While that's probably good advice for someone starting out, I've spoken several times at Security B-Sides and at a few tech events in downtown Orlando. The rej

While that's probably good advice for someone starting out, I've spoken several times at Security B-Sides and at a few tech events in downtown Orlando. The rejection reason I'm always offered (when I actually receive one) is a watered-down remix of the following: Your talk idea was excellent and highly rated! But we have previously obligated ourselves to representing the big name projects in the community, so we're instead going to give this spot to someone who wants to talk about a trivial improvement to Drupal or something only relevant to WordPress freelancers. Also, we already have an all-day security training and our judges toss cryptography in the same general category, so we consider it redundant. (This is obviously editorialized.) There's been a lot of talk about fixing a persistent cultural problem in the PHP community, where it's always the same speakers at every PHP event. And conference organizers pay lip service to wanting to do something about it. But then they turn around and invite the same people to do the same talks/training and then block off entire categories from being spoken about by anyone else. That's the part that actually annoys me: "We're working on this problem, but not really." As far as infosec conferences go, I've had schedule conflicts with everything except DEFCON and Black Hat, so being rejected there is probably just, "You're aiming too high. Try again in 10 years when you have real skills." (That being said, my DEFCON Crypto & Privacy Village talk hasn't been rejected yet, so 20 months might end up being my high score.)