What the Slides Didn’t Show at BSides
BSides, the community-run counterpoint to Black Hat, opens with a live DJ, fresh coffee at 9 AM, and a room that’s actually pleasant. No QR code badges hanging from lanyards, no name tags plastered across chests. The people in the main hall don’t need ear plugs, like the show floor at Mandalay Bay. You can hear people talking. That difference matters more than you’d think.
Opening Remarks Draw Lines
The opening keynote speaker called Meta’s surveillance hardware pervert glasses. The crowd nodded. There’s a strict no-photo policy unless everyone in the frame gives explicit consent. This is the same industry that treats your data as fuel everywhere else, and at BSides, they’re drawing a line.
The Car That Talked Back
Alissa Knight walked onto the stage in Gadi Evron’s “[un]prompted” track and demonstrated an over-the-air exploit using an AI system called Reaper. In her live demo, police-car APIs were wide open. She showed how object-level authorization breaks across multiple automakers. If you know a vehicle’s VIN, you can remotely manage that car. Auto-increment the VIN sequence and you can reach the entire fleet. Law enforcement buys vehicles in bulk, which puts them squarely in the target zone.
Knight also gendered the AI. This was a small, weird detail in a presentation about serious security failure that stuck with me more than I expected. We build machines, then give them pronouns, then wonder why trust becomes complicated.
The Interview Loop
Later at Hire Ground, a recruiter offered a complimentary resume review. Towards the end of our conversation, I learned that she worked for a company that had rejected me after six weeks of interviews. Her boss had led the original hiring process. Small world. The advice was solid: move the skills section up, keep it to one page. This was useful advice compared to many of the “free” resume reviews that are just sales pitches on LinkedIn.
Seven Speakers, One Problem
I’d volunteered as a mentor at BSides, so my afternoon was three hours watching new speakers rehearse for Proving Ground. Seven presentations, and the pattern was undeniable.
| Issue | Frequency | Impact |
|---|---|---|
| Fonts too small | 6 of 7 speakers | Unreadable from back of room |
| Reading bullets verbatim | 5 of 7 speakers | Audience disengagement |
| Finished under time | 4 of 7 speakers | 17 minutes instead of 25 |
| Talking to slides | 4 of 7 speakers | Lost eye contact |
| Projector failure | 1 session | Speaker continued anyway |
As the table shows, the most common issue was that six of seven presentations had text that wasn’t readable from the back of the room (or sometimes, the middle). One presenter kept going when two slides went black, never breaking rhythm. That’s heroic for someone who’d never stood in front of that large of a crowd before.
Another speaker apologized for his own slides mid-presentation because the terminal output during his demo was unreadable. Text so dense on the screen it became wallpaper. Someone else talked to their laptop for twelve minutes straight while the audience took the time to check their phones.
The gap between expertise and communication is measurable; technical depth means nothing if the room can’t absorb it. Earlier, Knight’s car exploit landed because she told a story. Half these new speakers had stronger content buried under formatting failures.
The Dinner Menu Didn’t Work
My first dinner party was at KUMI, a crowded Japanese restaurant. I have a fish allergy so the menu didn’t work for me. Got a couple chicken skewers and something like guacamole rice and called it dinner. The queue for custom-engraved sunglasses stretched longer than the line for Ray-Bans at a mall kiosk, so I passed. However, I did bump into the fantastic Mel Reyes and said a brief “hello,” as he was hurrying to a work-related event.
House Party Economics
At the CSides house party twenty minutes off the strip, the economic anxiety was partially visible. The consensus at the party was that cyber insurance costs are dropping, because proving harm to an individual from a data breach is nearly impossible when almost every company has been compromised. CISOs in consulting said business got harder this year, with customers pushing back on hourly billing and demanding outcome-based pricing instead. A CISO I might have met once before told me his story of six months of unemployment. Another promised to help find opportunities; his business was doing well.
Most of the group played CISO Jeopardy instead of poker, because apparently it’s hard to get cards and chips in Vegas. By the time I left a couple hours later, the poker chips were arriving.
Funding and Ghosting
Queercon closed the night. One of my favorite conversations (which are tough during a dance party) was a founder explaining that venture capitalists ghosted him worse than any Grindr date in NYC. He’s building a social protection app for marginalized communities, but funding stays elusive. The parallel wasn’t lost on me and the small group listening in.
What This All Means
The day mapped the security industry in eighteen hours:
- Technical capability on display during Knight’s demo
- Communication failure repeated seven times during Proving Ground
- Economic precariousness in nearly every conversation at the house party
- Community warmth in the no-badge policy and photo consent rules
- Career coldness in the hiring rejection loop and funding drought
Slide readability might be a proxy for everything else; if you can’t make your content legible, nobody accesses the knowledge underneath. Resumes sit ignored. The breach-economics argument I heard at the party gets dismissed the same way. Funding disappears when founders can’t translate their vision into numbers.
Technical experts keep building better tools, while business leaders keep treating risk as someone else’s problem. The people caught in the middle, the speakers and consultants and CISOs searching for work, are the ones paying the price.
However, BSides proves that community can exist without extraction. The venue itself rejects surveillance culture, but the job market outside those walls treats your time and talent as raw material to be consumed or performative content to be created.
Communication isn’t decoration. It’s the infrastructure. If the slide fails, the message dies. If the resume fails, the interview ends. If the pitch fails, funding evaporates. Same principle, different stakes.
The car hack demonstration will probably age well. Object-level authorization gaps don’t disappear after one conference talk. Neither do hiring practices that reject qualified candidates after investing weeks in evaluation. Both are vulnerabilities. One gets patched eventually; the other keeps running until something forces change.
I left with a clear sense of where the industry stands. Brilliant technical minds producing work that’s not accessible enough. Experienced professionals working through job markets that treat talent as disposable. Communities trying to protect privacy while operating in an economy that monetizes exposure.
The gap between what we can do and what we can communicate keeps widening. BSides made that visible, and whether something fixes it depends on how the technical community communicates with venture capitalists, private equity, CFOs, and other business leaders once the conference ends.
