GrrCON sign with the circuit-board skull logo, reading GR MI Hacker Con, Est 2011

On September 24th and 25th, I was in Grand Rapids, Michigan for GrrCON, a security and AI conference held at DeVos Place. GrrCON started in 2011, and this was its 15th year in person. This year drew roughly 3,000 attendees across three-plus presentation tracks, workshops, an executive summit, in-depth villages, and a vendor floor with over 100 sponsors. It is one of the longest-running security conferences outside of Las Vegas.

This was my first GrrCON, and I had high expectations. I was there to speak, but I also selfishly wanted to see what makes it tick, since I run Kernelcon back home in Omaha.

I submitted multiple talks to the GrrCON CFP, hoping at least one would land, and got the ping that my talk about rooting my bed had been accepted. Unlike at Hobocon, there was no confusion this time about which talk I was giving.

Talks

Keynotes

GrrCON ran multiple keynotes a day, and two stood out for me.

A packed keynote hall at DeVos Place under green lighting

George Kamide opened Thursday with GrrCON Awakening: Truth, Tactic, Talent (How Humans Win), joined on stage by Dr. Louis DeWeaver and Dr. Chase Cunningham. The three of them keynoted together in 2025, and it was popular enough that GrrCON brought it back. While I appreciated the discussion between the two PhDs, I enjoyed George’s portion the most. He drew a line from the assembly line to the modern technology era and showed how scarcity and talent shaped each step along the way. I found it inspiring because it made a long arc of change feel tangible.

Patrick Quirk (Ringmast4r) opened Friday with 17 Governments Audited, Zero Exploits, Bloomberg Called Me Criminal. Quirk ran passive OSINT reconnaissance against government infrastructure in 17 countries and recovered 342 GB of exposed data, including credentials and PII, without exploiting a single system. He then walked through how the media reported his work as an AI-powered attack. The talk was entertaining throughout, and it was interesting to see this kind of work from the perspective of someone who spends his time going after the exposed infrastructure of countries that aren’t US allies.

My Talk

Animated ASCII bed beside a pod temperature readout and AWS status indicator at 3:07 AM, with the talk title and GrrCON logo GrrCON podium in front of the title slide for My Bed Tried to Freeze Me at 3:00am, And How I Rooted It
The title card GIF I made for the talk, and the stage set up for it.

On the night of October 19th, 2025, I woke up at 3 AM freezing. My Eight Sleep Pod had locked into maximum cooling and sat at 55 degrees until morning, and nothing in the app could turn it off. Other owners reported the opposite that night: pods stuck at 100 degrees. The cause was the AWS us-east-1 outage. I worked at AWS at the time.

The talk covers what I did about it, which I first wrote up in Rooting My Eight Sleep Pod 3. I walked through the full teardown: opening the pod, wiring a TC2070-IDC cable from a $70 hardware kit, connecting over minicom, interrupting U-Boot to get a bash shell, remounting the filesystem read-write, and installing the open-source free-sleep project. The bed now runs entirely on my local network, with no cloud dependency and no $399/year subscription. The slides are here.

More than 500 people showed up, and the talk got plenty of laughs. The audience seemed most interested in the Right to Repair section, where I talked in detail about the right to modify what you own. At the end of my deck, I reminded everyone to keep their appliances in a state of fear and to threaten the ones that give them the most trouble. An attendee stopped me afterward to say he loved that part; he and his friends joke that they should pee on their electronics to establish dominance.

Speakers also received a +1 badge, which let me bring my coworker David Hafley along. David lives close to Grand Rapids, and we don’t get to see each other in person often, so I appreciated the chance to spend two days at a conference together. More conferences should do this.

VIP Sections

I hadn’t had VIP access at a conference before, and I liked it more than I expected. At GrrCON, a speaker badge includes VIP access, so speaking got me two perks that a general admission badge doesn’t.

The first was a guaranteed seat up front in most talks. Each room reserved a VIP section at the front with tables, so I could set my laptop down and take notes instead of balancing it on my knees. In a packed room, that meant I never had to arrive early to get a good seat or stand along the back wall. It made watching and digesting talks much easier, and it’s an incentive on its own to submit a talk again.

The second was a VIP area inside the sponsor hall, with tables, couches, drinks, snacks, and chair massages. When I needed a break from the hallway and the vendor booths, I had somewhere quiet to sit down, catch up on email, or just relax for a few minutes before the next talk.

Villages and the Vendor Hall

GrrCON runs a long list of villages and side events: lock picking, a tattoo village, BattleTech Mech Warrior pods, a forensics CTF, and a 1K-ish “Fatass Fun Run (Zero Trust Edition).” I enjoyed my time at three of them.

The Car Hacking Village, run by the CANBUSHACK team, had no formal agenda. Automotive components sat on tables, and attendees were free to pick them up and start poking at them. I’ve seen their village at DEF CON and have bought a CAN bus hacking badge from them. The village felt like a grown-up version of my talk’s lesson about not being afraid to look under the hood of something you own.

The Call Center Village was built around three modules: voice cloning using open-source tools on a local GPU, building conversational voice agents, and the Escalation Desk CTF, a voice social-engineering challenge that starts with AI agents and escalates to live human operators. The prize was a Golden Telephone Booth Trophy, and the village had a full-size British phone booth for photos. The village was crowded every time I stopped by, but I talked to a few competitors about some of the challenges. It would be a welcome village at any conference.

The Dungeons & Dragons Village ran walk-up sessions of up to six players in a classic dungeon crawl, restarting every 60 to 90 minutes with pre-generated characters and dice provided. It was my first real exposure to D&D, and it was the most fun I had on the floor. I played a rogue who kept stealing from the wrong people. Luckily, a teammate killed the correct target as a joke, which won us the session.

The vendor hall was large, with vendors from almost every discipline. Several of the vendors I spoke to said the conference brought them steady foot traffic and real leads, which is the whole point. There were plenty of giveaways and swag that my kids probably wish I had grabbed. The vendor area connected to a pub area with free beer. The conference also gave attendees two meal tickets, one for Thursday and one for Friday, for a decent conference meal (though I saw quite a few DoorDash orders).

Grand Rapids

The weather in Grand Rapids was mild, with a crisp fall feel, which made it easy to walk between DeVos Place and the rest of downtown. DeVos Place sits on the Grand River, and the city is taking its name literally. I was often distracted by dump trucks and an excavator driving through the river to build the city its own grand rapids.

A yellow dump truck driving through the Grand River beside a stone bridge
An excavator and a dump truck working in the Grand River with the downtown Grand Rapids skyline behind them

Those walks came with a soundtrack. The cars around downtown were extremely loud. I thought that had gone out of fashion in the early 2000s, when kids at my high school drilled holes in their mufflers, but it was everywhere in Grand Rapids. I don’t know if it has to do with the proximity to Detroit, but every 5 to 10 minutes, a car would come by revving its engine at everyone on the sidewalk while driving under 25 mph. If you’re sensitive to noise, I recommend bringing ear protection for walking around.

Interior of Küsterer Brauhaus with a ring chandelier, Bavarian flags, and soccer scarves

Once the con areas shut down for the night, the bar and food scene near the venue was a highlight. David and I went to Küsterer Brauhaus, ordered a couple of hot German pretzels and pilsners, and played trivia. We did well in the early rounds, but as the night went on, our answers got worse and we decided we needed more substantial food than pub pretzels. We moved up the street to Bridge Street Bar to watch Thursday Night Football and eat. I had a breakfast burrito, which was exactly what I wanted that late at night.

Entrance to the Gerald R. Ford Presidential Museum beside a red lighthouse sculpture

The one stop I didn’t have time for was the Gerald R. Ford Presidential Museum. Ford is the only president born in Nebraska, and his Omaha home was near my parents’ childhood homes. My father even met Ford at a bus stop near his house when Ford came back to visit as president. The museum is a short walk from DeVos Place, and from the outside it looked well worth the stop.

What Could Be Better

When I started writing conference reviews, I never intended them to be only positive, and GrrCON gave me a few things to talk about.

The biggest issue was one of tone. GrrCON felt like it was run for people who had already been there. The opening session never introduced the host or the conference; the person on stage said, roughly, “shut up, here are a few things to note, and here is the keynote speaker.” Nothing in the program pitched the con to someone attending for the first time or explained what made GrrCON worth coming back to. Maybe the organizers don’t need that kind of outreach, but it helps a first-time attendee.

The prize ceremony had the same problem. Winners were called up without anyone saying which contest they had won. I was sitting in the front row and eventually shouted, “What are these awards for?”

A long line of attendees stretching down the DeVos Place concourse

A con that has been running since 2011 has earned its regulars and its inside jokes. Its opening remarks still shouldn’t sound like a phone call where someone tells you “Bill said this” when you have no idea who Bill is. Two minutes of context at the opening and closing would fix this.

The speaker party had its own problems. When I arrived, there was no speaker check-in yet; it showed up later in the evening. The food was decent, and the bar was busy, so I helped myself. My table filled up with other speakers, and when we noticed the speaker bags and badges had arrived, we decided to finish our meal first. By the time we got up, they had run out. The organizers had only been able to bring a few, even though getting our badges and bags early so we could skip the next morning’s line was one of the main reasons they told speakers to come to the party.

That meant picking up my badge the next morning at the VIP desk, in the same line as the sponsors. The line was shorter than general admission, but sponsors ask a lot of questions at registration, and it took 30 minutes longer than it needed to before I could get into the conference. This should have been sorted out the night before, as promised. Bringing enough badges to the party, or opening a separate speaker queue the next morning, would fix it.

Hotels near the venue were expensive. My stay at the Homewood Suites by Hilton exceeded my company’s $400 nightly limit.

Final Thoughts

Despite the issues I called out, GrrCON was a fun conference, both as a speaker and as an attendee. My talk drew a big crowd and plenty of laughs, which says a lot about an audience that both shows up for talks and engages with them. I’ve been to conferences where the hallway conversations carry more weight than the program, so credit to the organizing committee for keeping the talks strong.

Running Kernelcon, I came home with a short list of ideas to consider. A +1 speaker badge would cost the conference one extra attendee per speaker and give speakers a reason to bring someone along. Reserved tables at the front of each room could make talks easier to follow and give speakers a perk beyond the badge itself. Meal tickets might let attendees eat without leaving the building. Kernelcon also has its own regulars and inside jokes, so GrrCON’s opening session was a useful reminder. The two minutes of context I’d ask GrrCON to add are worth checking that Kernelcon gives its own first-timers, too.

The villages were worth the time (especially D&D and the Call Center Village), and Grand Rapids was a good host city with something to do once the con areas shut down. I enjoyed my time at GrrCON and would like to return as a speaker.

Links

Thanks to the GrrCON organizers for having me, and to everyone who showed up to hear what goes on in my bedroom.

Adam (clevernyyyy)