So I just got back from "Offensive AI Conference" in San Diego and it was a
great event - for a first time conference it ran especially smoothly, the
attendees were an amazing crowd, and many of the talks were extremely
strong. There's something about a conference that is not recording the
talks that gets people to actually sit and listen to them via the magic of
FOMO, but also, when a conference is "invite only" then you just in general
get less shenanigans - people are invested in being there. On the
other hand, I worry that the glut of more "invite only" conferences
actually locks out people who are underrepresented or not established in
the industry, which is perhaps not ideal?
Two talks I thought went particularly well were:
- Ruikai Peng and Olivier Laflamme's talk on a methodology for binary
analysis using LLMs they constructed (wrapping binja) - which they demoed
finding an a 0day on a popular consumer firmware or two. Ruikai is
apparently....16 years old? Insane.
- Jason Garman and Aaron Brown's talk on Cyber Auto-Agent, which has a
lot of interesting innovation in it but also is available
<https://github.com/westonbrown/Cyber-AutoAgent> on GitHub. It's a web
application assessment tool that (they claim) meets or exceeds XBOW's
published number on the XBOW eval set (although I'm sure that's very out of
date). Worth an install, for sure!
When I took my kids to Defcon this year it was not really for business - it
was vibe hacking in the strictest sense. These are trying times and I
wanted to feel the community around me, even if that community was busy
kicking an inflatable beach ball around in the lobby, or soldering badges
together, or awkwardly dancing to nerdcore played at unreasonable volumes.
In some ways, hearing the beating of the wings of the fifty thousand strong
locust swarm of hackers that descends on Vegas every summer is very
reassuring. In that sense, Defcon has always been more about pure distilled
hacker vibe than anything else.
But Offensive AI Conference was a business and technical meet up - much in
the way Infiltrate used to be - where the DJ is actually told to turn down
the volume of the music at the initial party because people are trying to
have 50 different little meetings, where you attend the talks because the
talks do actually matter.
In any case, I assume next year they will grow, but also, still be
annoyingly hard to get into. :)
-dave
