Where were people's favourite lectures?<p>I attended 7 talks.<p>My favourite talk by far was hacking the GPG. Brilliant, really: <a href="https://media.ccc.de/v/39c3-to-sign-or-not-to-sign-practical-vulnerabilities-i" rel="nofollow">https://media.ccc.de/v/39c3-to-sign-or-not-to-sign-practical...</a><p>The "In-house electronics manufacturing from scratch" was a very inspiring talk: <a href="https://media.ccc.de/v/39c3-in-house-electronics-manufacturing-from-scratch-how-hard-can-it-be" rel="nofollow">https://media.ccc.de/v/39c3-in-house-electronics-manufacturi...</a><p>The rest were less good for me personally. Either over-dramatic and shallow (with a sexy-sounding topic) or too procedural in topics I'm not an expert in.
Somehow it did not get much attention, but Signal president Meredith Whittaker (together with
Udbhav Tiwari) spoke about the risks and threats from AI-enabled systems.<p><i>AI Agent, AI Spy</i><p><a href="https://media.ccc.de/v/39c3-ai-agent-ai-spy" rel="nofollow">https://media.ccc.de/v/39c3-ai-agent-ai-spy</a><p>I also found the talk about Asahi interesting, both from a technical
standpoint but also as a nice update what the current status is.<p><i>Asahi Linux - Porting Linux to Apple Silicon</i><p><a href="https://media.ccc.de/v/39c3-asahi-linux-porting-linux-to-apple-silicon" rel="nofollow">https://media.ccc.de/v/39c3-asahi-linux-porting-linux-to-app...</a><p>Finally, not recorded, but workshops like<p><i>Foundation workshop: Hands-on, how does the Internet work?</i><p>by Ingo Blechschmidt, is congress at its best. Getting a diverse set of people with various backgrounds and knowledge levels to
ARP spoof in a little over an hour is art.<p><a href="https://events.ccc.de/congress/2025/hub/event/detail/foundation-workshop-hands-on-how-does-the-internet" rel="nofollow">https://events.ccc.de/congress/2025/hub/event/detail/foundat...</a>
Meredith's talk was extremely scripted, not very original and then she ducked out of taking any audience questions. Udbhav awkwardly stood there but seemed like he could have had much more to say. It was hard to watch.<p>Mona Wang's talk early on Day 2 wasn't recorded but was the polar opposite -- Original, off-the-cuff, engaging, and just fun to witness.<p><a href="https://fahrplan.events.ccc.de/congress/2025/fahrplan/event/protecting-the-network-data-of-one-billion-people-breaking-network-crypto-in-popular-chinese-mobile-apps" rel="nofollow">https://fahrplan.events.ccc.de/congress/2025/fahrplan/event/...</a> <a href="https://m0na.net/papers/wirewatch.pdf" rel="nofollow">https://m0na.net/papers/wirewatch.pdf</a>
I also enjoyed the GPG talk. Other highlights:<p><i>Not an Impasse: Child Safety, Privacy, and Healing Together</i>: <a href="https://media.ccc.de/v/39c3-not-an-impasse-child-safety-privacy-and-healing-together" rel="nofollow">https://media.ccc.de/v/39c3-not-an-impasse-child-safety-priv...</a><p><i>APT Down and the mystery of the burning data centers</i>: <a href="https://media.ccc.de/v/39c3-apt-down-and-the-mystery-of-the-burning-data-centers" rel="nofollow">https://media.ccc.de/v/39c3-apt-down-and-the-mystery-of-the-...</a><p><i>Bluetooth Headphone Jacking: A Key to Your Phone</i>: <a href="https://media.ccc.de/v/39c3-bluetooth-headphone-jacking-a-key-to-your-phone" rel="nofollow">https://media.ccc.de/v/39c3-bluetooth-headphone-jacking-a-ke...</a>
"Liberation of the Freebox", A slightly crazy Frenchman embarks on a quest to find exploit and write a complex exploit chain, using PrDoom and the Linux HFS+ driver to gain root privileges on his set-top box. All this in order to unlock the recording of somewhat rubbish TV channels such as TF1 and M6.<p>And he waited almost ten years and the retirement of the hardware to reveal it because he didn't want it to be patched.<p>If you are into hardware emulation "From silicon to Darude sand-storm" is fun.<p>the <a href="https://media.ccc.de/v/39c3-from-silicon-to-darude-sand-storm-breaking-famous-synthesizer-dsps" rel="nofollow">https://media.ccc.de/v/39c3-from-silicon-to-darude-sand-stor...</a>
I still have to go through my watch list, the age old issue of not having my slides done before congress...<p>The 10 year of Dieselgate is interesting just from a "how bad is it really?" PoV, I saw the part about curves and other defeat devices already [1].<p>The Rowhammer talk is likely going to be great as well, I like Daniel's work [2].<p>The practical Cross-VM Spectre was interesting to show this is still a problem [3].<p>The opensource secure element was good for trying such a thing, but I wasn't that impressed with the content [4].<p>[1] <a href="https://cfp.cccv.de/39c3/talk/7MSRA7/" rel="nofollow">https://cfp.cccv.de/39c3/talk/7MSRA7/</a> <a href="https://media.ccc.de/v/39c3-10-years-of-dieselgate" rel="nofollow">https://media.ccc.de/v/39c3-10-years-of-dieselgate</a><p>[2] <a href="https://cfp.cccv.de/39c3/talk/3JXAJJ/" rel="nofollow">https://cfp.cccv.de/39c3/talk/3JXAJJ/</a> <a href="https://media.ccc.de/v/39c3-rowhammer-in-the-wild-large-scale-insights-from-flippyr-am" rel="nofollow">https://media.ccc.de/v/39c3-rowhammer-in-the-wild-large-scal...</a><p>[3] <a href="https://cfp.cccv.de/39c3/talk/ATYLN9/" rel="nofollow">https://cfp.cccv.de/39c3/talk/ATYLN9/</a> <a href="https://media.ccc.de/v/39c3-spectre-in-the-real-world-leaking-your-private-data-from-the-cloud-with-cpu-vulnerabilities" rel="nofollow">https://media.ccc.de/v/39c3-spectre-in-the-real-world-leakin...</a><p>[4] <a href="https://cfp.cccv.de/39c3/talk/9DYZXG/" rel="nofollow">https://cfp.cccv.de/39c3/talk/9DYZXG/</a> <a href="https://media.ccc.de/v/39c3-lessons-from-building-an-open-architecture-secure-element" rel="nofollow">https://media.ccc.de/v/39c3-lessons-from-building-an-open-ar...</a>
Absolutely Cory Doctorow's, for the showmanship alone. Lovely background slides. The message itself might not resonate with everyone.<p>The talk "Look Up" about unencrypted data over DVB satellite links was also though provoking, both in presentation and in technical content. If there's that much data unencrypted over a mainstream IP link, imagine how much is still on legacy protocols in 2025.
order by personal rank:<p>Sandstorm JP-8000 sawtooth DSP reversing
<a href="https://www.youtube.com/watch?v=XM_q5T7wTpQ" rel="nofollow">https://www.youtube.com/watch?v=XM_q5T7wTpQ</a><p>Washing machines hacking
<a href="https://www.youtube.com/watch?v=Q1S-PVo3GlA" rel="nofollow">https://www.youtube.com/watch?v=Q1S-PVo3GlA</a><p>AMD (ps5 sorta) security:
<a href="https://www.youtube.com/watch?v=cVJZYT8kYsI" rel="nofollow">https://www.youtube.com/watch?v=cVJZYT8kYsI</a><p>cool demo for the BT headphones talk:
<a href="https://www.youtube.com/watch?v=TK5Tz4Bt94Y" rel="nofollow">https://www.youtube.com/watch?v=TK5Tz4Bt94Y</a><p>precise time syncing with PTP:
<a href="https://www.youtube.com/watch?v=dOt-zRIG5co" rel="nofollow">https://www.youtube.com/watch?v=dOt-zRIG5co</a><p>x86 > arm with intermediate:
<a href="https://www.youtube.com/watch?v=3yDXyW1WERg" rel="nofollow">https://www.youtube.com/watch?v=3yDXyW1WERg</a>
Just for sheer geekery's sake probably the ISDN talk.<p>For OMG eye opening factor the FreeBSD jails talk (how the hell is this thing still so buggy?) and the talk on unencrypted satellite links<p>For excellent follow-along value and dedication to ridiculously pointless cause the Freebox talk. "Technically I don't own this box so instead of risking damaging it I'm going to take the extremely long and entertaining route around, somehow involving Doom WAD files"<p>For showmanship probably the Tegra talk
The biggest problem with ccc is that:
0. They are releasing too few tickets.
1. They are releasing the tickets too late.
3. Still not able to pay with card?<p>I live somewhat nearby, but can’t book or plan a visit because of this. I appreciate that they are releasing videos shortly afterwards though.
You can pay with a card, but there is an additional 5 Euros fee (which is fair enough).<p>I booked a refundable hotel already in the summer, in case I won't get the tickets. But getting the ticket this year was relatively easy (though maybe I just got lucky).
<a href="https://media.ccc.de/v/39c3-css-clicker-training-making-games-in-a-styling-language" rel="nofollow">https://media.ccc.de/v/39c3-css-clicker-training-making-game...</a>
The CSS clicker talk was really entertaining as well as just technological amazing!
The Last of Us - Fighting the EU Surveillance Law Apocalypse<p><a href="https://media.ccc.de/v/39c3-the-last-of-us-fighting-the-eu-surveillance-law-apocalypse" rel="nofollow">https://media.ccc.de/v/39c3-the-last-of-us-fighting-the-eu-s...</a>
I think the blue team ctf ai talk was a good benchmark were we at right now <a href="https://media.ccc.de/v/39c3-breaking-bots-cheating-at-blue-team-ctfs-with-ai-speed-runs" rel="nofollow">https://media.ccc.de/v/39c3-breaking-bots-cheating-at-blue-t...</a>
Demystifying Fuzzer Behaviour<p><a href="https://m.youtube.com/watch?v=h3UcecN5fvQ" rel="nofollow">https://m.youtube.com/watch?v=h3UcecN5fvQ</a>
The one on the bluetooth headphone vulnerabilities was quite fun: <a href="https://media.ccc.de/v/39c3-bluetooth-headphone-jacking-a-key-to-your-phone" rel="nofollow">https://media.ccc.de/v/39c3-bluetooth-headphone-jacking-a-ke...</a>
That in-house electronics one is gold.
The one on bsd jails <a href="https://media.ccc.de/v/39c3-escaping-containment-a-security-analysis-of-freebsd-jails" rel="nofollow">https://media.ccc.de/v/39c3-escaping-containment-a-security-...</a><p>The one on whatsapp bugs <a href="https://media.ccc.de/v/39c3-dngerouslink-a-deep-dive-into-whatsapp-0-click-exploits-on-ios-and-samsung-devices" rel="nofollow">https://media.ccc.de/v/39c3-dngerouslink-a-deep-dive-into-wh...</a>