[NDCOslo2024] Mirror, Mirror: LLMs and the Illusion of Humanity – Jodie Burchell
In the mesmerizing mirror maze of machine mimicry, where words weave worlds indistinguishable from wit, Jodie Burchell, JetBrains’ data science developer advocate, shatters the spell of sentience in large language models (LLMs). A PhD psychologist turned NLP pioneer, Jodie probes the psychological ploys that propel projections of personhood onto probabilistic parsers, dissecting claims from consciousness to cognition. Her inquiry, anchored in academia and augmented by anecdotes, advises acuity: LLMs as linguistic lenses, not living likenesses, harnessing their heft while heeding hallucinations.
Jodie greets with gratitude for her gritty slot, her hipster cred in pre-prompt NLP notwithstanding. LLMs’ 2022 blaze beguiles: why bestow brains on bytes when other oracles oblige? Her hypothesis: humanity’s hall of mirrors, where models mirror our mores, eliciting empathy from echoes.
Psychological Projections: Perceiving Personhood in Parsers
Humans, Jodie hazards, hallucinate humanity: anthropomorphism’s ancient artifice, from pets to puppets. LLMs lure with language’s liquidity—coherent confessions conjure companionship. She cites stochastic parrots: parleying patterns, not pondering profundities, yet plausibility persuades.
Extraordinary assertions abound: Blake Lemoine’s LaMDA “alive,” Google’s Gemini “godhead.” Jodie juxtaposes: sentience’s scaffold—selfhood, suffering—sans in silicon. Chalmers’ conundrum: consciousness connotes qualia, quanta qualms quell in qubits.
Levels of Luminescence: From Language to Luminary
DeepMind’s AGI arc: Level 1 chatbots converse convincingly; Level 2 reasons reactively; Level 3 innovates imaginatively. LLMs linger at 1-2, lacking Level 4’s abstraction or 5’s autonomy. Jodie jests: jackdaws in jester’s garb, juggling jargon sans judgment.
Illusions intensify: theory of mind’s mirage, where models “infer” intents from inferences. Yet, benchmarks belie: ARC’s abstraction stumps, BIG-bench’s breadth baffles—brilliance brittle beyond basics.
Perils of Projection: Phishing and Philosophical Pitfalls
Prompt injections prey: upstream overrides oust origins, birthing bogus bounties—”Amazon voucher via arcane URL.” Jodie demonstrates: innocuous inquiries infected, innocuousness inverted into inducements. Robustness rankles: rebuttals rebuffed, ruses reiterated.
Her remedy: recognize reflections—lossy compressions of lore, not luminous lives. Demystify to deploy: distill data, detect delusions, design defensively.
Dispelling the Delusion: Harnessing Heuristics Humanely
Jodie’s jeremiad: myths mislead, magnifying misuses—overreach in oracles, oversight in safeguards. Her horizon: LLMs as lucid lenses, amplifying analysis while acknowledging artifice.
Links:
[DefCon32] Compromising Electronic Logger & Creating Truck2Truck Worm
Jake Jepson and Rik Chatterjee, systems engineering master’s students at Colorado State University, present a compelling investigation into the cybersecurity risks of Electronic Logging Devices (ELDs) in the trucking industry. Their session at DEF CON 32 exposes critical vulnerabilities in these mandated devices, demonstrating the potential for remote exploits and a wormable attack that could propagate across truck networks. Jake and Rik’s research underscores the urgent need for standardized security protocols in an industry pivotal to global supply chains.
Uncovering ELD Vulnerabilities
Jake opens by highlighting the role of ELDs in ensuring compliance with Hours of Service regulations, yet notes their susceptibility to cyber-physical attacks due to inadequate security measures. Working at Colorado State University, Jake and Rik reverse-engineered commercially available ELDs, identifying insecure defaults and poor security practices. Their findings reveal how attackers could exploit these weaknesses to gain unauthorized control over truck systems, posing significant risks to safety and logistics.
Developing a Truck2Truck Worm
Rik details their proof-of-concept attack, which leverages wireless communication vulnerabilities in ELDs. Using tools like Ghidra for firmware reverse-engineering and network scanners, they developed a worm capable of spreading via over-the-air updates, exploiting default credentials. Rik explains how trucks’ proximity at rest stops or distribution hubs, combined with always-on diagnostic ports, creates ideal conditions for a worm to propagate, potentially affecting entire fleets within a 120-foot range in dense environments.
Coordinated Disclosure and Industry Impact
Jake shares their responsible disclosure process, including his first CVE, which prompted a swift response from manufacturer IO6, who issued a patch. However, Jake emphasizes that the root issue lies in government-mandated, self-certified devices lacking rigorous security standards. Their work highlights systemic flaws in ELD certification, urging regulators to prioritize cybersecurity to prevent large-scale disruptions in the trucking industry.
Links:
[AWSReInventPartnerSessions2024] Advancing Cloud Security Proficiency through Unified CNAPP Frameworks: A Structured Maturity Pathway
Lecturer
Leor Hasson functions as Director of Cloud Security Advocacy at Tenable, where he directs initiatives promoting exposure management via integrated platforms that consolidate visibility and remediation across diverse environments.
Abstract
This rigorous academic treatment explores the conceptual evolution and operational implementation of cloud-native application protection platforms (CNAPP), positioning them as sophisticated syntheses transcending fragmented tools like CSPM, CWPP, CIEM, and DSPM. The analysis delineates emergent security challenges within cloud ecosystems—novel attack surfaces, expertise scarcity, tool proliferation, and intensified cross-functional collaboration—while highlighting concomitant opportunities derived from programmatic accessibility. A meticulously articulated ten-phase iterative progression guides practitioners from foundational inventory compilation to sophisticated automated remediation, emphasizing contextual risk prioritization and hybrid infrastructure correlation through Tenable One.
Contextual Challenges and Emergent Opportunities in Cloud Security Posture
The advent of cloud computing has introduced transformative paradigms accompanied by distinct protective imperatives. Compared to traditional on-premises infrastructures, cloud environments manifest expanded attack vectors, a relative paucity of seasoned practitioners given the technology’s recency, an overwhelming array of specialized instruments lacking cohesive strategy, and significantly amplified requirements for interdepartmental cooperation. These dynamics collectively complicate systematic defense.
Concurrently, cloud paradigms afford unprecedented advantages: configurations and telemetry become programmatically accessible in structured formats, enabling automation at scale. Moreover, broadened access democratizes responsibility, permitting operational teams to assume ownership of their security obligations—an approach that, while introducing management complexity, harbors substantial potential for distributed resilience.
CNAPP architectures address these dualities by furnishing unified observational planes encompassing workloads, underlying infrastructure, identity entitlements, network topologies, and sensitive data classifications. Tenable Cloud Security exemplifies this integration, ingesting telemetry from native AWS accounts, multi-cloud deployments, identity providers, continuous integration pipelines, and ancillary third-party systems to orchestrate comprehensive risk governance.
Iterative Ten-Phase Maturity Progression for CNAPP Implementation
Framed metaphorically as “ten steps” to underscore non-linearity and iterative refinement, this progression structures organizational advancement:
Initial phases establish asset inventory discovery, revealing the operational landscape and preempting blind spots that adversaries exploit. Subsequent risk exposure assessment introduces contextual evaluation—distinguishing, for instance, publicly exposed S3 buckets containing personally identifiable information from equivalently configured but isolated resources. Remediation orchestration follows, translating insights into executable corrections.
Advanced stages encompass identity least-privilege enforcement, identifying excessively permissive policies or dormant credentials; network segmentation visualization, graphing potential exposure pathways; sensitive data classification, cataloging regulated information; vulnerability prioritization, correlating exploitability with internet-facing status; infrastructure-as-code security scanning, examining Terraform modules both in isolation and upon instantiation where parameters may introduce vulnerabilities; malicious code detection, flagging external data blocks capable of unauthorized execution during planning phases; and automated response integration, progressing from manual ticketing to conditional webhooks executing predefined resolutions when confidence thresholds are satisfied.
module "high_risk_storage" {
source = "./modules/secure_s3"
bucket_acl = "public-read-write" # Instantiation parameter triggers CNAPP alert
encryption_enabled = false
}
Maturity escalation reflects organizational confidence: rudimentary manual interventions evolve into sophisticated automation conditioned upon verified criteria. Tenable One amplifies this trajectory by amalgamating cloud-derived intelligence with endpoint vulnerability management, constructing end-to-end attack path visualizations—from developer workstations harboring pilfered access keys to the sensitive datasets those credentials could compromise.
Strategic Ramifications and Organizational Implications of CNAPP Adoption
Contextual intelligence emerges as the paramount differentiator, enabling precise allocation of defensive resources to threats possessing material impact. Hybrid visibility across cloud and on-premises domains mitigates lateral movement risks, while automated remediation compresses mean-time-to-resolution.
Broader organizational consequences include accelerated security posture maturation, optimized resource utilization through noise reduction, and enhanced regulatory compliance via auditable contextual evidence. The framework’s iterative nature accommodates evolving threat landscapes, positioning CNAPP not merely as a toolset but as an adaptive governance philosophy.
Links:
[KCDUK2024] The Joy of DevEx: Tightening Developer Feedback Loops in Kubernetes | Matthew Revell-Gordon
At KCDUK2024, Matthew Revell-Gordon, a senior platform engineering consultant at OpenCredo, shared an engaging exploration of how to enhance the developer experience (DevEx) by tightening feedback loops in Kubernetes. His talk addressed the challenges of local testing for cloud-native applications, offering practical solutions to align local Kubernetes environments with cloud deployments. By leveraging tools like Colima, KIND, and MetalLB, Matthew demonstrated how to create a robust local setup that mirrors production, fostering faster development cycles and a more joyful DevEx.
Challenges of Local Testing in Cloud-Native Environments
Cloud-native technologies like Kubernetes are designed to thrive in distributed, scalable cloud environments, which poses a significant hurdle for local testing. Matthew highlighted that while unit tests and linting are straightforward on a laptop, integration testing and infrastructure configuration validation are far more complex. Laptops lack the scale and fidelity of cloud environments, leading developers to rely heavily on cloud-based testing. This approach, however, introduces lengthy feedback loops, as CI/CD pipelines can take time to queue, bootstrap, and execute—often failing due to trivial errors like typos that could have been caught earlier.
Matthew recounted a real-world scenario where developers used Docker Compose for local testing, only to encounter issues when deploying to Kubernetes due to untested Ingress controller changes. This mismatch delayed releases and frustrated teams, underscoring the need for a local environment that closely emulates production. He emphasized that while cloud testing is inevitable, optimizing local setups can significantly reduce cycle times, catching errors before they reach costly cloud pipelines.
Crafting a Production-Like Local Kubernetes Setup
To address these challenges, Matthew proposed a solution centered on Colima, KIND, and MetalLB to create a local Kubernetes cluster that mirrors cloud deployments. Colima, a lightweight alternative to Docker Desktop, provides a configurable Linux-based virtual machine, allowing developers to fine-tune their environment. KIND (Kubernetes IN Docker) enables multi-node, high-availability clusters with precise control over Kubernetes versions, ensuring consistency with production. MetalLB replaces cloud-specific load balancer controllers, provisioning external IP addresses for local services.
In a live demo, Matthew provisioned a multi-node Kubernetes cluster using KIND, deploying a simple application with node affinity and a load balancer service accessible directly from his Mac. He addressed networking challenges by configuring routes and IP tables, ensuring seamless connectivity between the host, Colima VM, and KIND network. This setup, while not identical to a cloud environment, offers a close approximation, enabling developers to test complex configurations like node affinity and rollouts locally. Matthew also recommended automating these setups with scripts, making them accessible to developers who may not be infrastructure experts, thus enhancing team efficiency.
Enhancing DevEx Through Automation and Community
The true joy of DevEx, Matthew argued, lies in empowering developers to focus on coding rather than wrestling with infrastructure. By packaging local Kubernetes setups into one-click scripts, platform engineers can democratize access to production-like environments, reducing friction and boosting productivity. He cautioned against anti-patterns like creating local-only manifests or altering production setups for testing, as these diverge from the goal of fidelity. Instead, he advocated an iterative approach, starting with the most pressing pain points and gradually refining the local environment.
Matthew’s passion for community resonated throughout his talk. He encouraged platform engineers to share their tooling and scripts, fostering collaboration and easing the burden on developers. By tightening feedback loops, these solutions not only save time and costs but also cultivate a sense of joy in the development process, aligning with the broader ethos of KCDUK2024’s focus on community-driven innovation.
Links:
[DotAI2024] DotAI 2024: Merve Noyan – Mastering Open-Source AI for Sovereign Application Autonomy
Merve Noyan, Machine Learning Advocate Engineer at Hugging Face and a Google Developer Expert in vision, navigated the nebula of communal cognition at DotAI 2024. As a graduate researcher pioneering zero-shot vistas, Noyan demystifies multimodal marvels, rendering leviathans lithe for legions. Her odyssey exhorted eschewing enclosures for ecosystems: scouting sentinels, appraising aptitudes, provisioning prowess—yielding yokes unyoked from vendor vicissitudes, where governance gleams and evolutions endure.
Scouting and Scrutinizing Sentinels in the Open Expanse
Noyan decried data’s dominion: proprietary priors propel pinnacles, yet communal curations crest through ceaseless confluence—synthetics and scaling supplanting size’s supremacy. Open-source’s oracle: outpacing oracles, birthing bespoke brains across canons—textual tapestries to visual vignettes.
Hugging Face’s haven: model menageries, metrics manifold—perplexity probes, benchmark bastions like GLUE’s gauntlet or VQA’s vista. Noyan navigated novices: leaderboard luminaries as lodestars, yet litmus via locales—domain devotion via downstream drills.
Evaluation’s edifice: evince efficacy through ensembles—zero-shot zephyrs, fine-tune forays—discerning drifts in dialects or drifts in depictions.
Provisioning and Polishing for Persistent Potency
Serving’s sacrament: Text Generation Inference’s torrent—optimized oracles on off-the-shelf oracles—or vLLM’s velocity for voluminous ventures. Noyan’s nexus: LoRA’s legerdemain, ligating leviathans to locales sans surfeit.
TRL’s tapestry: supervised scaffolds, preference polishes—DPO’s dialectical dances aligning aptitudes. Quantization’s quartet—Quanto’s quanta, BitsAndBytes’ bits—bisecting burdens, Optimum’s optimizations orchestrating outflows.
Noyan’s nexus: interoperability’s imperative—transformers’ tendrils twining TRL, birthing bespoke ballets. She summoned synergy: Hugging Face’s helix, where harbors host horizons—fine-tunes as fulcrums, fusions as futures.
In invocation, Noyan ignited: “Let’s build together”—a clarion for coders charting communal conquests, where open-source ordains originality unbound.
Links:
[OxidizeConf2024] The Wonderful World of Rust Tooling
Transitioning to Rust’s Ecosystem
The Rust programming language is renowned for its memory safety and performance, but its tooling ecosystem is equally transformative, particularly for developers transitioning from other platforms. James McNally, an independent software consultant, shared his journey from LabVIEW to Rust at OxidizeConf2024, highlighting how Rust’s tools enable reliable and performant industrial measurement systems. With a decade of experience in custom systems for scientists and engineers, James emphasized the productivity and flexibility of Rust’s tooling, drawing parallels to LabVIEW’s integrated environment.
LabVIEW, a visual programming language since the 1980s, offered James a single tool for desktop, real-time controllers, and FPGA development, with built-in UI capabilities. However, its limitations in modern software engineering tools prompted him to explore Rust. Rust’s ecosystem, including Cargo, Clippy, and Criterion, provided a cohesive environment that mirrored LabVIEW’s productivity while addressing its gaps. James’s transition underscores Rust’s appeal for solo developers needing to deliver high-quality systems with limited resources.
Building Robust CI Pipelines
A key focus of James’s presentation was his standard continuous integration (CI) pipeline for client projects. Using Cargo, Rust’s package manager, he automates building, testing, and formatting, ensuring consistent code quality. Clippy, Rust’s linter, plays a pivotal role by enforcing strict coding standards and preventing panics through targeted lints. James demonstrated how Clippy’s checks catch potential errors early, enhancing reliability in measurement systems where precision is critical.
For performance optimization, James relies on Criterion, a benchmarking tool that provides detailed performance metrics. This is particularly valuable for industrial applications, such as a concrete testing system for a university, where performance directly impacts data accuracy. By integrating these tools into CI pipelines, James ensures that his systems meet client requirements for reliability and efficiency, reducing the need for external dependencies and simplifying project management.
Community-Driven Tooling Enhancements
Rust’s open-source community is a driving force behind its tooling ecosystem, and James highlighted tools like cargo-deny for license checking and vulnerability alerting. He acknowledged challenges, such as false positives in large workspaces, but praised tools like cargo-tree for dependency analysis, which helps identify unused dependencies and resolve security issues. These tools empower developers to maintain secure and compliant codebases, a critical consideration for industrial applications.
James also addressed the potential for visual programming in Rust, noting that while LabVIEW’s visual paradigm is effective, text-based languages like Rust benefit from broader community support. Future enhancements, such as improved security tools like semgrep, could further streamline Rust development. By sharing his practical approach, James inspires developers to leverage Rust’s tooling for diverse applications, from one-off test systems to commercialized particle detectors.
Links:
[DefCon32] Prime Cuts from Hacker History: 40 Years of 31337
Deth Veggie, Minister of Propaganda for the Cult of the Dead Cow (cDc), leads a nostalgic panel celebrating 40 years of hacker culture, joined by members of cDc, Legion of Doom, 2600 Magazine, Phrack, and r00t. Moderated by Professor Walter Scheirer from the University of Notre Dame, the session traces the origins of the computer underground in 1984, a pivotal year marked by the rise of personal computers and modems. Through vivid storytelling and audience engagement, the panelists reflect on the rebellious spirit, technical curiosity, and community that defined early hacking, offering insights for inspiring the next generation.
The Birth of Hacker Culture
Deth Veggie sets the stage, recounting the founding of cDc in 1984 in a Texas slaughterhouse adorned with heavy metal posters and a cow skull. This era saw the convergence of disaffected youth, empowered by personal computers and modems, forming groups like Legion of Doom and launching 2600 Magazine. The panelists share how their fascination with technology and rebellion against societal norms fueled the creation of a vibrant subculture, where Bulletin Board Systems (BBSes) became hubs for knowledge exchange.
The Rise of T-Files and Phrack
The panel explores the explosion of written hacker culture in 1985 with the advent of Phrack Magazine and text files (t-files), which became the currency of elite hackers. Panelists from Phrack and 2600 recount how these publications democratized technical knowledge, from phone phreaking to early computer exploits. Their stories highlight the thrill of discovery and the camaraderie of sharing hard-earned insights, shaping a community driven by curiosity and defiance.
Navigating the Underground
Reflecting on their experiences, the panelists discuss navigating the computer underground, from dial-up BBSes to illicit explorations of early networks. Members of Legion of Doom and r00t share anecdotes of creative problem-solving and the ethical dilemmas of their actions. These narratives reveal a culture where technical prowess and a desire to challenge authority coexisted, laying the groundwork for modern cybersecurity practices.
Engaging the Next Generation
Responding to audience questions, the panel addresses how to inspire today’s youth to engage with technology creatively. Deth Veggie suggests encouraging hands-on exploration through hacker spaces, maker spaces, and vintage computer festivals, where kids can tinker with old cameras and computers. The panelists emphasize finding role models who ignite passion, citing their own experiences looking up to peers on stage. They advocate fostering an active search for knowledge, akin to the BBS era, to cultivate emotional and intellectual investment in tech.
Preserving the Hacker Spirit
The panel concludes by urging the community to preserve the hacker spirit through mentorship and open knowledge sharing. Walter Scheirer’s moderation highlights the importance of documenting this history, as seen in cDc’s archives and 2600’s ongoing publications. The panelists call for nurturing curiosity in young hackers, ensuring the legacy of 1984’s rebellious innovators continues to inspire transformative contributions to technology.
Links:
[DefCon32] Clash, Burn, and Exploit: Manipulate Filters to Pwn kernelCTF
Kuan-Ting Chen, known as HexRabbit, a security researcher at DEVCORE and member of the Balsn CTF team, delivers a riveting exploration of Linux kernel vulnerabilities in the nftables subsystem. His presentation at DEF CON 32 unveils three novel vulnerabilities discovered through meticulous analysis of the nftables codebase, a critical component for packet filtering in the Linux kernel. Kuan-Ting’s journey, marked by intense competition and dramatic setbacks in Google’s kernelCTF bug bounty program, culminates in a successful exploit, earning him his first Google VRP bounty. His narrative weaves technical depth with the emotional highs and lows of vulnerability research, offering a masterclass in kernel exploitation.
Understanding nftables Internals
Kuan-Ting begins by demystifying nftables, the successor to iptables, which manages packet filtering and network-related functionalities in the Linux kernel. He explains how features like batch commits, anonymous chains, and asynchronous garbage collection, designed to enhance efficiency, have inadvertently increased complexity, making nftables a prime target for attackers. His introduction provides a clear foundation, enabling attendees to grasp the intricate mechanisms that underpin his vulnerability discoveries.
Uncovering Novel Vulnerabilities
Delving into the technical core, Kuan-Ting dissects three nftables vulnerabilities, two of which exploited challenging race conditions to capture the kernelCTF flag. He details how structural changes in the nftables codebase, often introduced by security patches, can unintentionally create new flaws. For instance, one vulnerability, identified as CVE-2024-26925, stemmed from improper input sanitization, enabling a double-free exploit. His methodical approach, combining code auditing with creative exploitation techniques like Dirty Pagedirectory, achieved a 93–99% success rate across hardened kernel instances, including Ubuntu and Debian.
The kernelCTF Roller-Coaster
Kuan-Ting’s narrative shines as he recounts the emotional and competitive challenges of the kernelCTF program. He describes a series of near-misses: an initial exploit collided with another submission, a second was rendered unusable due to a configuration error, and a third lost a submission race by mere seconds. The turning point came when a competitor’s disqualification allowed Kuan-Ting to secure the bounty just before Google disabled nftables in the LTS instance on April 1, 2024. This gripping tale underscores the persistence required in high-stakes vulnerability research.
Lessons for Kernel Security
Concluding, Kuan-Ting reflects on the broader implications of his findings. He advocates for rigorous code auditing to complement automated fuzzing, as subtle logic errors can lead to potent exploits. His work, detailed in resources like the Google Security Research repository, encourages researchers to explore novel exploitation techniques while urging kernel maintainers to strengthen nftables’ defenses. Kuan-Ting’s success inspires the cybersecurity community to tackle complex subsystems with creativity and resilience.
Links:
[PyConUS2025] Welcome Address by the Conference Chair
Lecturer
Elaine Wong serves as the Conference Chair for PyCon US 2025. A long-standing contributor to the Python community, she previously chaired PyCon Canada in 2018 and co-chaired it in 2019. Wong has organized PyLadies Toronto and the CSV Conference, supported video production at multiple community events, and co-hosts a monthly virtual meetup for conference organizers. Recognized with a Python Software Foundation Community Service Award in 2020 and designated a PSF Fellow, she brings extensive experience in community building, livestreaming, and event logistics. Her professional background includes media and broadcasting work. Further details appear on her personal website at https://eswong.ca/ and her presence on X under the handle @elthenerd.
Abstract
This address opens PyCon US 2025 in Pittsburgh, Pennsylvania, by outlining the logistical framework, community resources, and programmatic highlights of the multi-day gathering. Elaine Wong introduces the organizing team, sponsors, and volunteers while providing essential orientation on venue navigation, code of conduct, accessibility measures, and special tracks. The presentation emphasizes participatory opportunities such as open spaces, hatcheries, and lightning talks, situating the conference within the broader ethos of inclusive Python community practice.
Conference Orientation and Community Infrastructure
Elaine Wong began by expressing enthusiasm for the assembled attendees and offering a light-hearted musical greeting adapted to the occasion. She introduced herself as Conference Chair and acknowledged her co-chair, John, who stood ready to assist with questions throughout the event. Together they form the primary points of contact for logistical support and guidance.
Central to the success of the conference, Wong stressed, is the dedicated staff of the Python Software Foundation. She listed Olivia, Deb, Lauren, Jamie, Phyllis, Laura, E, Marie, Jacob, Maria, Seth, and Mike, inviting a round of applause for their year-long efforts in preparing the venue, program, and infrastructure. Equally vital are the sponsors whose financial contributions underwrite food service, utilities, and overall operations; attendees were encouraged to visit the expo hall and express personal thanks via a provided QR code linking to the full sponsor roster.
The volunteer cohort received particular recognition. More than one hundred individuals had already signed up, with a target of three hundred on-site volunteer hours. Wong directed participants to a QR code and website for short-term shifts ranging from one to several hours, noting that such engagement offers both practical insight into conference operations and an eventual pathway toward leadership roles such as chair.
Practical orientation followed. Wi-Fi credentials and a QR code for network access were displayed, alongside announcement of a new mobile application available for both iOS and Android platforms. The application supplies schedules, maps, and session favoriting capabilities. Venue layout received detailed treatment: general sessions, keynotes, lightning talks, and special guest presentations occupy Hall B on the second floor. Parallel talk tracks are located in Hall C and on the third floor, reachable via escalators or elevators and a pedestrian walkway. Breakfast is served outside Hall B beginning at 7:30 each morning; lunch and snacks appear in Hall A, which also houses the expo hall on Friday and Saturday as well as swag pickup for pre-ordered t-shirts. Surplus shirts become available for purchase on Sunday at 11:00 on a first-come basis. Luggage storage operates Saturday and Sunday outside Show Office C from 8:00 to 18:00, with later retrieval possible from the staff office in rooms 306–307. A mothering and nursing room occupies Show Office B; the travel-grant office is in Show Office A, with posted hours for recipients. Gender-neutral restrooms are clearly marked. The fourth floor hosts summits and the PyLadies lunch, while room 405 provides a quiet space and a rooftop terrace offers outdoor respite. Emergency procedures direct participants to call 911 and notify staff wearing light-blue shirts or DLCC attire; on-site EMTs are stationed behind Hall B on the main conference days.
Code-of-conduct provisions received careful attention. Wong summarized the expected standard of conduct by reference to the kindness and consideration associated with Mr. Rogers. Concerns may be reported by text, email, or in person to the committee led by Molly, whose members wear distinctive orange shirts and maintain a presence in the staff room. Photo policy is signaled by lanyard color: orange indicates preference against photography, black indicates consent. Health and safety guidance encourages but does not require masking; free masks and testing kits remain available at registration.
A brief recap of the preceding two days noted completed tutorials, the language summit, education summit, WebAssembly summit, sponsored presentations, newcomers’ orientation, and a lively opening reception. Keynote speakers Jeff, Tom, Lynn, Corey, and Dr. Corey Jordan were introduced, with the added note that all would hold meet-and-greet sessions at the PSF booth; the Carpentries, led by Dr. Jordan, maintain an expo presence. Special programming includes a diversity-and-inclusion panel, a security-engineer update, and a Python Steering Council session. The Charlas Spanish-language track occupies rooms 310 and 311 for two days, inviting participants of every proficiency level. Live human captioning, provided by White Coat Captioning, accompanies all talks.
Hatchery events expand the formal program: FlaskCon occupies the afternoon of the current day, a community-organizer summit and Hometown Heroes showcase occur on Saturday, and a beginner-oriented Humble Data workshop runs on Sunday, all centered in room 317. Additional summits address typing, maintainership, packaging, and mentor sprints. Open spaces have been digitized; participants register via website or QR code for one-hour self-organized sessions on a first-come basis. Lightning-talk sign-ups likewise proceed through an online form linked to each attendee’s dashboard, with four scheduled rounds. Tickets remain available for the PyLadies auction, a dinner-and-bidding event that constitutes the principal fundraiser for the PyLadies Foundation and supports both global chapters and travel grants. The PyLadies luncheon on Sunday offers further reflection and networking. Sunday also features posters, a job fair, and a community showcase that invites regional conferences, meetups, and open-source projects to claim tables.
Local recommendations for Pittsburgh attractions, including the baseball stadium and neighborhood eateries, appear under a provided URL. Wong closed by endorsing the informal “hallway track” and the Pac-Man rule—leaving physical space in conversational circles so that newcomers may join readily. Official social-media channels and the hashtag #PyConUS complete the orientation.
Programmatic Opportunities and Inclusive Practices
Beyond logistics, the address situates PyCon US within a deliberately inclusive framework. The multi-track structure, language accessibility via Charlas and live captioning, quiet rooms, gender-neutral facilities, and explicit photo and health policies collectively lower barriers to participation. Hatcheries and open spaces democratize content creation, allowing attendees to surface emerging ideas outside the formal call-for-proposals process. Lightning talks lower the threshold for first-time speakers. Volunteer pathways and the explicit invitation to future leadership roles reinforce the conference’s self-renewing character. Financial underwriting by sponsors and the travel-grant system further extend reach. Collectively these measures illustrate how a large-scale technical gathering can embed community values of accessibility, mutual support, and continuous expansion of the Python ecosystem.
Links:
[DefCon32] Encrypted Newspaper Ads in the 19th Century
Elonka Dunin and Klaus Schmeh, renowned cryptology experts, unravel the mystery of encrypted advertisements published in The Times between 1850 and 1855. Intended for Captain Richard Collinson during his Arctic expedition, these ads used a modified Royal Navy signal-book cipher. Elonka and Klaus’s presentation traces their efforts to decrypt all ads, providing historical and cryptographic insights into a unique communication system.
The Collinson Cipher System
Elonka introduces the encrypted ads, designed to keep Collinson informed of family matters during his search for the lost Franklin expedition. The cipher, based on a Royal Navy signal-book, allowed Collinson’s family to encode messages for publication in The Times, accessible globally. Elonka’s narrative highlights the system’s ingenuity, enabling secure communication in an era of limited technology.
Decrypting Historical Messages
Klaus details their decryption process, building on 1990s efforts to break the cipher. Using their expertise, documented in their book from No Starch Press, Klaus and Elonka decoded over 50 ads, placing them in geographic and cultural context. Their work reveals personal details, such as messages from Collinson’s sister Julia, showcasing the cipher’s effectiveness despite logistical challenges.
Challenges and Limitations
The duo discusses the system’s mixed success, noting that Collinson received only four messages in Banuwangi due to expedition unrest. Klaus addresses the cipher’s vulnerabilities, such as predictable patterns, which modern techniques could exploit. Their analysis, enriched by historical records, underscores the challenges of maintaining secure communication in remote settings.
Modern Cryptographic Relevance
Concluding, Elonka explores the potential of artificial intelligence in cryptanalysis, noting that LLMs struggle with precise tasks like counting letters but excel in pattern recognition. Their work invites further research into historical ciphers, inspiring cryptographers to apply modern tools to uncover past secrets, preserving the legacy of Collinson’s innovative system.