Musings of a Goon-du

The opportunity to share my experiences as a Goon at the inaugural DEF CON Singapore (DCSG1) was too attractive to turn down. But before the banter begins, I was promised serious latitude with this piece since after all it is for a hackerzine, so expect my mediocre literary ability, idiosyncratic creative liberties, and potential utter gibberish. Also, per my personal mantra of "asking for forgiveness rather than permission", expect an unfiltered perspective of the good, bad, ugly, and everything in between. Now that you have been warned, read on at your own cost.

As a new Goon, the Vegas tradition is to be referred to as a Noon, a portmanteau of New and Goon. As the first attempt at asserting some local flavour to DEF CON Singapore, I hereby posit the label of Goon-du for new Goons at DCSG. For those unacquainted with Singlish, perhaps even those familiar but with fewer grey hairs, a goon-du is an almost affectionate term to refer to a fool or a clueless person — which is rather apt for a new Goon at the first-ever DEF CON in Singapore.

Though I dislike disclaimers, I have to offer one — what's about to transpire is by no means a complete representation of every Goon's experience at DCSG1. I am just the lucky (or unlucky) one who gets to yap about it. If what I am about to share piques your interest for involvement at future DCSGs, please do yourself a favour and speak to my fellow Goon-dus to get a more comprehensive and nuanced understanding of what it takes to be a Goon.

Now to the tea.

The Accidental Goon

In case you are wondering, amongst the Singapore-based folks I was probably the least likely to have the opportunity to be a Goon at DCSG1. For those who may not be aware, I am currently based in Dubai and happened to be back only because of the unfortunate War in the Middle East. Moreover, as much as I ought to be, I am not as involved or plugged in to the local cybersecurity community unlike a good number of Goons who have stellar tenures supporting local volunteer-led initiatives.

My opportunity to Goon first came through a friend, who subsequently served as a fellow Goon-du, and it was for the very specific task of helping at Hacker Jeopardy. For those who know a thing or two about Hacker Jeopardy, I wasn't entirely sure whether I should be flattered or question my image. Nonetheless, it was a difficult decision to turn down — I was expecting to be preoccupied with business travel during the week of DCSG1.

However, sh*t happens — in my case, it happened. The War in the Middle East started, I was stranded in the US, and with the volatile situation, I decided to make my way back home instead. When it became clear that the War would take on a protracted nature — barely a month out from DCSG1 — I asked if the opportunity to Goon was still available. To my pleasant surprise, there was still room for me. Lo and behold, that's my origin story of becoming a Goon-du.

Spongebob always says it best!

The Bodoh Goon

As with any novel experience, I was mostly, if not completely, clueless about what to expect as a Goon. When asked about my availability, the overzealous person in me decided it was a great idea to indicate that I was available for the entire duration of DEF CON Training and Conference. This just meant ample opportunity to be bodoh (Singlish for dumbo) across five days. For those fluent in Singlish who might think that "Bodoh Goon-du" as a double negative seems too harsh — trust me, there were times where this double whammy felt entirely real.

In about the week leading up to DCSG1, we had two briefs: a general one for all Goons covering expected roles, responsibilities, and desired etiquette as ambassadors of DEF CON; and another specific to Goons supporting the Training days. Despite the informative briefs, as with any large-scale physical event, there will always be "known unknowns" and "unknown unknowns" where Goons have to adapt and put our best foot forward as circumstances evolve. I am proud to report that's exactly what we did.

Throughout Training and Conference, there were countless moments where I felt like a bodoh — whether from an attendee asking a question I probably should have known the answer to, or an ad-hoc task like setting up the POS machine for early-access swag sales. Fortunately, I was blessed with a supportive crew of Goons (and Goon-dus) where everyone was ready to step up, and if we were all clueless in that moment, we went straight into tinkering mode to figure it out. TLDR — especially for future Goon-dus: don't be afraid to ask for help.

If you are old enough and/or geeky enough, you would get it!

The Chao Keng Goon

I promised the good, bad, and ugly, so here's a hard truth about Gooning. As with any volunteer-led initiative, there will unfortunately be no-shows and people who do the "bare minimum" so they can claim they've done their part. For the latter, I am not even sure why one would bother to volunteer if the goal is to check some proverbial box — but yes, humans can be strange creatures.

For this bunch of miscreants, chao keng is apt. For the unacquainted, chao keng is a Singlish term derived from the Hokkien or Teochew dialects, and it typically means to feign illness or injury to avoid work, duties, or responsibilities. It is a term popularised through National Service (NS), the mandatory military service for every able-bodied male citizen or permanent resident in Singapore. The notion of chao keng transcends NS into the workplace and into many other aspects of life — unbelievably applicable to volunteering too.

At DCSG1, fortunately, the chao keng Goon was more the exception than the norm. There was a handful of no-shows during the Conference days, but the "grand" title of chao keng Goon had to go to a particular individual who showed up on Day 1 of Conference as instructed, collected his Goon swag, and thereafter — instead of fulfilling his responsibilities — roamed the Conference floor as a regular attendee. This person had no intention of helping and only signed up to freeload his way into DCSG1. His masquerade did not go unnoticed; he was duly identified and removed from the conference grounds. Moral of the story: be decent, don't be a pr*ck.

Nuff said.

The Dynamic Goon

With the inherently fluid nature of any large-scale event — exacerbated by the chao keng phenomenon — comes one of the quintessential aspects of being a Goon: always be dynamic. Though most Goons have pre-assigned roles, many had to take on additional tasks or be redirected on an ad-hoc basis. Given that tasks can be drastically different from one another, Goons had to be prepared to perform things well outside their comfort zone.

Keeping to the Singlish tradition, the apt phrase here is bao sua bao hai, a Hokkien term that translates to 包山包海 in Mandarin. The literal translation — "cover mountain, cover sea" — is typically used to describe someone who goes far beyond their expected job scope or tackles multiple tasks at once. It speaks to both the impressive "can-do" spirit and the busy, sometimes overwhelmed nature of taking on too much.

The dynamic or bao sua bao hai Goon was on full display at DCSG1. There were so many instances where Goons went above and beyond to ensure things got done. Training Goons were also supporting the Villages on Conference days — spending the full day assisting with training, then spending hours into the night setting up their respective Villages. During the Conference, there were multiple occasions where Goons were redeployed to manage emergent issues: crowd control for an unexpectedly popular talk, or a village activity that blew up. In sum, as the good Boy Scout I once was — be prepared, and be ready to roll with the punches.

The Eclectic Goon

This next aspect of the Goon experience is probably my favourite. It is not a particular trait or characteristic of an individual, but the collective mix of backgrounds and experiences of the Goons that culminates in a hallmark of this group. Probably circumstantial rather than by design, the demographics of the Goon-dus felt like a microcosm of the cybersecurity community in Singapore.

Amongst us, we had folks about to graduate from university, folks in the early innings of their cybersecurity careers, and tenured people with strong track records. The Goon-dus hailed from a diverse breadth of organisations — end-user environments, technology vendors, MSSPs, and entrepreneurs running their own practices. Though Singapore-based, we had a fair representation of people who hailed from different parts of the world.

For me, this rojak of Goon-dus — rojak being a salad dish of Javanese origin common across Indonesia, Malaysia, and Singapore, also used colloquially to describe a cultural mix — meant many conversations offering a breadth of perspectives on the state of the cybersecurity profession, community, and industry in Singapore. Over the discourse, it was a privilege to hear the aspirations, hopes, insecurities, and struggles of my fellow Goon-dus. Despite some valid reservations about the future of cybersecurity in Singapore, the overall optimism and willingness to hustle gave me an immense sense of hope for the road ahead.

The calm before the storm that is registration.

The Friendly, Firm, and Fun Goon

Looking back at my Goon-ing experience over the entire DCSG1, it was evident that I had to adapt my demeanour to the context I was in at any given moment. To be clear, I am not suggesting that being a Goon requires duplicity or sociopathy. The vastly different and evolving circumstances simply necessitate that Goons behave in ways commensurate with the prevailing situation. Three faces — Friendly, Firm, and Fun — sufficiently encapsulate my personal experience.

Of the three, being friendly was the default for me at DCSG1. The core spirit of DEF CON revolves around community: everyone comes together, drops their egos, shares what they love about their work, tinkers with hardware and software and everything in between. At DCSG1, this collegiate nature was on full display, and being a (friendly) Goon was about facilitating the DEF CON experience and ensuring attendees got the most out of their time at Training and Conference.

Photo-taking is a core Goon skill.

Being firm is also part and parcel of the Goon experience. I am ill-suited to explain the full legacy of the "Goon" label, but in the spirit of context — DEF CON in the U.S. started in 1993, and in the early years, with Las Vegas as the location, it should not be difficult to fathom the motley assortment of people who would attempt to crash it. Las Vegas also has the propensity to bring out a particular strain of uninhibited behaviour in its visitors. Putting those together, being a Goon at DEF CON meant being a combination of bouncer and enforcer of the ground rules.

Thankfully, the situation in Las Vegas today has much improved, but no DEF CON is complete without some shenanigans — so the Goons remain responsible for keeping the peace. In Singapore, the majority has developed an inherent deference to authority and a sense of politeness, so the Goons at DCSG1 generally did not have to deal with anarchy and chaos. Nonetheless, there were instances where firmness was warranted.

My "fondest" memory of being firm was my (thankfully) brief tenure as the "chips police" at Training. On Training Day 2, I was asked to watch over the afternoon refreshments — potato chips and cookies. The task was to ensure participants took their fair share, which was unfortunately required because some hungry folks on Day 1 had resulted in about 50% of participants getting nothing. Believe it or not, there were participants visibly unhappy when the quota was explained, with some attempting to return for seconds hoping the Goons wouldn't catch on. What started with me as the sole chips police subsequently necessitated additional Goon support to enforce the quota. Petty as it may sound, I did wonder in that moment if common decency isn't all that common anymore. Nonetheless, being firm as a Goon is a relevant and necessary attribute.

"The door troll," said the photographer.

Being the Fun Goon is, at least for me, the best part of the experience. If there are no opportunities for folks to let their hair down at a conference, that makes for a really dull time. I saw it as a personal mission to encourage participants to have fun at DCSG1 — primarily through Hacker Jeopardy. On that front, I had some success but left much to be desired. I initially convinced three teams to join: one bailed after registration, one bailed while waiting for their round, and the last did a commendable job but did not make the finals. For the two teams that bailed, I have the memory of an elephant — I humbly suggest you redeem yourselves next time.

For those familiar with how Hacker Jeopardy runs in DEF CON Vegas, you know just how rowdy it can get. There were valid concerns about whether it could be "too much" for local sensitivities at DCSG1. It was important to keep with DEF CON tradition while adapting to local circumstances. Fortunately, we found an adequate balance — sufficient teams were fielded, the warning calls of "don't f**k it up!" periodically rang through the hall, and a reasonable amount of beer was consumed with minimal post-HJ shenanigans. A big shout-out to Tyler for being a masterful host and creatively architecting the questions.

A game-changing decision was made on the morning after Hacker Jeopardy. The awesome g0rdo decided to run Hacker Jeopardy Reloaded — same questions, same amount of fun, without the beer. With the generosity of the swag store, we had prizes to incentivise participation. From 10am onwards, there was a re-run of HJ on the hour until the closing ceremony. We hosted about six rounds through the day, each comprising at least three teams. By the time we were done, close to 100 participants had the opportunity to experience HJ. I was always of the opinion that more people should get to partake in the joy and excitement of HJ, so I was particularly pleased that we democratised the experience at DCSG1.

My best shot at being a Hacker Jeopardy Babe ;)

The Gamxia Goon

When I reflect on my Goon-du experience at DCSG1, I find myself experiencing an immense amount of gratitude. As the Accidental Goon, I am grateful to my fellow Goon-dus — many of whom had known each other before — for accepting me into the fold. I am equally thankful for my fellow Goon-dus and the seasoned US-based Goons for your patience with the times my bodoh self reared its head, and for your support as we powered through the dynamic circumstances at DCSG1.

As alluded to earlier, I am grateful for the many conversations with my fellow Goon-dus during the long days at Training and Conference — whether an exchange of professional or personal perspectives across a broad spectrum of topics, or just sheer gossip (yes, I maintain that gossip is the national sport of Singapore). The numerous conversations made me realise how much I missed the familiarity of the local community. Importantly, the conversations extended beyond the Goons. Though I expected to meet many familiar faces at DCSG1, I clearly underestimated the draw of DEF CON. I met numerous people I had the privilege to befriend over the years in industry and community — but there were equally many moments of pleasant surprise when I met friends and colleagues from periods that predated my time in cybersecurity. The sheer happenstance was truly a highlight.

DEF CON is fundamentally a community-driven movement. Analogous to the adage that it takes a village to raise a child, I posit that it takes villages to drive a successful DEF CON. It was heartening to witness the many volunteers from Singapore and across the globe coming together to deliver a rich plethora of interactive activities — engaging participants and promoting their respective interest areas. Just as the kampung spirit is an enduring component of Singapore's socioeconomic identity, it is my sincere hope that the collegiate spirit on full display at DCSG1's villages will forge a vibrant cybersecurity community in Singapore.

Always a blast to see the Car Hacking Village folks!

To Goon or Not to Goon? That is NOT the Question

If you are still with me at this point, huge props for bearing with my verbose reflection — or more aptly described as talk cock, sing song. Now that you have seen DCSG1 through the eyes of a Goon-du, I hope it offers some insight into Goon-ing and encourages you to consider volunteering at future DEF CONs. I will not invoke the Jedi authority of "Do or Do Not, there is No Try" to advocate for you to volunteer. Being a Goon is not for everyone — the good Goon is, in my opinion, a combination of many attributes: amiable, helpful, adaptable, and at the same time tenacious, resilient, and unwavering. By now you should know the babbling baboon in me, so I shall leave you with a mix of mimicry, existentialism, and marginal humour:

To Be is to Goon. To Goon is to Be. Goony Gooning Goon-du?

When our powers combine!