I recently had a couple of students (and former students, and colleagues) ask me if I was attending any of a set of upcoming cons (non-academic/organizational conferences) in the general area of cyber security. That includes everything from the more highly polished Black Hat and DefCon events, to Bsides events, DerbyCon, Circle City Con, et al. (I don’t include the annual RSA Conference in that list, however.)

25 years ago there were some as the field was starting up that I attended. One could argue that some of the early RAID and SANS conferences fit this category, as did some of the National Computer Security Conferences. I even helped organize some of those events, including the 2nd RAID workshop! But that was a long time ago. I don’t attend cons now, and haven’t for decades. There are two main reasons for that.

First, is finances. Some of the events are quite expensive to attend — travel, housing, and registration all cost money. As an academic faculty member, and especially as one at a state university, I don’t have a business account covering things like these as an expense item. Basically, I would have to pay everything out of pocket, and that isn’t something I can afford to do on a regular (or even sporadic) basis. I manage to scrape up enough to attend the main RSA conference each year, but that is it.

Yes, faculty do sometimes have some funds for conferences. When we have grants from agencies such as NSF or DARPA, they often include travel funds, but usually we target those for places where the publication of our research (and that of our students) gives the most academic credit — IEEE & ACM events, for instance. Sometimes donors will provide some gifts to the university for us to use on things not covered by grants, including travel. And some faculty have made money by spinning off companies and patenting their inventions, so they can use that.

None of that describes my situation. Over the last 20 years I have devoted most of my efforts at raising (and spending) funds towards the COAST lab and then CERIAS. When I have had funding for conferences, I have usually spent it on my students, first, to allow them to get the professional exposure. There is seldom money left over for me to attend anything. I show up at a few events because I’m invited to speak and the hosts cover the expenses. The few things I’ve invented I’ve mostly put out in the public domain. I suppose it would be great if some donor provided a pot of money to the university for me to use, but I’ve gotten in the habit of spending what I have on junior colleagues and students so I’m not sure what I’d do with it!

There is also the issue of time. I have finite time (and it seems more compressed as I get older) and there are only so many trips I have time (and energy) to make, even if I could afford more. Several times over the last few years I’ve hit that limit, as I’ve traveled for CERIAS, for ACM, and for some form of advising, back to back to back.

Second, I’m not sure I’d learn much useful at most cons. I’ve been working (research, teaching, advising) in security and privacy for 30 years. I think I have a pretty good handle on the fundamentals, and many of the nuances. Most cons present either introductions for newbies, or demonstrations of hacks into existing systems. I don’t need the intros, and the hacks are not at all surprising. There is some great applications engineering work being done by the people involved, but unlike some people, I don’t need to see an explicit demonstration to understand the weaknesses in supply chains, poor authentication, lack of separation, no root of trust, and all the other problems that underlie those hacks. I eventually hear about the presentations after the fact when they get into the news; I can’t recall hearing about any that really surprised me for quite some time now.

I wish leaders in government and business didn’t need to be continually bashed with demonstrations to begin to get the same points about good security, but I’ve been trying to explain these issues for nearly my whole career, and they simply don’t seem to listen after “This will cost more than you are currently spending.” If anything, attending con events simply points out that the message I’ve been trying to convey for so long has not been heard; rather than instructive, cons might well be rather depressing for me.

There’s obviously also a social element to these events — including the more academic and professional conferences — that I am clearly missing out on. I do have a little regret over that. I don’t get to meet some of the young up-and-coming people in the field, on either the research or applied ends of things. I also don’t get to see some of people I already know as often as I wish I did. However, that gets back to cost and time. And I don’t think too many people have noticed the difference or bemoaned a loss because I wasn’t there, especially as I have gotten older. The current crop of practitioners are all excited by learning the most recent variation on a theme — someone who points out that it is all material we could have predicted (and prevented) isn’t going to fit in. Frankly, I was surprised to hear there was any interest in Jack Daniel’s “Shoulders of Infosec” project by some of the con crowd!

So, do I hate cons? No, not at all! If colleagues or students find them of value and they have the time and resources to attend, then they should go…but they aren’t likely to see me attending.