CacheCon

CacheCon

Fort Collins · Colorado · on the Cache la Poudre

The mission

Three things.
The rest is detail.

Most conference mission statements are one sentence long, mention excellence, and could be moved to a different conference without anybody noticing. Here are ours in three lines, followed by a great deal of text on what each one costs and how you will be able to tell if we are failing at it.

Section 01 · The short form

The mission, in three lines

If you only read this far, read this far.

  1. Diversity by design

    “not by hope, not by apology”

    Build a room that is not all one kind of person, on purpose, early, by hand, and treat failing at it as a reason not to hold the event rather than a paragraph in the wrap-up post.

  2. A room Northern Colorado does not have

    “the gap is the whole reason”

    Stand up a real security community sixty-five miles north of the one that already exists, for the people who have been quietly doing this work up here without ever being in the same room.

  3. Nobody here is the product

    “the real thing, and nothing taken for it”

    Actual work from the people who actually did it, given to a room that gets harvested for precisely nothing in exchange. Both halves of that are the same commitment, and the second half is what makes the first half possible.

Why three. Because a list of ten is a list of zero. These are the three we would cancel over, which is the only test of a mission statement that means anything. Everything else on this site, the regulations, the data policy, the conduct rule, the CFP, is one of these three turned into something you can check.

Section 02 · Definitions

Vision, mission, values, and why everyone mixes them up

Nobody remembers which one is which, including people who run workshops about it, and the reason is that most organizations write all four at the same offsite and end up with four paragraphs that say the same pleasant nothing. They are genuinely different things, though, and the difference is useful, so here it is in the plainest form we can manage.

Vision
The world you want. It describes an outcome, not you. A real vision does not require your organization to exist, and if yours cannot be true unless you personally pull it off, you have written a business plan and mislabeled it.
Mission
What you are doing about it. Present tense, specific, yours. The test is simple: if you could print it on a competitor’s wall and nobody would blink, it is not a mission, it is a mood.
Values
How you behave on the way there, and particularly how you behave when behaving costs you money. A value you have never once paid for is a preference. Ours are the ones we turned down revenue over, and that is not a hypothetical.
Strategy
The order you do things in, and what you have agreed to be bad at for now. Two rooms, one town, one year at a time. We are deliberately bad at scale.

So, ours

The vision. A security profession whose gatherings are built for the people sitting in them. Where being curious is the whole entry requirement. Where the crowd in the room looks something like the population it claims to defend. Where going to a conference costs you a ticket and a couple of days, and not a permanent entry in somebody’s database that outlives your interest in the subject. Note that none of that needs CacheCon. Plenty of small conferences are already most of the way there and have been for years. That is exactly what makes it a vision rather than a pitch.

The mission is narrower, because it has to be ours and it has to be doable. Run one small conference in Fort Collins that does all three of the things above at once, in public, where the commitments are written down in advance. Publish what it cost and what went wrong. Make the whole thing boringly easy to copy, so that the answer to “could you do this here” is yes, and the instructions are already on a website.

The values are not on this page, and that is deliberate. They are already published in checkable form as the park regulations and leave no trace. Those pages are the values. There is no softer-worded document behind them and no version of them that only the organizers have seen.

A value is a rule you keep when keeping it is expensive. Everything else is marketing with a nicer typeface.

Section 03 · Mission 01

Diversity by design

An all white, all male lineup is a failure condition here, not a disappointment. If that is what this turns into, it does not happen.

That sentence appears on three pages of this site, which is on purpose, because it is the only part of the mission with a kill switch attached. Not a target, not an aspiration, not something to be noted with regret in a retrospective. If the program comes together and it is one kind of person all the way down, the correct move is to not run a first year conference rather than to run one that looks exactly like all the others and promise to do better next time.

Here is the honest local context, because leaving it out would be worse. Fort Collins is a very white town, and so is most of Northern Colorado. That is a demographic fact and pretending otherwise to sound welcoming would fool nobody who has ever been here. It is also, in our experience, a genuinely accepting place, which is a different property and gets nobody off the hook. Being an accepting town is the easy half. What it means practically is that a room which is not all one kind of person has to be constructed deliberately and early, by the organizers, rather than hoped for during the CFP and apologized about afterward.

What “by design” actually means

The word matters. Most conferences treat this as a selection problem, which is the one place where it cannot be solved, because by the time submissions are in front of you the pile is already whatever it is. Selecting differently from a narrow pile just moves the unfairness around. So the work happens before anything is submitted:

  • We go and ask people directly. A submission pile does not diversify itself, and waiting for one to is a way of blaming the pile for your own inaction. This is a real, unglamorous job: making a list, writing to strangers, and being turned down a lot.
  • The first review pass is name-blind. No employer, no handle, no bio, just the abstract and the outline. Fixing the pipeline rather than the scoring is the only honest way to keep blind review, and blind review is worth keeping.
  • First-time speakers get a dry run. Weeks ahead, over video, with somebody who has done it before. A great many people who should be on a stage simply have not been on one, and that is a solvable problem rather than a quality signal.
  • Anonymity is a first-class option. Handle, no bio, no photograph. If being visible in this industry costs you something it does not cost us, then it is not much of a favor to insist you be visible.
  • Travel is a conversation, not a silent filter. If the cost of getting here is what stops you, say so in the submission. We cannot promise anything yet and we will not pretend otherwise, but we would much rather know and try than have you quietly send nothing.
  • Somebody is watching the room, not just the program. Staff, volunteers and speakers all have the same second job: spot the person standing alone and go fix it. If you came on your own, knew nobody, and went home having met nobody, we failed, and we want to be told.

What it is not

It is not a quota, because we do not have the numbers for a quota to mean anything at this size, and a quota you cannot fill honestly just turns into somebody being invited as a decoration. It is not a diversity track, because putting the topic in its own room is how you excuse the other rooms. It is not a panel about the subject in place of doing anything about it. Nobody here is going to be asked to represent a demographic on stage. You will be asked about the bug you chased and the board you glitched, same as everyone.

And it is not tolerance. The word we keep using on purpose is wanted. Women, people of color, trans and queer folks, disabled hackers, and anybody who got into this without the degree or the clearance or the job title. Actively wanted, sought out by name, and not counted afterward for a slide.

The tension we are not going to pretend away

Two things on this site pull against each other and it would be dishonest to lay them out on separate pages and hope nobody noticed. A lineup where people can be fully anonymous is a lineup nobody can audit from the outside. Add a name-blind first pass and there is no external way to verify any claim on this page at all. Both of those choices are deliberate. Here is how they fit together.

The work happens before selection, never during it. That is the whole resolution. Fix the pipeline and the blind review can stay blind, which is the only arrangement where both commitments survive intact.

Anonymity stays the speaker’s call and never the organizer’s. If you want to be visible, be visible. If you would rather not be, nobody is going to out you so the schedule looks more varied to strangers. That is using a person as a prop, which is precisely the thing this section exists to be against.

The cost of that is real and worth stating plainly: if enough people choose the handle, the published schedule may look less varied than the room genuinely is, and there will be no way to prove otherwise. We will take that trade every time. The judgment about whether this has become an all white male conference is made out of what the organizers actually know, and you have already been told what happens if the answer is yes.

Free speech, and respect for all

These are not in conflict and we are tired of the pretense that they are. You can hold any position you like here and defend it hard. There is a whole session format built around people disagreeing in front of a room. What you cannot do is go at the person instead of the idea, and the difference has never once been genuinely unclear to anybody who wanted to know it. Disagree as hard as you like. Do it to the position.

Which produces one more line that is easier to write than most people think. If any of the above sounds like something you would need to work around, this is not the conference for you, and that is fine. Do not come.

A room that is all one kind of person asks one kind of question. The people who are best at surveillance self-defense are very often the ones who needed it first.

That last point is worth dwelling on, because the case here is not only a fairness case. Threat models come out of lived experience. A room full of people who have never had reason to worry about being tracked will produce a conversation about tracking that is missing its most useful half. For a conference whose two stated subjects are privacy and hacking, a homogeneous room is not just uncomfortable, it is technically worse. We would want this even if nobody were watching.

Section 04 · Mission 02

A room Northern Colorado does not have

You can work in this field in Fort Collins for fifteen years and never once be in a room with the people doing your job four miles away.

The Front Range has a security community. It is real, it is good, and it is almost entirely in Denver and Boulder. If you live up here, participating in it means a drive down I-25 after work, an evening event, and a drive back, which adds up to most of a weeknight for an hour of conversation. Some people do it. Most people do it twice, quietly conclude that community is a thing that happens somewhere else, and stop.

Sixty-five miles is a strange distance. It is too far to be a suburb and too close to justify anybody building a second version of anything. So nobody has, and the result is a gap rather than a desert: plenty of people doing serious work, almost none of them in contact with each other.

Who is actually up here

More than outsiders assume. This corridor runs from Longmont up through Loveland, Fort Collins, Windsor, Greeley and Wellington, and keeps going to Cheyenne forty-five minutes north. In it you will find chip design offices, embedded and instrumentation shops that have been here since long before anybody called this a tech corridor, a couple of extremely large breweries with extremely real industrial control systems, food processing at a scale that would surprise you, hospital systems, school districts, municipal utilities running water and power for a quarter million people, county governments, and a land-grant university with a genuine engineering and computer science school in the middle of it.

All of that has the same security problems as anywhere else and a fraction of the staff. The person keeping a water utility upright is doing interesting and consequential work under constraints that would make a bank’s security team weep, and there is currently nowhere within an hour for them to describe it to anybody who would understand.

And then there are the students. Colorado State is twenty minutes from nearly all of the above, and the usual way a student there meets this industry is a career fair, which is a room full of recruiters and no room full of practitioners. That is a bad first impression of a field that is mostly people taking things apart out of curiosity. Students and the between-jobs get in at cost or gratis, and not as a gesture. A person who lands in a room of practitioners at twenty tends to still be here at forty.

What we are doing about it

  • Holding it here. Walking distance from Old Town is the one venue requirement that does not get compromised, because the whole point is that people can come after work and get home the same evening.
  • On a weekday. Monday, or Monday and Tuesday, or Thursday and Friday. The room is affordable then, and this is work rather than a hobby somebody should have to spend a weekend on.
  • Priced for a local paying their own way. Twenty-five dollars if it is your money. Ninety-nine if your employer is paying. That is not a discount structure, it is the actual point: nobody up here should have to justify a budget line to meet their neighbors.
  • Sending people, not booths. If you run a team here, send the humans on it. We would rather have six of your engineers in the room than your logo on a banner, and we have arranged the economics so that is the only option anyway.

The part that matters more than the conference

One conference is an event. Events are fine and they end. What we actually want out of this is a habit: people who met here running something monthly that has nothing to do with us and does not carry our name. A lockpicking night above a bar. A reversing group that meets in a library room. Three people who now text each other when something looks wrong on their network at two in the morning.

If a Northern Colorado security community comes out of this and then outlives the conference entirely, that is not a failure mode. That is the mission completed and the conference turning out to have been the excuse. We would consider that the best available outcome and we are saying so in advance so it cannot later be reframed as a loss.

If most of the room flew in, we built something interesting and we still missed.

Which is the uncomfortable measurement attached to this one. A conference that draws well from out of state is a nice problem and it is not this problem. We want people to fly in, we want the talks to be worth flying for, and if the local half of the room is thin then mission two did not happen, however good the event was. That number gets published with the rest of them.

Not competing with anybody

There are good conferences an hour south of here and you should go to them. This is not a rival operation and there is no reason for anyone to treat it as one. The gap we are filling is geographic and it exists because of a highway, not because anybody down there did anything wrong. If the Denver and Boulder crowd drives up for a day, they are extremely welcome, and several of them will probably end up doing the actual work of making this happen.

Section 05 · Mission 03

Nobody here is the product

You get the real work from the person who did it, and we take nothing from you for it beyond the price of the room and the coffee.

Those look like two separate promises and they are one. The reason the talks are bad at a CPE farm is the same reason your badge gets scanned at the door: follow the money all the way down and nobody in the chain is paid on whether you learned anything. Hours in a seat are the billable unit, badge scans are the sponsor deliverable, and the content is whatever fills the gap between them. Remove the harvest and the incentive to fill a room with slides quietly disappears, because there is no longer anything to fill it for. The whole case is written out here and it is the post this conference came from.

The taking-nothing half

Stated as things rather than principles, because principles are cheap:

  • The badge is paper. No chip, no barcode, no QR. Nobody can scan you because there is nothing on you to scan, and that single decision removes the entire economic reason the rest of the machinery exists.
  • There is no list. Somebody has to print badges, so of course we know who registered. What does not exist is a list that gets kept, enriched, rented, sold or handed to a sponsor. Registration data is held one year, for late CPE claims, and then it is gone.
  • Sponsors buy a table, not you. They are told so in writing before they are allowed to pay. If a sponsor wants your email they will have to talk to you like a person and earn it.
  • No slot is for sale. Not a keynote, not a track, not a partner session with a thin coat of paint on it.
  • There is no app. The schedule is a web page and a sheet of paper. Neither one needs your location, your contacts or a push token.
  • This website phones nobody. Static HTML on a box we run. No analytics, no tag manager, no CDN, no embeds, and the fonts are served from this domain because loading them from Google would hand your address to Google on every page view, which rather gives the game away.

The giving-you-the-real-thing half

Take the harvest out and what is left has to actually be good, which is the pleasant part of the trade. What we ask for is work somebody did with their hands: a bug chased, a protocol read until it gave up, a board glitched, a sample pulled apart, a detection pipeline built, a surveillance system measured rather than speculated about. Including the three months where it did not work. Especially that part.

Nobody speaks as a company. Be fully anonymous, use a handle, or put your own face and bio on it. All three are supported and none is the default. The one thing nobody is up there as is a brand, and a stage with no logos on it turns out not to be worth buying, which does more for a program’s honesty than any disclosure slide ever has.

Nothing is gated. No advanced-only track, no prerequisite, nobody checking your credentials at a door. If a talk goes over your head that is the speaker’s problem to solve, not yours. Hacker here means curious, not employed.

And the fifteen minutes after every talk are on the schedule rather than squeezed into the gap, because that is where the actual thing happens: the follow-up question, the disagreement that turns into somebody opening a laptop, the conversation that was the reason to be in a room instead of watching a recording. Speakers are expected to still be there for it, and to want to be.

None of this is difficult. It is just unprofitable, which is a different problem, and one we would much rather have.

You still get your CPEs

Signed certificate at the door, no chasing anybody for it afterward. People need the hours, and being sniffy about that just sends somebody off to buy them somewhere worse. We hand them out and then stop thinking about them, because nothing on the schedule is built out of seat time.

Section 06 · Accountability

How you will know we failed

A mission with no failure condition is a slogan. These are checkable by you, from outside, without taking anybody’s word for anything. If one of them happens, say so in public, and we will have deserved it.

Fatal

  • ×
    The lineup is all one kind of person

    Then it does not run. That is the whole mechanism and there is no softer version of it.

  • ×
    Something scanned you

    A chip, a code, a badge reader, an app that wanted your location. Any of those means mission three is over, regardless of what this page says.

  • ×
    A sponsor emailed you

    And you never gave them your address. That means a list existed. There is no innocent explanation available for that one.

  • ×
    Somebody bought a slot

    At any price, under any name, including a keynote dressed as a favor to a partner.

Missed

  • ×
    The local half of the room was thin

    A great conference that mostly flew in is a different conference from the one described on this page. The count gets published either way.

  • ×
    You came alone and left alone

    Nobody introduced you to anybody all day. That is a specific job we have given to every person wearing a lanyard, so it is a specific failure. Tell us and we will say so.

  • ×
    You could not act on any of it

    If nothing in two rooms of talks was something you could go and try on Monday, the program was wrong, whatever the feedback forms said.

  • ×
    The books did not get published

    What came in, what went out, line by line, after the event. Silence about money is an answer, and not a good one. The commitment is here.

Hold us to it in public. That is the only enforcement mechanism that has ever worked on anybody, and it is the reason all of this is written down in advance rather than described warmly afterward. Being wrong is not the thing we are trying to avoid. Being wrong deniably is.

Section 07 · Scope

What this is not

Not a claim to have invented anything. Plenty of small conferences already work like this and have for years. That is not an awkward fact for this page, it is the evidence that the whole thing is possible, and it is why the vision above does not require us.

Not anti-vendor. Vendors employ a great many excellent people and some of them will be in the room, welcome, speaking about work they did. What this is against is a stage that can be bought and a room that can be bought access to. Those are structural problems and they are not solved by thinking better of anyone.

Not a movement. It is one conference, in one town, for one or two days, run by people with day jobs. Treating it as anything larger would be the first step toward it becoming the thing it was built in response to.

Not big, and not trying to be. Two rooms is what can be done well in year one, so two rooms is what happens. Growth is not on the list above and will not be added to it quietly.

Not permanent. If the mission cannot be met, the event does not happen. That is stated as a live option rather than a rhetorical flourish, and the first of the three is the one most likely to invoke it.

The specific commitments that come out of all this are posted at the trailhead, the data policy is seven principles every Colorado kid already knows, and the person whose name is on the venue contract is named, with the conflicts written out.

If the above sounds like a room you want to be in, there are two useful things you can do about it, and one of them is much more useful than the other.

Submit a talk Help run it

The more useful one is the second. A first year conference is mostly a pile of jobs nobody has claimed. Reading CFP submissions, chasing a venue, standing up the CTF, finding a band that will play to a room of hackers on a Tuesday. That is where the shortage is, and it is the part that decides whether any of the rest of this page describes something real. hello@cachecon.com.