CacheCon

CacheCon

Fort Collins · Colorado · on the Cache la Poudre

The mission

Three things.
The rest is detail.

Most conference mission statements are one sentence long, mention excellence, and could be moved to a different conference without anybody noticing. Here are ours in three lines, followed by a great deal of text on what each one costs and how you will be able to tell if we are failing at it.

Section 01 · The short form

The mission, in three lines

If you only read this far, read this far.

  1. Diversity by design

    “not by hope, not by apology”

    Build a room that is not all one kind of person, on purpose, early, by hand, and treat failing at it as a reason not to hold the event rather than a paragraph in the wrap-up post.

  2. A room Northern Colorado does not have

    “the people are here, the room is not”

    Give the security community that is already up here, fractured across towns, sectors and job titles, one room and one date a year. Not another group. A place the existing ones can finally find each other.

  3. Nobody here is the product

    “the real thing, and nothing taken for it”

    Actual work from the people who actually did it, given to a room that gets harvested for precisely nothing in exchange. Both halves of that are the same commitment, and the second half is what makes the first half possible.

Why three. Because a list of ten is a list of zero. These are the three we would cancel over, which is the only test of a mission statement that means anything. Everything else on this site, the regulations, the data policy, the conduct rule, the CFP, is one of these three turned into something you can check.

Section 02 · Definitions

Vision, mission, values, and why everyone mixes them up

Nobody remembers which one is which, including people who run workshops about it, and the reason is that most organizations write all four at the same offsite and end up with four paragraphs that say the same pleasant nothing. They are genuinely different things, though, and the difference is useful, so here it is in the plainest form we can manage.

Vision
The world you want. It describes an outcome, not you. A real vision does not require your organization to exist, and if yours cannot be true unless you personally pull it off, you have written a business plan and mislabeled it.
Mission
What you are doing about it. Present tense, specific, yours. The test is simple: if you could print it on a competitor’s wall and nobody would blink, it is not a mission, it is a mood.
Values
How you behave on the way there, and particularly how you behave when behaving costs you money. Ours have not been tested yet, in fairness: nobody has so far offered us anything worth breaking one for. Writing them down before the offer arrives is the only honest thing available, and it is why they are already public.
Strategy
The order you do things in, and what you have agreed to be bad at for now. One room, maybe two, one town, one year at a time. We are deliberately bad at scale.

So, ours

The vision. A security profession whose gatherings are built for the people sitting in them. Where being curious is the whole entry requirement. Where the crowd in the room looks something like the population it claims to defend. Where going to a conference costs you a ticket and a couple of days, and not a permanent entry in somebody’s database that outlives your interest in the subject. Note that none of that needs CacheCon. Plenty of small conferences are already most of the way there and have been for years. That is exactly what makes it a vision rather than a pitch.

The mission is narrower, because it has to be ours and it has to be doable. Run one small conference in Fort Collins that does all three of the things above at once, in public, where the commitments are written down in advance. Publish what it cost and what went wrong. Make the whole thing boringly easy to copy, so that the answer to “could you do this here” is yes, and the instructions are already on a website.

The values are not on this page, and that is deliberate. They are already published in checkable form as the park regulations and leave no trace. Those pages are the values. There is no softer-worded document behind them and no version of them that only the organizers have seen.

Section 03 · Mission 01

Diversity by design

An all white, all male lineup is a failure condition here, not a disappointment. If that is what this turns into, it does not happen.

That sentence appears on three pages of this site, which is on purpose, because it is the only part of the mission with a kill switch attached. Not a target, not an aspiration, not something to be noted with regret in a retrospective. If the program comes together and it is one kind of person all the way down, the correct move is to not run a first year conference rather than to run one that looks exactly like all the others and promise to do better next time.

Here is the honest local context, because leaving it out would be worse. Fort Collins is a very white town, and so is most of Northern Colorado. That is a demographic fact and pretending otherwise to sound welcoming would fool nobody who has ever been here. It is also, in our experience, a genuinely accepting place, which is a different property and gets nobody off the hook. Being an accepting town is the easy half. What it means practically is that a room which is not all one kind of person has to be constructed deliberately and early, by the organizers, rather than hoped for during the CFP and apologized about afterward.

What “by design” actually means

The word matters. Most conferences treat this as a selection problem, which is the one place where it cannot be solved, because by the time submissions are in front of you the pile is already whatever it is. Selecting differently from a narrow pile just moves the unfairness around. So the work happens before anything is submitted:

  • We go and ask people directly. A submission pile does not diversify itself, and waiting for one to is a way of blaming the pile for your own inaction. This is a real, unglamorous job: making a list, writing to strangers, and being turned down a lot.
  • The first review pass is name-blind. No employer, no handle, no bio, just the abstract and the outline. Fixing the pipeline rather than the scoring is the only honest way to keep blind review, and blind review is worth keeping.
  • First-time speakers get a dry run. Weeks ahead, over video, with somebody who has done it before. A great many people who should be on a stage simply have not been on one, and that is a solvable problem rather than a quality signal.
  • Anonymity is a first-class option. Handle, no bio, no photograph. If being visible in this industry costs you something it does not cost us, then it is not much of a favor to insist you be visible.
  • Travel is a conversation, not a silent filter. If the cost of getting here is what stops you, say so in the submission. We cannot promise anything yet and we will not pretend otherwise, but we would much rather know and try than have you quietly send nothing.
  • Somebody is watching the room, not just the program. Staff, volunteers and speakers all have the same second job: spot the person standing alone and go fix it. If you came on your own, knew nobody, and went home having met nobody, we failed, and we want to be told.

What it is not

It is not a quota, because we do not have the numbers for a quota to mean anything at this size, and a quota you cannot fill honestly just turns into somebody being invited as a decoration. It is not a diversity track, because putting the topic in its own room is how you excuse the other rooms. It is not a panel about the subject in place of doing anything about it. Nobody here is going to be asked to represent a demographic on stage. You will be asked about the bug you chased and the board you glitched, same as everyone.

And it is not tolerance. The word we keep using on purpose is wanted. Women, people of color, trans and queer folks, disabled hackers, and anybody who got into this without the degree or the clearance or the job title. Actively wanted, sought out by name, and not counted afterward for a slide.

The obvious question

Somebody asked it directly, which is a great deal better than the version where nobody asks and everybody guesses. They were weighing up sponsoring, they are a white guy, and they wanted to know whether showing up meant adding to the problem.

No. Plainly, with nothing attached to soften it back into a yes.

Read the failure condition again and notice what it is attached to. It is about the lineup, which is a thing the organizers build, and not about the room, which is whoever decides to come. Nobody is counted at the door. There is no quota to land on the wrong side of, and there is no number of white men that turns a good conference into a bad one. The kill switch is wired to our work, not to your attendance.

And the honest forecast, since this page keeps insisting on those: most of this room will probably be white men. The trade skews that way, Northern Colorado skews that way, and a first year conference draws from whoever is already nearby. Predicting anything else would be a pleasant thing to say with nothing behind it. It would also be a strange thing to apologize for, given that the people it describes are most of who is doing the unpaid work that gets a first year off the ground at all.

What we are after is not fewer of anybody. It is that the stage, the workshop benches and the Island of Misfit Toys end up looking more like the people this trade exists to protect than the trade itself currently does. Everybody gets breached. Everybody has somebody in their family who gets called by a scammer. A room working on that problem is better at it for holding people who have met it from different directions, which is a point about the quality of the work rather than about anybody’s seat.

So come. Submit something. Sponsor it if you want to. And if you know somebody who has never been to one of these, bring them. A first conference is a great deal easier to walk into next to somebody who has already done it once.

The tension we are not going to pretend away

Two things on this site pull against each other and it would be dishonest to lay them out on separate pages and hope nobody noticed. A lineup where people can be fully anonymous is a lineup nobody can audit from the outside. Add a name-blind first pass and there is no external way to verify any claim on this page at all. Both of those choices are deliberate. Here is how they fit together.

The work happens before selection, never during it. That is the whole resolution. Fix the pipeline and the blind review can stay blind, which is the only arrangement where both commitments survive intact.

Anonymity stays the speaker’s call and never the organizer’s. If you want to be visible, be visible. If you would rather not be, nobody is going to out you so the schedule looks more varied to strangers. That is using a person as a prop, which is precisely the thing this section exists to be against.

In practice we do not expect many people to ask for it. Most speakers will put their own name on the talk, and the option is there for the few who need it.

Free speech, and respect for all

These are not in conflict and we are tired of the pretense that they are. You can hold any position you like here and defend it hard. There is a whole session format built around people disagreeing in front of a room. What you cannot do is go at the person instead of the idea, and the difference has never once been genuinely unclear to anybody who wanted to know it. Disagree as hard as you like. Do it to the position.

Which produces one more line that is easier to write than most people think. If any of the above sounds like something you would need to work around, this is not the conference for you, and that is fine. Do not come.

A room that is all one kind of person asks one kind of question. The people who are best at surveillance self-defense are very often the ones who needed it first.

That last point is worth dwelling on, because the case here is not only a fairness case. Threat models come out of lived experience. A room full of people who have never had reason to worry about being tracked will produce a conversation about tracking that is missing its most useful half. For a conference whose two stated subjects are privacy and hacking, a homogeneous room is not just uncomfortable, it is technically worse. We would want this even if nobody were watching.

Section 04 · Mission 02

A room Northern Colorado does not have

There are security people up here, and there are security groups up here. What there is not is one room they all end up in once a year, on a date everybody already knows about.

The usual story about a place like this is that it has no community and somebody needs to go and build one. That is not true here, and repeating it would be insulting to people who have been quietly doing the work for years. Northern Colorado has groups, and some of them have been meeting for a long time. Association chapters. A DEF CON group. Makerspaces and hackerspaces. University clubs and student CTF teams. OWASP and 2600 style meetings that come and go with whoever is willing to book the room. And a fair number of standing arrangements between four people that never acquired a name at all. What this place has is a fracture problem, which is a completely different thing and has a completely different fix.

The split runs along about four seams at once. By town, because Fort Collins, Loveland, Greeley, Longmont and Windsor are far enough apart that a weeknight in one of them is an entire evening in another. By sector, because the person keeping a municipal water system upright and the person doing embedded work at a hardware shop have almost no reason to end up in the same room and every reason to talk to each other. By job, because the detection engineer, the appsec lead and the person reversing firmware in a basement are nominally in one field and functionally in three. By affiliation, because the chapter member, the hackerspace regular and the person who has never joined anything are each fairly certain the others are a different crowd. And by whether you are the sort of person who will drive to Denver, which quietly sorts everybody into people who have a community and people who have concluded there is not one.

None of that is anybody’s fault. It is simply the default. A small group forms around one specific thing, does that thing well, and stays exactly that size, because nothing exists to convene it with the other small groups doing the same twenty minutes away.

Why the missing piece is a conference

The Front Range’s center of gravity for conferences and anything larger than a meetup is Denver and Boulder, and reasonably so. Sixty-five miles turns out to be a strange distance: too far to be a suburb, too close for anybody to justify standing up a second version of anything. So nobody has. Taking part from up here means a drive down I-25 after work, an evening, and a drive back, which is most of a weeknight spent on an hour of conversation. Some people do it. Most do it twice and then quietly conclude that anything bigger than a meetup is a Denver thing, and that there is no point waiting for one to turn up here.

What a fractured community does not need is another monthly meetup. It has those. Adding one more small group to a set of small groups makes the problem marginally worse. What it does not have is an annual fixed point: one date, known a year ahead, worth clearing a weekday for, cheap enough that nobody has to justify a budget line, and large enough that the lockpicking people and the industrial control people and the students end up in the same hallway without anybody having arranged it.

The mission is not to build a community. It is to give the one that is already here a room and a date.

A word about the association chapters

This site is hard on professional associations and the case is written out at length elsewhere. It is worth being precise about who that is aimed at, because the aim matters a great deal here.

The complaint is structural and it is about the national bodies. An organization writes the CPE rules, then partners with the event company that needs bodies in seats, and the result is an economy in which nobody along the chain gets paid on whether you learned anything. That is a policy problem sitting at the top of an org chart.

It is not a complaint about the volunteer running the local chapter. That person is booking a room, chasing a speaker who keeps not replying, and buying pizza out of a float of ninety dollars, on top of a full-time job. That is the same unpaid work this conference is made of, and several of the better security people in this part of the state are doing exactly it right now for very little in return.

So the chapters up here are wanted, plainly, and wanted as chapters. Bring a stack of whatever you hand out, and recruit in the hallway, which is what the hallway is for.

The one thing that does not travel with you is the part the manifesto is actually about. No slot is for sale, nobody speaks from the stage as an organization, and no list of the people in the room leaves the building. Those apply to everybody identically, including to the people running this.

And your members can claim the hours. The signed certificate is handed over at the door, free, with nobody to chase afterward. That is the one piece of the association machinery that was ever any real use to a member, so we kept it and left the rest.

Who is actually up here

More than outsiders assume. This corridor runs from Longmont up through Loveland, Fort Collins, Windsor, Greeley and Wellington, and keeps going to Cheyenne forty-five minutes north. In it you will find chip design offices, embedded and instrumentation shops that were here long before anybody called this a tech corridor, a couple of extremely large breweries with extremely real industrial control systems, food processing at a scale that would surprise you, hospital systems, school districts, municipal utilities running water and power for a quarter million people, county governments, and a land-grant university with a genuine engineering and computer science school in the middle of it.

All of that has the same security problems as anywhere else and a fraction of the staff. The person keeping a water utility upright is doing consequential work under constraints that would make a bank’s security team weep, and the nearest place to describe it to somebody who would understand is an hour down the highway on a weeknight.

And then there are the students. The usual way a student at Colorado State meets this industry is a career fair, which is a room full of recruiters and no room full of practitioners. That is a poor first impression of a field that is mostly people taking things apart out of curiosity. Students and the between-jobs get in at cost or gratis, and not as a gesture. Somebody who lands in a room of practitioners at twenty tends to still be here at forty.

What we are doing about it

  • Holding it here. At Wolverine Farm Publick House, a short walk from Old Town, because the whole point is that people can come after work and be home the same evening.
  • On a weekday. Friday, April 23, with the potential for a second day. The room is affordable then, and this is work rather than a hobby somebody should have to spend a weekend on.
  • Priced for a local paying their own way. As affordable as we can make it: no more than twenty-five dollars if it is your money and ninety-nine if your employer is paying, and closer to fifteen and fifty if one more sponsor comes in, all still a draft rather than a decision. That is not a discount structure, it is the actual point: nobody up here should have to justify a budget line to meet their neighbors.
  • Pointing at the groups that already exist. Chapters, hackerspaces, student clubs, the unnamed four-person standing arrangements. If you run one up here, tell us and it goes on this site, with no obligation in either direction. A conference that convenes people once a year and then leaves them nowhere to go for the other fifty-one weeks has done half a job.
  • Mixing the room on purpose. The talks are not sorted into streams and the Island of Misfit Toys is one room rather than separate villages, precisely because the seams described above are the thing we are trying to cross. A village lets you spend an entire conference inside the discipline you already work in, which is the fracture with a lanyard on.
  • Sending people, not booths. If you run a team here, send the humans on it. We would rather have six of your engineers in the room than your logo on a banner, and the economics have been arranged so that is the only option anyway.

What success actually looks like

Not attendance. The number that matters is what happens to the groups that already exist, in the months afterward. The lockpicking night that has been running quietly for two years picks up six people who had no idea it was there. Two groups that had never heard of each other start alternating months. Somebody who has been reversing firmware alone in Greeley finds three other people doing it and stops doing it alone.

Which forces an explicit position on something most conferences get wrong. There will be no CacheCon chapter, no CacheCon meetup, no CacheCon anything running between events. Putting our name on the ongoing thing would make us one more group competing for the same evenings, which is the fragmentation this is supposed to fix rather than add to. The groups that exist are the groups. If this conference is useful, it is useful as plumbing between them.

And if that connective work gets done and the conference itself later stops happening, that is not a failure mode. That is the mission completed and the conference turning out to have been the excuse. We are saying so in advance so it cannot be reframed later as a loss.

Not competing with anybody

There are good conferences an hour south of here and you should go to them. This is not a rival operation and there is no reason for anybody to treat it as one. The gap being filled is geographic, and it exists because of a highway rather than because anybody down there did anything wrong. If the Denver and Boulder crowd drives up for a day they are extremely welcome, and several of them will probably end up doing the real work of making this happen.

That goes double for the groups already running up here, chapters very much included. You are not competition, you are the point. We would much rather advertise you than replace you, and a conference that sends forty people back out into your monthly meetings has done more for this place than one that keeps them all to itself.

Section 05 · Mission 03

Nobody here is the product

You get the real work from the person who did it, and we take nothing from you for it beyond the price of a cheap ticket.

Those look like two separate promises and they are one. The reason the talks are bad at a CPE farm is the same reason your badge gets scanned at the door: follow the money all the way down and nobody in the chain is paid on whether you learned anything. Hours in a seat are the billable unit, badge scans are the sponsor deliverable, and the content is whatever fills the gap between them. Remove the harvest and the incentive to fill a room with slides quietly disappears, because there is no longer anything to fill it for. The whole case is written out here and it is the post this conference came from.

The taking-nothing half

Stated as things rather than principles, because principles are cheap:

  • Nothing on the badge can be scanned. No chip, no barcode, no QR. Nobody can scan you because there is nothing on you to scan, and that single decision removes the entire economic reason the rest of the machinery exists.
  • There is no list. A ticket is a single-use code emailed to whoever bought it, and nobody asks your name at the door, so there is no list of who registered to keep in the first place. What we hold is an email address, a code and a ticket type, for one year, for late CPE claims, and then it is gone. Nothing gets kept, enriched, rented, sold or handed to a sponsor.
  • Sponsors buy a table, not you. They are told so in writing before they are allowed to pay. If a sponsor wants your email they will have to talk to you like a person and earn it.
  • No slot is for sale. Not a keynote, not a track, not a partner session with a thin coat of paint on it.
  • There is no app. The schedule is a web page and a sheet of paper. Neither one needs your location, your contacts or a push token.
  • This website phones nobody. Static HTML on a box we run. No analytics, no tag manager, no CDN, no embeds, and the fonts are served from this domain because loading them from Google would hand your address to Google on every page view, which rather gives the game away.

The giving-you-the-real-thing half

Take the harvest out and what is left has to actually be good, which is the pleasant part of the trade. What we ask for is work somebody did with their hands: a bug chased, a protocol read until it gave up, a board glitched, a sample pulled apart, a detection pipeline built, a surveillance system measured rather than speculated about. Including the three months where it did not work. Especially that part.

Nobody speaks as a company. Be fully anonymous, use a handle, or put your own face and bio on it. All three are supported and none is the default. The one thing nobody is up there as is a brand, and a stage with no logos on it turns out not to be worth buying, which does more for a program’s honesty than any disclosure slide ever has.

Nothing is gated. No advanced-only track, no prerequisite, nobody checking your credentials at a door. If a talk goes over your head that is the speaker’s problem to solve, not yours. Hacker here means curious, not employed.

And the fifteen minutes after every talk are on the schedule rather than squeezed into the gap, because that is where the actual thing happens: the follow-up question, the disagreement that turns into somebody opening a laptop, the conversation that was the reason to be in a room instead of watching a recording. Speakers are expected to still be there for it, and to want to be.

None of this is difficult. It is just unprofitable, which is a different problem, and one we would much rather have.

You still get the paperwork for your CPEs

A signed certificate of attendance with the hours on it, at the door, no chasing anybody for it afterward. We do not grant the credits, no conference does; your certifying body awards them when you self-report and this is what it wants to see. People need the hours, and being sniffy about that just sends somebody off to buy them somewhere worse. We hand them out and then stop thinking about them, because nothing on the schedule is built out of seat time.

Section 06 · Accountability

How you will know we failed

A mission with no failure condition is a slogan. These are checkable by you, from outside, without taking anybody’s word for anything. If one of them happens, say so in public, and we will have deserved it.

Fatal

  • ×
    The lineup is all one kind of person

    Then it does not run. That is the whole mechanism and there is no softer version of it.

  • ×
    Something scanned you

    A chip, a code, a badge reader, an app that wanted your location. Any of those means mission three is over, regardless of what this page says.

  • ×
    A sponsor emailed you

    And you never gave them your address. That means a list existed. There is no innocent explanation available for that one.

  • ×
    Somebody bought a slot

    At any price, under any name, including a keynote dressed as a favor to a partner.

Missed

  • ×
    The local half of the room was thin

    A great conference that mostly flew in is a different conference from the one described on this page. The count gets published either way.

  • ×
    Nobody introduced you to anybody

    You spent the day in a full room and went home having met nobody in it. Introducing people is a specific job given to everybody wearing a lanyard, so that is a specific failure rather than bad luck. Tell us and we will say so.

  • ×
    You could not act on any of it

    If nothing on the whole schedule was something you could go and try on Monday, the program was wrong, whatever the feedback forms said.

  • ×
    The books did not get published

    What came in, what went out, line by line, in a public ledger posted to as money moves rather than a write-up afterward. Silence about money is an answer, and not a good one. The commitment is here.

Hold us to it in public. That is the only enforcement mechanism that has ever worked on anybody, and it is the reason all of this is written down in advance rather than described warmly afterward. Being wrong is not the thing we are trying to avoid. Being wrong deniably is.

Section 07 · Scope

What this is not

Not a claim to have invented anything. Plenty of small conferences already work like this and have for years. That is not an awkward fact for this page, it is the evidence that the whole thing is possible, and it is why the vision above does not require us.

Not anti-vendor. Vendors employ a great many excellent people and some of them will be in the room, welcome, speaking about work they did. What this is against is a stage that can be bought and a room that can be bought access to. Those are structural problems and they are not solved by thinking better of anyone.

Not a movement. It is one conference, in one town, for a day, maybe two, run by people with day jobs. Treating it as anything larger would be the first step toward it becoming the thing it was built in response to.

Not big, and not trying to be. One room is what a first year conference can pay for by itself, and a second alongside it is the first thing sponsorship buys. Either way that is the ceiling. Growth is not on the list above and will not be added to it quietly.

Not permanent. If the mission cannot be met, the event does not happen. That is stated as a live option rather than a rhetorical flourish, and the first of the three is the one most likely to invoke it.

The specific commitments that come out of all this are posted at the trailhead, the data policy is seven principles every Colorado kid already knows, and the person whose name is on the venue contract is named, with the conflicts written out.

If the above sounds like a room you want to be in, there are two useful things you can do about it, and one of them is much more useful than the other.

Submit a talk Help run it

The more useful one is the second. A first year conference is mostly a pile of jobs nobody has claimed. Reading CFP submissions, working out food, standing up the CTF, finding a band that will play to a room of hackers on a Friday. That is where the shortage is, and it is the part that decides whether any of the rest of this page describes something real. hello@cachecon.com.