37C3 and New Year's Eve 2023
Another one from the vaults. The 37C3 conference took place in December, 2023. This report was mostly written in January, 2024. Mostly finished it at night in my cottage between 28 and 29th December, then edited and added some stuff in July, 2025. So… Only 1.5 years late?
It was a little ironic, and a little sad, that I was finishing the 37C3 report during 38C3. I didn't manage to get any tickets for me and #3 for 38C3 and had to make do with watching the stream.
The links to the talks go to CCC's own media archive of the filmed talks. It's a wonderful archive with many hours of enjoyment.
— — —
At last! A real, physical C3!!! I don't deny that I'm glad it was possible to listen to remote talks at rC3 (2021) and the Dezentrale Jahresendungveranstaltungen (JEV22, 2022). I even enjoyed arranging the little remote H3 conference, but actually being in the same building as 10,000+ other hackers from around the world is something else entirely.
37C was back to Congress Center Hamburg after having been in Leipzig for a few years. I still miss Berlin, of course, but Hamburg is nice, too.
Not many photos from the inside of CCH because of the C3 photo policy, obviously.
Before I continue I have to mention the elephant in the room: I heard rumours that Jake Applebaum showed up at the CCH, that he was asked to leave, and that he did leave. I'm sure that could have been handled better and I hope that Security and Awareness teams in CCC events are easily available for incidents in the future.
I hope people gives some real thought about any enforcements about things like this. For example I don't think it's good idea to force people to use their real names when buying C3 tickets, making tickets personal, and showing IDs at the entrance so entrance Engels can check against a list of banned people. Showing IDs at C3!? Really? No, thanks. They have to figure out something else.
Back to the C3 travel report…
Me, a friend, and #3 travelled together by train from Malmö to Hamburg via Copenhagen. The trip to Hamburg was mostly uneventful and in first class! It wasn't even expensive. We brought some Newtonmas beers, of course, and some snacks.
Four of us shared a flat in St Pauli, rather close to Reeperbahn. We mostly took the bus to and from CCH but once walked the entire way and once walked from Schanzenviertel after the traditional burritos.
Of course we had burritos at Jim Burrito's as usual! Burritos are traditional whenever visiting Germany now. I even think of Germany every time I eat a burrito, yes, even in the Mission in SF!
It all started when we found Dolores in Berlin during the 25C3 in 2008. Soon we had two burritos a day when we didn't get stuck at the wonderful brunch at Cafe Morgenrot.
I was quite nervous about this being #3's first time at C3. What if they got bored!? We made a thing about spending at least a few hours at CCH each day and then I went back with them to the flat for some quality alone time with their pen, paper, and iPad.
I managed to arrange a playdate at least one of the days and there was some soldering and a lot of investigating of CCH and the many assemblies. That seemed to have been fun and it looks like #3 is willing to tag along next year, too!
My hope was that #3 would have a similar experience I had many years ago when I stumbled on an assembly where a 16-year-old girl was presenting her fully autonomous robots that she had built herself. I thought if #3 found something like this, they would be able to think something "If she can do this, I can, too!" and get even deeper down the rabbit hole.
Personally I thought that the assemblies and the installations were a bit tame this year: no phone-controlled flame throwers, no trapeze artists 10 metres above the dance floor, no autonomous robots fighting each other, and not even any traces of die Seidenstraße (the pneumatic tube system)! Where were everyone?
I heard some rumours about the organisers being far fewer than usual and probably much less experienced than usual. The call for assemblies came late. People were perhaps also not ready for an actual, physical C3 this year. There was also a lack of Engels (volunteers). A few friends volunteered as Engels but to my shame I didn't do it myself.
I bought T-shirts and a zipper hoodie for me and #3. So far no one has asked them about the C3 merch. Not once! And they have many C3 t-shirts, going back years… If someone had wore something like that at my school when I was young I would have been on them at once, being impressed and asking questions.
All the talks from 37C3 are available here:
Talks that get a special mention, for some reason or another:
Please identify yourself! Digital identity systems in the EU and around the world
Since I work with a small open platform (Tillitis TKey) that can be used for authentication (among other things) I thought this would be especially interesting. Unfortunately it was thin on the technical details and I didn't learn much on the technical front.
What I did learn was mostly on the legal front:
- replies on the technical implementation for the EU Digital Wallet needs to be in before August, 2024.
- there is supposed to be a right to be pseudonymous.
- the proposal is that by 2026 the use of the Digital Wallet will be compulsory.
- UN's Universal Safeguard for Digital Public Infrastructure.
- Mozilla's proposal What could an “Open” ID system look like?
Here are some more, much more interesting stuff about the upcoming European Union Digital Identity:
- Actual technical reference of the EU DI: "The Architecture and Reference Framework" (ARF).
- EU's reference implementation of all parts of the software needed can be found in: https://github.com/eu-digital-identity-wallet
Breaking "DRM" in Polish trains: Reverse engineering a train to analyze a suspicious malfunction
Extremely interesting and well done research on manufacturers' control over train hardware and their hostile behaviour against customers.
Synthetic Sentience: Can Artificial Intelligence become conscious?
Joscha Bach's wonderful series is not your regular AI hype. It's part of another type of cognitive research and just wonderful.
-
Don't be misled by the silly name. It's named after the uniform patch of American psyops (…ending "because physical wounds heal") this marvellous and well-presented talk presents, among other things, the history of psyops and interesting case studies.
Explicitly didn't watch the trainweck about SMTP smuggling because, fuck them… You don't release an exploit on Newtonmas vacation without even telling affected software projects first!
The talk about how to scale end-to-end encryption with Messaging Layer Security (MLS) didn't have many technical details… I would have liked much more, but it's much better to just read RFC 9420 and the recent (April, 2025) companion MLS architecture RFC.
I discovered that the Cyberpunkabendbar Cable Trash was held at the ship MS Stubnitz in a special 37C3 version. Some friends went but I didn't think I should go with #3 alone in the flat. Maybe some day? I really like Hamburg and visit at least a couple of times per year.
I saw this poster about an upcoming conference in a few places:
Rabbit prototyping! Ha! I was so tempted. #3 said something like "It's you!" when they saw the poster. I have one of those posters at home now.
An aquaintance showed me this lovely little working GSM phone:
Lots of prison phone vibes, but so cute. Naturally, it was hooked up to the self-organized local GSM network.
Living very close to Reeperbahn was interesing. #3 commented on the strip clubs but they were apparently not very aware of the other sex workers around us.
We never got accosted by sex workers when #3 was with us. When some of the adult flat members walked back one night some of the sex workers correctly identified who among us had the real money and came with some rather direct suggestions. How!? Was it the expensive jacket? None of them ever spoke with me. I think they thought I was some penniless punk who probably lived in St Pauli or Schanze.
We skipped the last day at C3 and instead checked out of our flat and took the bus to Hauptbahnhof. We ended up in a café and had a second breakfast while waiting for the train, then got some supplies for the trip. #3 and I went back to Malmö via Copenhagen but the rest travelled elsewhere.
Unfortunately our train was cancelled and the replacement train didn't have any seat bookings at all! We ended up on the floor for a while until a nice conductor mentioned that there were free seats up ahead. It wouldn't have been fun spending five hours on the floor of the train between carriages, but in the end it was alright.
We arrived back in Malmö late in the evening on December 30 so we didn't have much time to prepare for New Year's Eve.
We celebrated New Year's Eve at the cottage, as usual. Central Malmö during NYE is not my kind of fun. It's similar to central Berlin. Fireworks everywhere! Horizontally as much as vertically. Gun powder smoke like fog everywhere.
Unfortunately we still had no working electricity in the cottage kitchen. P had prepared some meals for us in Malmö and we could heat one after the other on the portable induction stove.
The first days of the new year came with the snow.
Yes, I know it doesn't look like much, but that's just after a few hours. Since it's so flat around here it piles up in wedges on the highway and cars get stuck.
Over a thousand cars got stuck in a huge queue in the snow on the highway close to the cottage. Some people had been sitting in their cars for 16 hours when they were evacuated by tracked vehicles. The snow kept coming. We were OK, though, with plenty of wood for the wood stove and some food stored.
Happy new year!
Written by MC on Boomtime, the 61 day of Confusion in the YOLD 3191 ().