Let's learn about L2 isolation with VLANs and dive into basic network architecture with OPNsense. After playing a bit with IPv4, let's discuss unicorn-issues IPv6 for your homelab-ing. Then expanding with WireGuard for simple inter-machine networks. Finally, we will take a look into a fail of my own via "security"(-by-obscurity) and a few words of how to defend against it.

This talk will discuss the security considerations one should make for their own network at home. The first step, to achieve network segmentation, is the use of VLANs - but how do they work? Then advancing into isolated networks using OPNsene and how to configure routing between them (in a more or less scalable way, purely based on experience).

After breaking up (with) your networks, we will take a look into IPv6 troubles you'll likely encounter when you begin applying more strict rulesets onto your network and start leaving NAT-ting behind you. This will also include a quick summary of the most important IPv6-terms you'll need.

Instead of exposing your services publicly, one can also establish site-to-site (S2S) links with well-known parties, so we will take a quick look into getting WireGuard up and running - once again with some pitfalls you may encounter.

In the end, we will take a brief detour into how one could exploit one of my own mistakes (DNS-based routing without application of source-ip filtering).

Licensed to the public under https://creativecommons.org/licenses/by/4.0/

about this event: https://program.why2025.org/why2025/talk/XZRAHF/

This talk will take you into a journey leading to the retrofit of a robotic tape library to enable it to accomodate hard drives in addition to the original media, from the reasons we did it to all the obstacles that needed to be overcome and how we did all that, pushing a little further the physical limits that make data storage increasingly problematic in a world where over 200TB is generated every second and must sometimes be retained for years (and possibly more).

Every year, humanity generates at least 250 Exabytes of data, so storage becomes increasingly problematic because this accumulates and at least part of it must be stored and made accessible for extended periods ; however, not all of that data is being accessed simultaneously. Moreover, the Internet is not well suited for the transfer of large datasets and quite often it is preferable to move physical media.

In this talk we will dive into some physical limits related to this particular problem, and how we have pushed them a little further by retrofitting a large tape library so that it can accommodate hard drives in addition to magnetic tapes.

This task involved reverse-engineering the drive train, designing new electronics to replace the proprietary and monolithic hardware by something more manageable, coming up with a plan to build a docking station that can be handled by the robot and withstand millions of insertion cycles and that is also end-user-friendly while keeping it as affordable as possible. We will dive into the limitations of the various tools at our disposal and how we worked around them to achieve our goal, while drawing a picture of all the skills and technologies involved and how this can be useful for you.

Licensed to the public under https://creativecommons.org/licenses/by/4.0/

about this event: https://program.why2025.org/why2025/talk/7X9NJP/

Are you a smartphone user worried about spyware, advanced actors, backdoors, zero-days or side-channel attacks? These routinely bypass end-to-end encryption through keyloggers, screen capture and compromised keys. Smartphones are part of complex ecosystems with dozens of hardware and software components and remain vulnerable despite vendor and political efforts.

We introduce a simple, offline, airgapped device to counter such threats.

Checkout www.qryptr.com and github.com/gappuser/qryptr

Show-and-tell of qryptr, the completely open-source secure messaging device.

Checkout https://github.com/gappuser/qryptr and https://qryptr.com

Licensed to the public under https://creativecommons.org/licenses/by/4.0/

about this event: https://program.why2025.org/why2025/talk/YEN87P/

Welcome at WHY2025!

A warm welcome by Nancy and Boekenwuurm, to wish you the best WHY2025 and give a quick intro!

Licensed to the public under https://creativecommons.org/licenses/by/4.0/

about this event: https://program.why2025.org/why2025/talk/BAU8GH/

When presenting for a larger audience or when a presentation is recorded it is almost a given that a microphone is used. In this presentation we will show you common problems presenters have with microphones, we will give you tips on holding a hand microphone and show common problems with headsets. All this to give you tools to improve the audio quality of your presentation at the source which can be used at hacker events and everywhere else you will be using a microphone.

Licensed to the public under https://creativecommons.org/licenses/by/4.0/

about this event: https://program.why2025.org/why2025/talk/MZWWK7/

What could be more fun than gaining control over your dreamworld? Go to sleep, and find yourself doing things that would be impossible in the real world. Flying? No problem! You can be superman and have it feel more real than reality. Now if that's not a fun hacking project..

You can hack all sorts of things. Software, hardware. But being a hacker, what makes more sense than to hack oneself? Hackers have been turning themselves into bionic man, but we can also just hack our brain, using just out brain. I am talking about lucid dreaming: dreaming while you are aware of doing so and able to shape your dream. This talk will discuss what we know so far about lucid dreams and how they relate to other special states of the mind. The main focus will be on how to hack your own mind to start experiencing lucid dreams, what you can do in them, and how they differ from real life.

Licensed to the public under https://creativecommons.org/licenses/by/4.0/

about this event: https://program.why2025.org/why2025/talk/KBJXPG/

As of August 1st, 2025, the EU’s Radio Equipment Directive enforces new cybersecurity requirements. For the first time, broad categories of everyday devices , not just critical infrastructure or niche tech, must meet mandatory security standards. This talk breaks down how we got here, why it matters, and what’s breaking in the process. We’ll look at the political and technical hurdles in rolling this out, what it means for manufacturers, and how it connects to the looming Cyber Resilience Act.

On August 1st, 2025, three new cybersecurity requirements under the EU’s Radio Equipment Directive (RED) officially kicked in. This is the first time the EU has imposed hard security requirements on a wide range of everyday consumer products. Think routers, smart watches, toys with a Wi-Fi chip, and more. This part of RED is often called RED DA (Delegated Act), and it's a big deal: security is no longer optional.

In this talk, we'll unpack what RED DA is actually about: how it came to be, why it was pushed through before the upcoming Cyber Resilience Act (CRA), and how that sequencing leads to some strange and messy overlaps between the two. Spoiler: it’s a political and regulatory patchwork.

We’ll look at how standardization efforts around RED DA have developed, but also at how many manufacturers are still figuring out how best to comply, while market surveillance authorities are navigating their own challenges, often working with limited tools, guidance, or resources.

On top of all this, the reality is, RED/DA is just a warm-up for the main event: the Cyber Resilience Act. We’ll take a look at what CRA brings to the table, what the current state of standardization looks like there, and what kinds of challenges are already popping up on the horizon. If you’re building, selling, or securing connected products in the EU, or just curious about how regulation is reshaping product security, this talk will give you a clear picture of what’s going on and what’s coming next.

Licensed to the public under https://creativecommons.org/licenses/by/4.0/

about this event: https://program.why2025.org/why2025/talk/RT9XQ9/

In the realm of cybersecurity, workplaces can be surprisingly unsafe, with a higher turnover of CISOs and alarming rates of misconduct. This talk explores the mechanisms behind this paradox, examining organizational dynamics, the pressures on CISOs, and the emergence of toxic behaviors. By analyzing real-world some very personal examples, we will uncover the root causes of these issues and provide practical solutions to foster a safer, more resilient cybersecurity culture.

Cybersecurity is a field where pressure is constant, and mistakes can have severe consequences. Yet, for many cybersecurity professionals, the greatest threats do not come from external attackers but from within their own organizations. In one striking example, a security researcher discovered severe vulnerabilities in a widely used product, only to be dismissed as "overreacting" by management—a classic case of gaslighting. At Equifax, a CISO faced public blame for a devastating breach, despite years of underfunding and ignored warnings about outdated software. In another case, security engineers at SolarWinds raised concerns about critical vulnerabilities that were ignored—vulnerabilities that were later exploited in a massive supply chain attack affecting thousands of organizations.

These toxic dynamics are not just isolated incidents; they are symptoms of a broader problem in the way organizations perceive and manage cybersecurity. Security is often seen as a cost center—a department that creates problems rather than solving them. This mindset fuels blame-shifting, where CISOs become scapegoats after breaches they lacked the power to prevent. Even worse, security professionals who try to escalate serious risks are sometimes ignored, marginalized, or even retaliated against. A report by (ISC)² found that 60% of cybersecurity professionals have experienced burnout, and nearly one-third have left jobs due to toxic work environments. Such conditions not only harm individuals but also weaken an organization’s overall security posture.

But it doesn’t have to be this way. This talk explores how more mature industries have learned to overcome similar toxic dynamics. What can we learn from those experiences? By drawing on these examples, this talk will identify practical steps to transform cybersecurity into a healthier, more resilient field where burning people is no longer the net result of dealing with security.

Licensed to the public under https://creativecommons.org/licenses/by/4.0/

about this event: https://program.why2025.org/why2025/talk/7TUKUF/

Zodra een presentatie gehouden wordt voor een groter publiek of wanneer een presentatie opgenomen wordt is het bijna een gegeven dat een microfoon gebruikt wordt. In deze presentatie laten we jullie zien welke problemen presentators hebben met microfoons, we geven tips hoe een hand microfoon vast gehouden hoort te worden en laten veel voorkomende problemen met hoofdmicrofoons zien. We geven je handvatten om de geluidskwaliteit van je presentatie zo goed mogelijk te laten zijn.

Licensed to the public under https://creativecommons.org/licenses/by/4.0/

about this event: https://program.why2025.org/why2025/talk/TAWFK8/

Frank talks about AI, why it all of a sudden is everywhere and what it means.

The keynotes of the likes of Microsoft, Google and Apple can all be summarized in 10 words: “A.I., A.I., A.I., Large Language Model, A.I., A.I., GPT, A.I. …“, so no doubt artificial intelligence holds a promise for the future. But what promise? Will A.I. save use or doom us? Or is it too soon to tell?

With the invention of the car, the car accident, vehicle man slaughter and the getaway car were also invented, as well as the police car and motorized ambulances. How does this apply to artificial intelligence?

What is the current state of A.I., what does it mean to our perception of the truth, and can it help us make the world more secure? How do classical security measures apply to the A.I. world, where do they fall short, and can we expect new or improved measures with the help of A.I.? Spoiler: yes, they do, and yes, we can.

In this talk, Frank will look at the A.I. wave from his unique and down to earth perspective. And hopefully you will walk away with a better understanding of AI in the context of (cyber) security.

Licensed to the public under https://creativecommons.org/licenses/by/4.0/

about this event: https://program.why2025.org/why2025/talk/TJNSGF/