Recovering our agency at DEF CON 34

Looking back on the second Nix Community at DEF CON

by Nix Vegas Team

The road to recovery is long. Especially when you're having fun. After some weeks, we've had time to rest, reflect and get back into our daily lives post DEF CON. Which means, we owe you Nixies (can we coin this) our 2026 retrospective.

This was year two of the Nix Community at DEF CON. Everything that went wrong in year one did not go as wrong this year, mostly because setup in the Las Vegas Convention Center wasn't as rushed. And, well, mostly, due to supply chain issues regarding the Nix Badge. But let's digress. Despite that and some small A/V hiccups along the way (although we had a much better overall setup from DEF CON this year), we were able to get things flowing. It was very much smooth sailing considering it was no longer our first rodeo.

We are grateful to have had some of the same sponsors back on board this year as well as new ones. Thanks to all of our sponsors for the support! You are a big reason for why we are able to do the things we want to do, and we more than doubled (~2.4x) last year's sponsorship. If you want to see where your money went, scroll down!

Thanks also to our speakers and attendees! There was a lot of great content and interest within our space, which was about double the size of last year (and we used all of it).

Lastly, we'd like to thank Dark Tangent and the Goon team for welcoming us back and being incredibly pleasant to interact with all year.

Just like last year, our retrospective is structured by our requirements, which were mostly to have a great time at DEF CON. In the spirit of open source, we're sharing it openly.

"I am the master of my fate, I am the captain of my soul."

- William Ernest Henley

ESCAPE YOUR FATE!

<3: @numinit, @djacu, @RossComputerGuy, @crertel, @odoom, @sarcasticadmin, Jake, and Grant

Theme

"Smart people in bad structures produce trash. Ordinary people, well organized, can produce precious gems."

- Pieter Hintjens

This year's DEF CON theme was Agency. Our play on it (with the lovely art of Kenz Tobias) was Escape Your Fate.

Agency is self-determination. It's about making choices that increase yours, AND helping others to control theirs.

We're subjected to companies who try to form cartels to dominate the market, spreading existential fear and doom across social media. Even in the NixOS community, there's been the rightful question of keeping the community autonomous. Unchecked fear causes people working toward the same goal to turn against each other, atomizing and weakening the friendships and connections we make in the process.

We have evolved to interpret fear strongly. The fear of rejection, of being attacked by others, of being shut out of doing the thing we love, are all emotions that we know take priority over all the rest. Fear means danger. We are sometimes subservient to it, and lose our way. If we can only address the present danger, what higher purpose can we contribute to?

[Pessimistic merging] gives maintainers power over new contributors, which many maintainers abuse.

- Pieter Hintjens, Social Architecture

The Nix Community at DEF CON is many things to many people, but unafraid of your drama is somewhere at the top of the list. We reject the notion that an open source community should be allowed to be anything less than positive sum. When maintainers form fiefdoms and cliques that make you pay a toll on your sanity to smash that merge button, the enjoyment gets lost in the process.

Find your way out of the fog. Let the forks flow freely, and maybe rediscover your agency. The software was always free. You were too, regardless of what the flamewar on Github or Discourse told you.

Bigger and better

We didn't want to get our own hopes up, and thought this year might be a little smaller. Novelty wears off after the first time, people go and do other things. But, apparently people want to do this crazy thing in the desert every year with us and that means we're committed.

Our space was close to twice as large this year, so we added a few things compared to last year. The NixCTF, NixOS running on people's badges, and the Nix Party were the highlights.

Where's the money, Vegas?

While the NixCTF and badge have their own blogposts that you can explore in more detail, we want to answer the question of where all the sponsor money went.

TL;DR: we had over double the sponsorship year over year. Vegas is not a cheap place, so THANK YOU to everyone who helped us this year. It wasn't bet all on black or on Starknet tokens.

2025: $13,040 spent, $6,500 from sponsors, $6,540 out of pocket

2026: $16,055 spent, $15,615 from sponsors, roughly broke even

We were able to use all of Flox's Closure tier sponsorship to ensure our attendees had DEF CON badges.
Determinate Systems' Closure tier sponsorship helped fund a couple more badges, Kenz's art, and a good chunk of the wonderful shirts we had made from DCL Productions.
exa.ai's Closure tier sponsorship finished off the shirts and helped pay for incidentals from Amazon (more Govee lamps, Panda Wireless adapters for our mesh network boxes, some cabling, and so on).
The NixOS Foundation is helping us pay for all of our stickers, as well as signage that we always get made. Our signage was nicer this year than last and helped direct people to our space very well.
Nixcademy's Builder tier sponsorship helped us pay for our first Nix Party, which was basically us renting out ~4 tables at Chayo (and paying Vegas Mexican restaurant prices for 20-25 people to have pitchers of frozen margaritas). This also helped with incidentals like badge lanyards and some of the cost of our signage.

Next year, we will be trying to use our OpenCollective more as it provides some useful tools.

What we're looking for in the future

Party harder

More support for the Nix Party would be especially good. I think we have the beer sorted out with kegs from Battlemage Brewery (which has already contributed to the growth of the Nix community more than they know, so they may just give us some kegs). Obviously we need a way to transport the kegs up the hill, but we have multiple cars.

Many happy people at Chayo.

We'd like the Nix Party to be an actual suite party with some DEF CON DJ playing a set. DCFurs tried this years ago and got the Fontainebleau annoyed at them, for what it's worth, so we're not exactly sure how realistic this is.

Thank you again to Jacek from Nixcademy for allowing us to try this. We would not have been able to do it without sponsorship because it would have been about $1,450 on someone's credit card. We hope we can do it again in the future, even better!

More hosting sponsorship

We use EDIS Global for our egress provider due to their proximity to Fastly. Most of our VPS are sub-$15/month but we spin up a more powerful one for the stream every year just for the event. This is expensive.

Hardware donations are still really useful. We're still using our Protectli and Tenstorrent hardware, and ran our whole network off it. We'll be adding more builders as we do more stuff.

We will assuredly do more stuff up until DEF CON is canceled.

Badge?

We're probably going to attempt an iteration of the badge every year (note the question mark). PCBWay was helpful but we welcome more help.

Full disclosure, we've never really offered it as a sponsor option directly because we think that's more of a risky investment than a sponsorship given supply chain issues, but also maybe we should give ourselves more credit due to the rabbit we pulled out of a hat this year.

Many of us admire the work of the #badgelife community, especially the work of AND!XOR and Hack For Satan. While we're relatively new to the scene, we think we can pull off plenty of neat ideas at this point. There is a lot of concentrated knowledge in the team that modern tools only seem to be helping.

Winners of the NixCTF won this year's and last year's badge

New things this year

There were also the minor vibe-enhancing things we did this year:

CTF integrated with Home Assistant

We had a bunch of smart LED lamps wired into Home Assistant. Whenever someone captured a flag in the CTF, our CTF backend would hit a Home Assistant webhook on a private VLAN and they'd all flash green.

We want to do even more of these lamps, and joked that we could run a Home Assistant CTF in general with our setup. It may not be a joke at some point.

The community space before being crowded with people

Local live captioning

We ran a local Whisper speech model to do live captioning of talks. It was super useful once we figured out how to hook it up to OBS, which also did our sponsor logo rotation and Grafana dashboard, but that Tenstorrent box won't clock down and gets really hot. We need better thermal management for it when we aren't using the cards (i.e. to turn them off).

We also had a flag for the CTF that was triggered by a hotword

More cached packages

We also had a Hydra and local Forgejo server that we're still using, and planning on making available to attendees to use in the off days. At least one of our CTF challenges used the git server, and we're planning on putting our BadgeOS build on our Hydra.

We expanded our cached package set to all stable and unstable versions, and even the last release of 25.11. All of our CTF VMs were able to use it.

You should check out Tormented Radio too, they're cool

There's no way to filter store paths by which package set they came from in a nixpkgs eval, without provenance information or a lot of GC roots. This makes GC very awkward since it's based on age by default. Even with ZFS dedup, it's a lot.

  pool: ghostgate
 state: ONLINE
  scan: scrub repaired 0B in 03:30:48 with 0 errors on Sat Jul 18 00:04:12 2026
config:

        NAME                                             STATE     READ WRITE CKSUM
        ghostgate                                        ONLINE       0     0     0
          mirror-0                                       ONLINE       0     0     0
            ata-Samsung_SSD_870_EVO_4TB_S757NL0Y604080R  ONLINE       0     0     0
            ata-Samsung_SSD_870_EVO_4TB_S757NL0Y205776M  ONLINE       0     0     0
        cache
          nvme-eui.002538d9314043b4-part3                ONLINE       0     0     0

errors: No known data errors

 dedup: DDT entries 117139406, size 39.7G on disk, 24.6G in core

bucket              allocated                       referenced
______   ______________________________   ______________________________
refcnt   blocks   LSIZE   PSIZE   DSIZE   blocks   LSIZE   PSIZE   DSIZE
------   ------   -----   -----   -----   ------   -----   -----   -----
     1    70.8M   6.08T   2.15T   2.17T    70.8M   6.08T   2.15T   2.17T
     2    25.3M   1.31T    478G    499G    54.6M   3.00T   1.05T   1.09T
     4    5.50M    395G    142G    146G    26.5M   1.82T    668G    688G
     8    6.25M    260G    122G    129G    69.8M   2.83T   1.35T   1.43T
    16    2.47M   75.1G   31.1G   34.4G    54.2M   1.59T    679G    751G
    32     848K   19.0G   7.53G   8.82G    36.1M    807G    321G    377G
    64     291K   5.15G   2.05G   2.52G    24.5M    437G    173G    213G
   128     131K   2.06G    742M    976M    22.1M    357G    124G    164G
   256    56.9K    762M    233M    339M    19.2M    255G   78.0G    114G
   512    19.2K    373M   81.7M    114M    13.1M    244G   54.8G   76.7G
    1K    5.82K   29.6M   14.5M   28.1M    7.90M   39.3G   19.6G   37.9G
    2K    2.53K   12.3M   7.17M   13.7M    7.44M   30.4G   18.0G   37.6G
    4K      384   1.33M    952K   1.80M    1.96M   7.09G   4.98G   9.53G
    8K       70    216K    122K    304K     718K   2.24G   1.23G   3.06G
   16K       16   48.5K     28K     64K     366K    985M    587M   1.43G
   32K        7   27.5K   12.5K     28K     317K   1.20G    554M   1.24G
   64K       12    110K     55K     72K    1.26M   12.8G   6.36G   8.01G
  128K        1   1.50K   1.50K      4K     145K    217M    217M    579M
 Total     112M   8.14T   2.92T   2.98T     411M   17.5T   6.66T   7.13T

Surely there's a better way. At the moment, we cannot sustainably run Hydra evals without aging out the limited amount of onsite cache space we have, or manually curating GC roots for all of nixpkgs. (In other words, we may need to create a way to do policy-based cache cleanup in the near future.)

Alternate upstreams than DC Wifi

We tried to keep our uplink alive with a Calyx Institute modem even when DEF CON's was down, and offered a flake for automatic enrollment of people's laptops to the DEF CON Wifi registration.

We want to do even better with bonding next year. Someone should be able to come to the Nix Community and we should always have working internet access.

We figured out the mixer on Saturday, and wired it up so we could stream Tormented Radio back into people's headsets while they worked. Naturally, we need to just do our own radio station now, with a local Jellyfin server so we aren't dependent on the uplink as much. It's something that's been on our radar for a while in any case.

Better PXE boot

We could PXE boot machines into a system that would auto-register on DEF CON wifi. That was a neat trick. Ideally we'll have a proper WPA Enterprise network next year :)

Our PXE boot could also, naturally, make the machine play Bad Apple because we figured out how to sleep for a fractional number of seconds in iPXE's scripting language. We also hid a CTF flag so people had to either download the iPXE script or just boot into it and watch all of Bad Apple before the flag printed.

Other events

We probably should do more with the Projects track (notably, infra integration) and not do two PR merging sessions. We got through like 10 PRs on Friday and then it tapered off on Saturday. This was somewhat expected but we should vary it a little. Remote participation worked nicely through Owncast. We'd probably bridge Matrix, Discord, and Owncast in the future so we just have a channel full of whatever people are chatting on.

And, regardless, have two talk submission deadlines: one for DEF CON's Community Stage deadline and the other for our own. That would unconfuse things so we don't need to extend our deadline for a third year.

Conclusion

We had a little challenge for the community last year:

For next year, here's a hint: Nix fixes everything. What can you fix with it?

What's the weirdest machine you can get a Nix-based Linux distro running on?

Ever thought about "nontraditional" execution environments for Linux packages, or maybe Nix evaluation itself?

Does the idea of finding a sandbox escape in Nix builds fill you with excitement?

All three of these were addressed by the badge, the CTF, and various talks in different ways. Weird machines are our strong suit! And, in a funny coincidence, @psyclyx/fix on a badge controlling the LEDs was the nontraditional environment for Nix evaluation.

Fate status: escaped ✅ (along with multiple Nix sandboxes and the SG200x's secure boot)

The future

What about next year? Can we find a way to restore our roots of trust in our software, even with LLMs involved in creating it?

<3 (and see you next year),

Nix Vegas team

Nix Vegas

A DEF CON community of Nix users and developers