the handle, the schedule may look less varied than the room actually is. I will take that trade. The judgement about whether this has become an all white male conference is mine to make out of what I actually know, and I have already told you what I will do about it.

And if you are reading this and talking yourself out of submitting because you are not sure you belong at a hacker conference: you are the specific person this section was written for. Send the thing.

Be as anonymous as you like

Three options, all equally fine, and no default among them. Go fully anonymous and the schedule carries the talk and nothing else. Use a handle. Or use your own name with a headshot and a bio, if you would rather people could find you afterward. Tell us which one you want and that is exactly what we print.

The only thing not on that menu is representing a brand. Nobody is up here as a company: no logos on the slides, no vendor deck template, no pitch in a talk’s clothes. Say where you work if it matters to the story. A stage with no logos on it is not worth buying, which does more to keep a program honest than any disclosure slide ever did.

How it gets reviewed

Two rooms means a short schedule and a lot of good talks we will not have space for, which is worth knowing before you spend an evening on a submission. Reviewing is done by a panel of named humans, published before the CFP closes so you know who is reading. The first pass is name-blind: no employer, no handle, no bio, just the abstract and the outline. Conflicts recuse themselves in writing. Everybody who submits gets a real answer from a person, including the rejections, and including why.