Advice on CFP responses
The conference Call For Paper (CFP) season has started in full swing. Lots of people have started preparing their CFP responses. I look forward to seeing the new research and tutorials from these.
Over the last few years, I've had the good fortune to present at a number of conferences. I find large crowds stressful, but a good conference makes that extra stress worthwhile. And I really enjoy talking with people and exchanging ideas.
If you plan to respond to CFPs, I have a little bit of advice to make your proposal and presentation stand out.
Order of operations
If your approach is to submit to a CFP, then do the research if accepted, you're doing it completely backwards. Stop that. The proper thing to do is start a bunch of research, then when it's decently well along, start submitting it. To be fair, it also depends on the type of talk. a survey or tutorial is different than true research. (from my comments on Twitter)
You should have already made good progress on your research before submitting. Some of it might still need completion, but looking for interesting vulnerabilities or threats or techniques should happen before you write up your abstract and response. Presenting research at a conference resembles a senior thesis more than it does the term paper you banged out in an all-nighter the night before it was due.
For some things, this doesn't apply as much. Teaching basic techniques requires solid preparation but not research. For other things, it means everything. Conference-driven development] results in an overly-stressed hacker and inferior product.
Some conferences have ridiculously long lead times (I'm looking at you, RSA). I would never submit new research to that sort of conference, although a snapshot of ongoing study might work well. If many months will elapse between your submission and the actual presentation, try to submit something that doesn't require discovery of new knowledge in the intervening time. (Also see the reference to Miessler at the end of this post.)
I learned some hard lessons last summer. Besides learning the futility of conference-driven development, I also found that signing up for too much research at once can cause major problems. Last year, I committed to writing and releasing a whole new tool and polishing an existing tool for a fresh release. On top of that, of course, lay my personal life (family >> hacking) and my day job. While my research and work have lots in common and in fact support each other, I still had clients and deliverables.
Before sending several different responses to many conferences, think carefully about what would happen if several of them accept your proposal. In fact, even if you propose basically the same talk to multiple conferences, decide how much travel and presentation the rest of your life can support. A high acceptance rate sounds great at first. Take it from me, though: it brings its own set of challenges.
Sparse matrices have little value
Every CFP sets out a number of questions and fields.
FILL THEM ALL OUT. YES, ALL OF THEM.
Some of them may not take much (e.g. "no special equipment required"). But CFP organizers constantly emphasize the need to answer their questions completely, and with good reason. Not everyone does. Just answering everything automatically raises your chances.
Related to this: explain what you mean. Leave the mystery for the actual presentation, but not for the questionnaire and abstract. If the selection committee doesn't know what you want to talk about, they will move on to another candidate they can evaluate fairly.
Different conferences require different levels of detail, of course. Many of them just want an abstract and basically choose based on the combination of subject matter and speaker reputation. Others want two abstracts (short and detailed) plus an outline. Personally, I prefer the latter because it forces me to make sure I've done my homework in advance (see above).
Presenting your research or a solid explanation of little-understood techniques can mean real benefits for the attendees and for your own career. I don't just mean that in terms of publicity, either: forcing yourself to get the material in shape to show it to others means you understand it that much better yourself, too. If you put in the effort, it will pay off.
- Writing the CFP (Zach Holman)
- 4 Tips to Get a Conference "Call for Papers" Submission Accepted (Jeremiah Grossman)
- How do I make my CFP stand out? (Nikita)
- Create Good Security CFP Responses (Nathan Hamiel)
- The Hierarchy of Information Security Talks (Daniel Miessler)
- Dry Runs (Dave Aitel) added later