I gave my first conference talk this past Saturday, at a small regional BCS event in Leeds. About 35 attendees, a one-day format, my talk in the afternoon slot.
The talk was about my honeypot work — the design, the captures, the patterns. Following from my January commitment to speak this year, the experience is worth writing about briefly.
How the talk went
The substance was fine. I had prepared more material than fit; the talk ran slightly over time. The audience asked good questions and seemed engaged.
The parts I think worked:
Specific captures over abstract description. I built the talk around three specific honeypot captures (sanitised), each illustrating a different attacker type. This made the abstract patterns concrete; the audience engaged more with the captures than with the framework discussions.
Honest uncertainty. I made a point of including the calibrated humility discipline — "this is what I observe; here are the things I am uncertain about; here is what I would need to see to update". This produced more useful questions than a more confident presentation would have.
Questions to the audience. A couple of moments where I asked the audience how they would handle a specific situation, then incorporated their answers into the discussion. This worked well; the audience felt like participants rather than spectators.
The parts I would do differently
Less material. I had prepared about 50 minutes of content for a 40-minute slot. The over-run meant I rushed the conclusion. The right amount of material for a 40-minute slot is probably 30 minutes of content with substantial buffer.
Better visual design. My slides were sparse and largely text. I think the captures would have benefited from cleaner visualisations of the timing and the command sequences. I will invest in this for future talks.
More on the operational lessons. I focused on the captures and patterns; I under-weighted the defensive recommendations. The audience was practitioners; they wanted to know what to actually do with the observations. I will give more time to this in future talks.
What the experience taught
Three things.
Speaking is harder than writing but produces different value. The discipline of speaking — managing time, reading the audience, handling questions in real time — is different from the discipline of writing. Both are valuable; they are not interchangeable.
The audience interaction is the thing the writing cannot do. Several attendees came up afterwards with specific operational questions or with their own experiences that complemented the talk. This kind of conversation is impossible in writing.
The peer signalling matters. Half a dozen people I respected from the Manchester gathering last year and Birmingham earlier this year were in the audience. Speaking among peers is a different (and slightly more nervous) experience than presenting to strangers. The signal — "I have something worth saying to this audience" — is a small but real shift in self-presentation.
Score against my prediction
From my January list:
Prediction 18: "I speak at at least one conference in 2001." Probability: 65%. Deadline: 31 December 2001.
Resolved affirmative. The 65% probability was reasonable; the timing was almost on-deadline (November rather than earlier in the year).
For calibration: I tend to be slightly under-confident on personal commitments where I am the bottleneck. The 65% should probably have been 80% — I had committed to it; the question was scheduling, not capability.
What I am doing next
For 2002: I am going to commit to two talks rather than one. The marginal cost of the second is small once the first has been done; the practice from doing more of them is valuable.
For specific topics: my honeypot work continues to be the topic I have most to say about. A more focused talk on the careful-attacker captures might be the right next thing.
For my own discipline: I will keep the speaking commitment alongside the writing one. They are complementary; neither replaces the other.
More as the year wraps up.