Exactly. It's actually great that DevDays was able to charge only $99 AND compensate speakers and workers+! It actually means they one-upped Defcon in that regard.
BlackHat-caliber conferences, as you imply, will come over time as Defcon-caliber conferences explode in popularity.
Again, I know next to nothing about DevDays, and I could be totally off the mark. But it seems to me, like others pointed out, Joel tried to do too much too quickly. Jeff would have had a tough time getting BH off the ground after just two years of DC.
+My assumption here is that by stating Defcon was NOT able to do these things, DevDays was. Sorry if I misunderstood that.
To be fair, venues for conferences don't really have obvious economies of scale: not only do larger conferences often cost more per person, but the quality of the venue and the "rowdiness" (for lack of a better word; arguably the "liability" ;P) of the crowd drastically changes things.
For example, if I wanted to a one-day event with a bunch of reasonably happy low-key developers, it is quite easy. Starting on the small end, with something like 5 people, I can do it in my apartment (and people often do this, for small "meetups"), and if we went up to 10 people, everyone could come to my office.
Even if I wanted something just a touch larger, the venue costs are still going to stay near zero: if I wanted 20 people, I could borrow someone's conference room, and if I needed to go up to 50 people I know someone nearby who would probably loan me their auditorium/theater setup.
With 1-300 people (most conferences), there are lots of choices, from hotels to "community centers": often these are really cheap ways of getting a bunch of people to be able to congregate. If you have a tech conference, you might even be able to get really good rates on something like the eBay "Town Hall".
However, DEF CON is simply /not like this/. DEF CON is a four-day conference set at a fancy hotel in Vegas. This year, the estimated attendance was 10,000 people; and these are not just your "quiet developer type": these people (while largely not gambling, which is important), are drinking constantly and hacking stuff.
Yes: /hacking stuff/; like the elevators, which were half offline for a day because someone was trying to mess with them (I'm certain their other guests were not happy about this); or the lighting/sound system, which someone managed to find out had a default password, so someone central control and would cut the speaker's mic at just the right moments to drive them most crazy.
I kid you not: the point-of-sale terminals at the hotel were offline for a while one day because someone took them offline; there were rumors at the conference that someone had setup a "rogue 3G cell" (to sniff unencrypted connections; apparently people used to do similar things often at previous events), and everyone who attends the conference simply "knows" that you bring enough cash to never have to use the ATMs at the hotel: they are probably skimming cards.
And yet, this event is still managed to be run for only $150/person. Insane, huh? ;P Frankly, I have a ton of respect for how DEF CON is able to scale with this kind of insanity, and not run anything but a horrible loss (and for all I know, they do).
Black Hat: 4 locations?, 4-figure attendance fee, significant speaker compensation, significant full-time paid staff.
It took several years of Defcon before Jeff could start Black Hat and go full time to build it.