I attended 7 talks.
My favourite talk by far was hacking the GPG. Brilliant, really: https://media.ccc.de/v/39c3-to-sign-or-not-to-sign-practical...
The "In-house electronics manufacturing from scratch" was a very inspiring talk: https://media.ccc.de/v/39c3-in-house-electronics-manufacturi...
The rest were less good for me personally. Either over-dramatic and shallow (with a sexy-sounding topic) or too procedural in topics I'm not an expert in.
AI Agent, AI Spy
https://media.ccc.de/v/39c3-ai-agent-ai-spy
I also found the talk about Asahi interesting, both from a technical standpoint but also as a nice update what the current status is.
Asahi Linux - Porting Linux to Apple Silicon
https://media.ccc.de/v/39c3-asahi-linux-porting-linux-to-app...
Finally, not recorded, but workshops like
Foundation workshop: Hands-on, how does the Internet work?
by Ingo Blechschmidt, is congress at its best. Getting a diverse set of people with various backgrounds and knowledge levels to ARP spoof in a little over an hour is art.
https://events.ccc.de/congress/2025/hub/event/detail/foundat...
Mona Wang's talk early on Day 2 wasn't recorded but was the polar opposite -- Original, off-the-cuff, engaging, and just fun to witness.
https://fahrplan.events.ccc.de/congress/2025/fahrplan/event/... https://m0na.net/papers/wirewatch.pdf
And he waited almost ten years and the retirement of the hardware to reveal it because he didn't want it to be patched.
If you are into hardware emulation "From silicon to Darude sand-storm" is fun.
the https://media.ccc.de/v/39c3-from-silicon-to-darude-sand-stor...
Not an Impasse: Child Safety, Privacy, and Healing Together: https://media.ccc.de/v/39c3-not-an-impasse-child-safety-priv...
APT Down and the mystery of the burning data centers: https://media.ccc.de/v/39c3-apt-down-and-the-mystery-of-the-...
Bluetooth Headphone Jacking: A Key to Your Phone: https://media.ccc.de/v/39c3-bluetooth-headphone-jacking-a-ke...
The talk "Look Up" about unencrypted data over DVB satellite links was also though provoking, both in presentation and in technical content. If there's that much data unencrypted over a mainstream IP link, imagine how much is still on legacy protocols in 2025.
Sandstorm JP-8000 sawtooth DSP reversing https://www.youtube.com/watch?v=XM_q5T7wTpQ
Washing machines hacking https://www.youtube.com/watch?v=Q1S-PVo3GlA
AMD (ps5 sorta) security: https://www.youtube.com/watch?v=cVJZYT8kYsI
cool demo for the BT headphones talk: https://www.youtube.com/watch?v=TK5Tz4Bt94Y
precise time syncing with PTP: https://www.youtube.com/watch?v=dOt-zRIG5co
x86 > arm with intermediate: https://www.youtube.com/watch?v=3yDXyW1WERg
I am not so much into videos but due to some extended interest in the matter I decided to watch the recording of that talk and I do not regret it. Much recommended to everyone who is interested in the state of the art of precision time synchronization over network. Also, in my opinion this talk is presented masterfully with most of the time actually spent on a convincing live demo.
https://media.ccc.de/v/39c3-excuse-me-what-precise-time-is-i...
For OMG eye opening factor the FreeBSD jails talk (how the hell is this thing still so buggy?) and the talk on unencrypted satellite links
For excellent follow-along value and dedication to ridiculously pointless cause the Freebox talk. "Technically I don't own this box so instead of risking damaging it I'm going to take the extremely long and entertaining route around, somehow involving Doom WAD files"
For showmanship probably the Tegra talk
Because everything that complex is going to be that buggy.
With the bugs they found fix a constant number of them still remains.
https://media.ccc.de/v/39c3-the-last-of-us-fighting-the-eu-s...
I live somewhat nearby, but can’t book or plan a visit because of this. I appreciate that they are releasing videos shortly afterwards though.
Some person that wanted to get a ticket not getting one is bad, but what is worse is to have more visitors than you or the venue can safely handle. This and of course you still want it to work for the type of event you're doing, with multiple stages, parallel talks, ideally minimum walking distances, not a lot of extra tech to rent in terms of projection, sound etc.
To my knowledge the 3C congresses have been a story of growth and having to move to the next-bigger venue throughout the years.
I booked a refundable hotel already in the summer, in case I won't get the tickets. But getting the ticket this year was relatively easy (though maybe I just got lucky).
It was also a great excuse to spend New Year's Eve in Berlin.
The 10 year of Dieselgate is interesting just from a "how bad is it really?" PoV, I saw the part about curves and other defeat devices already [1].
The Rowhammer talk is likely going to be great as well, I like Daniel's work [2].
The practical Cross-VM Spectre was interesting to show this is still a problem [3].
The opensource secure element was good for trying such a thing, but I wasn't that impressed with the content [4].
[1] https://cfp.cccv.de/39c3/talk/7MSRA7/ https://media.ccc.de/v/39c3-10-years-of-dieselgate
[2] https://cfp.cccv.de/39c3/talk/3JXAJJ/ https://media.ccc.de/v/39c3-rowhammer-in-the-wild-large-scal...
[3] https://cfp.cccv.de/39c3/talk/ATYLN9/ https://media.ccc.de/v/39c3-spectre-in-the-real-world-leakin...
[4] https://cfp.cccv.de/39c3/talk/9DYZXG/ https://media.ccc.de/v/39c3-lessons-from-building-an-open-ar...
The one on whatsapp bugs https://media.ccc.de/v/39c3-dngerouslink-a-deep-dive-into-wh...
Miele washing machine hacking, very nice, I was going to say I'd be waiting to see someone integrate it into HA... and then looked up the Github repo and there's HA integration already there.
Maybe of relevance to non-security people here:
1. Most of it is about AI investigating event data in general, not just SOC/IR: cyber, intel, fraud, SRE, and we're even messing with customer 360 & social media data
2. For anyone into vibes coding or building agents, I encourage jumping to the "self-writing AI" section where we're finding we are moving internally from vibes coding -> vibes engineering -> and finally now to eval-driven AI coding loops
And, for anyone in security, doing careful evals here has indeed strongly colored my view on the market :)
However, the talk was beautiful. It went quick, was informative, good slides, very respectful Q&A (comms and quality-wise), and it had a message of DIY _and_ inspiring hope. It is easy to criticize X or say we need to do better with Y. These guys are doing it, and their journey and findings is completely open source (even though there was substantial financial risk involved). The hacker spirit 101.
[1] https://media.ccc.de/v/39c3-in-house-electronics-manufacturi...
[0] https://media.ccc.de/v/38c3-self-models-of-loving-grace
[1] https://joscha.substack.com/p/on-the-jeffrey-epstein-affair
[2] https://events.ccc.de/congress/2025/hub/en/event/detail/tech...
He quoted what he believed was scientific evidence in a private conversation that became public, has comments on fashism being efficient are clearly anti-facist and believed to observe a gender stereotype. No matter if the facts were true, it should be possible to discuss such things (especially those you think are facts) in private without getting canceled. Even if they would play in to the hand of racism or sexism if made as public statements.
I found his appology a bit weak, but I also don't see his offense, despite the messages in public being offensive and possibly harmful.
The allegations do not appear to involve abuse or moral complicity with Epstein. Instead, they seem to focus on emails Bach exchanged with Epstein concerning IQ, race, and possibly sex. Bach denies these allegations of racism and sexism.
That is at least how I understand the material based on the provided links.
"The main part of the workshop consists of a moderated deliberative discussion with the audience."
I think it is a bit ironic, that Joshua got canceled because of a private conversation - and the debate about it is not recorded, so .. in effect people are more free to express their opinions without getting canceled.
Disapointing to me. Joshua seems to have points of views I find debatable (I don't know much about him) But canceling to not have to stand his opinions? That is very much against the hacker spirit to me and he is a smart guy who knows a lot about AI.
Bluetooth Headphone Jacking: A Key to Your Phone [video]
https://news.ycombinator.com/item?id=46453204
Hacking Washing Machines [video]
https://news.ycombinator.com/item?id=46428496
Escaping containment: A security analysis of FreeBSD jails [video]
https://news.ycombinator.com/item?id=46436828
All my Deutschlandtickets gone: Fraud at an industrial scale [video]
Cory Doctorow's talk is quite strong.
An excerpt:
> I assume you've spotted the pattern by now: the US trade representative has forced every one of its trading partners to adopt anticircumvention law, to facilitate the extraction of their own people's data and money by American firms. But of course, that only raises a further question: Why would every other country in the world agree to let America steal its own people's money and data, and block its domestic tech sector from making interoperable products that would prevent this theft?
> Here's an anecdote that unravels this riddle: many years ago, in the years before Viktor Orban rose to power, I used to guest-lecture at a summer PhD program in political science at Budapest's Central European University. And one summer, after I'd lectured to my students about anticircumvention law, one of them approached me.
> They had been the information minister of a Central American nation during the CAFTA negotiations, and one day, they'd received a phone-call from their trade negotiator, calling from the CAFTA bargaining table. The negotiator said, "You know how you told me not to give the Americans anticircumvention under any circumstances? Well, they're saying that they won't take our coffee unless we give them anticircumvention. And I'm sorry, but we just can't lose the US coffee market. Our economy would collapse. So we're going to give them anticircumvention. I'm really sorry."
> That's it. That's why every government in the world allowed US Big Tech companies to declare open season on their people's private data and ready cash.
> The alternative was tariffs. Well, I don't know if you've heard, but we've got tariffs now!
> I mean, if someone threatens to burn your house down unless you follow their orders, and then they burn your house down anyway, you don't have to keep following their orders. So…Happy Liberation Day?
It carries even more weight now that "post-American" is coming from...an American. This guy stands for his ideals, I envy such resolve.
It has some long tradition placing those visibly on the podium. As the story goes, the idea is that you can immediately see if the video stream freezes up (because the cat in the video suddenly stops waving). You wouldn't immediately catch that in between talks (when you have some time to fix the issue) if the camera was just pointed at an empty stage with no movement. I think at 30C3 or so, I saw one that was placed so that it would repeatedly knock on the microphone as well.
Anyway, the waving cat has become a bit of a meme by itself and mascot of the VOC, hence also the (animated) icon in video player.
PS: HN sucks with dupes.
I'm looking forward to watching "Who cares about the Baltic Jammer?" and "The art of text (rendering)" as examples of the former.
An example of the latter is "selbstverständlich antifaschistisch!"
What would be strange are hackers that are fascist. Fascism demands surrender to power and obedience, which is antithetical to the hacker sprit. Questioning systems, equalizing power imbalances is the hacker spirit.
Antifascists have been parroting globalist Wall Street ideology for the past few decades, but this is coming to an end.
That last polarisation and othering is odd, unnecessary, divisive and not generally representative of 39c3 talks nor the CCC.
Antifascism is a long tradition among humanists and European hackers and not related to "left-wing extremism".
Why do you find it necessary to discredit the message of that talk? What's the supposedly extremist message in there?
There's plenty of European technologists who feel completely alienated from most stuff around c3 and hacker spaces because, believe it or not, most members there do tend to adhere to radical left-wing ideologies. This usually invites a whole grab bag of problems, if one has more right-wing beliefs and tries to engage.
I will concede to you that it did not used to be this bad. But it is now. Chalking this issue up to a 'long tradition' is like saying: "Community X has a long tradition of radicalization, so it's a-ok!"
Fighting fascism is required of every person who wants to keep a working democracy, regardless of your fiscal policy ideas or how egoistical you want your government to represent you.
Democracy is what allows you to remove bad leaders/parties without having to fight a bloody revolution. Fascism yearns to remove that possibility. Hence anti-fascism being needed.
That being said: Which part of the talk did you find especially extremist?
51 Ways to Spell the Image Giraffe
Who cares about the Baltic Jammer?
Asahi Linux - Porting Linux to Apple Silicon
The art of text (rendering)
Excuse me, what precise time is It?
DNGerousLINK
CPU Entwicklung in Factorio
How to render cloud FPGAs useless
Breaking architecture barriers: Running x86 games and apps on ARM
Cracking open what makes Apple's Low-Latency WiFi so fast
Reverse engineering the Pixel TitanM2 firmware
Not To Be Trusted - A Fiasco in Android TEEs
Celestial navigation with very little math
Textiles 101: Fast Fiber Transform
Escaping Containment: A Security Analysis of FreeBSD Jails
Don’t look up: There are sensitive internal links in the clear on GEO satellites
Opening pAMDora's box and unleashing a thousand paths on the journey to play Beatsaber custom songs
Lessons from Building an Open-Architecture Secure Element
And of course some of the Lightning Talks...
