When ShmooCon ticket sales go well, we’ll get a few comments on scarcity of tickets or maybe some statements of disbelief about the time it took, but it’s all quite minimal. When ticket sales don’t go well, the volume of the comments goes to 11 and the topics run the gamut. Ticket sales didn’t go well for round 2 this year (in fact, we’re still trying to figure out our next steps) and we’ve had some good discussion with folks in the aftermath. However, it’s clear that we need to do a better job of communicating our overall philosophy on ticket sales to help clear up confusion, elicit feedback from the community, and to continue to be transparent about what we’re doing.

First, and foremost:

It’s important to us that everyone understands that the issues we are having this year are due to load and the inability of our set up at the new hosting companies (remember there have been two now) to handle things in a matter that meets our needs. We moved our website this year hoping to make the job of updating and maintaining shmoocon.org easier as the old site was becoming unmanageable and had too many quirks to count. We thought we had done our homework regarding load on sales days but clearly we fell short.

Our actual ticketing system, which resides back on our own servers, is working as it has for the last few years now, which is to say it’s functional and quick – if only you could get to it.

The most common question we get asked is:

  • Why do you do this yourself? (And the corollary, “Why don’t you just outsource ticket sales?”)

There are a number of reasons. We’ll run through these in no particular order.

Your Privacy
We limit attendance. That’s part of ShmooCon. Because of that, we can’t simply take cash at the door. We need to sell tickets in advance, which means we have to take some of your info in order to process a credit card sale. We are our own merchant. We have a merchant account with a card processor and clear all credit cards ourselves.

What’s interesting about cards is that card processors aren’t really allowed to do anything directly to you based on your use of a card. They can’t mine the data and send you ads for things you might want to buy, they can’t resell all your info to people for demographic purposes, etc. They have regulatory handcuffs that attempt to preserve some of your privacy.

Merchants don’t have those handcuffs. We all know how big companies will mine your purchases and suggest new things for you to buy. Other companies will resell your info. We’re the merchant here. We don’t want to know who you are. We want you to buy a barcode and come to the conference. Ideally we’d never even have to know your name and email, but we need those to handle troubleshooting and to track down transactions in the event something goes wrong. Beyond that, we don’t upsell to you, we don’t sell you, and we try to have your back.

There are lots of ticket companies out there that would be happy to have our ticket sales business. Not only do they get a cut of the transaction, they also get all of the information about you and get to keep it to market to you later… or sell it… or lose it in a breach. There’s a big privacy tradeoff that goes on when we go to 3rd party providers and we’re not sure we want to do that. We have a photo policy, we run our own ticketing, and we allow anyone with a barcode to show up and attend. We try to hold a reasonable line on privacy, even when our privacy is being eroded every day.

Cost
Turns out, third party ticket processors are expensive. One company, for instance, takes in total 5.5% + $1 for each ticket sold. On a $150 ticket, that’s $8.75 a ticket. When you handle ticketing directly like we do, we’re only paying $4.70/ticket in fees. Looking at 1500 general admin tickets, that’s greater than $6k in extra fees. Yes, we could raise ticket prices to account for the difference, but that doesn’t change the fact that using a 3rd party ticket sales company doubles the fee on the ticket. It’s more expensive for all of us when we don’t do it ourselves.

We Control the Outcome (we can ensure fairness)
People try to game our system. There are scripts, bots, people looking for side doors, and even some ritual sacrifices people are making in an attempt to get tickets before others do. We’ve created a system that is a simple queue. First come, first served. When the load is high (i.e. when there is FAR more demand than supply) this queue is remarkably effective at leveling the playing field. Sure, each round we see people with scripts successfully get tickets. But we also see people with iPhones and people from a variety of countries get tickets too.

Before we release tickets to be paid for, we inspect the registration run to look for signs of shenanigans. If we see something unfair, we address it. In the spirit of hackerdom, if someone gets a ticket by a previously unknown issue with our system, we’ll usually honor the ticket and close the door at the same time.

We have a custom built system that allows us to enforce our definition of fairness on the sales process. If we outsource that, we put total faith in other people’s systems. We lose the ability to inspect what has occurred. Maybe these other systems are as fair as ours. Maybe not. At least with our own system, it’s the devil we know and we can poke it.

Having said all that, you should know that we are talking to several of these ticket management companies to see if and how they can help. While they do cost more and we have our privacy concerns, there’s something to be said about going to a platform that, in theory, can handle the load and manage the sales. We’re not sure how this will pan out, but we are mindful that we are causing an inconvenience to our attendees and distracting ourselves from the other parts of running the con. As outlined above there are important tradeoffs in going with a 3rd party, and we want to make sure we have correct information in order to make the best decisions. We will keep you posted.

Because We Want To
ShmooCon is a labor of love for the volunteers that run it. There’s a sense of pride that we can (usually) run sales successfully to completion. It’s a mad, mad process, and it’s a real adventure to make it work. We’re technologists at heart and honestly as stressful as it is, it’s an enjoyable system to run from a geek’s perspective.

Some other points we’d like to hit on:

 

Load
Again, load is what’s causing all the trouble this year.  Even on a log scale, our traffic pattern is just stupid. On any given day, we may see 2 or 3 thousand requests against the webserver. For round 2 when the server buckled, we saw 888,000 requests in an hour. We know that on the face of it this sounds like a perfect time to go “To The Cloud!” and that yes, we could build a huge elastic thing to handle this.  It’s not, however, realistic for us to maintain that system all year. Plus, there are certain problems in this mix that a c1.xlarge doesn’t solve. What we really need is a system that can handle this load for a minute or two a year and do it in a cost effective way and manageable way.

 A Lottery
Numerous people have suggested we run a lottery. It’s a great concept, and we’d love to find a way to run a lottery that is fair to everyone. However, there’s a core problem around identity proofing we can’t solve. For instance:

If all it takes is an email to register for the lottery, then people can make tons of emails and effectively stuff the ballot box. This model favors the asshole.

If we ask people to “buy” a lottery ticket for $1 and limit it to one ticket per card, people with many cards (or many friends willing to help out) can stuff the ballot box. This model is biased against groups of people like students, lower income folks, and frankly those without a large network of credit card handing over friends.

If we ask for your actual identity to register for the lottery and compare it at the time of sale and at the time of attendance, we’ve lost all the anonymity we were trying to have. Also it will substantially slow down onsite registration, and further it is biased towards those with government issued ID’s (which we have no way to truly verify anyway, not to open up that can of worms). Add to that, we don’t feel like you should ever have to show an ID to attend ShmooCon except in a few cases where a ticket is deemed non-transferable or we’re trying to resolve an issue like a lost ticket.

If anyone has ideas on how to do identity proofing in a lottery that doesn’t bias towards one group or another, we’re all ears.

Rights of First Refusal
This suggestion comes up from time to time. The idea is that people (either some or all) that have attended in the prior year of ShmooCon get first opportunity to attend again the next year. There are a few issues with this. First, we don’t track who actually attends (we really only know who pays) so we would have no way of determining who should attend in future years. Further, infosec gets a pretty rough rap for being cliquish. Inviting the same people over and over would actually define a clique. This sounds like an interesting experiment but it’s not something we’re going to do with ShmooCon.

Moving Forward:

We’re committed to getting a workable solution in place ASAP to close out sales for this year. We are actively investigating a few options and will make a decision soon. Whether or not this decision carries us into future years remains to be seen. We are certainly frustrated with the current situation and are working hard to rectify it quickly.

Please let us know if you have any ideas or suggestions. We’re definitely open to your input and welcome feedback. Thanks again for your support.