Yes. After the event was over, I asked him what he had been working on, it was some code to identify what sort of buffer he had just opened (secure v. insecure, I don't remember the details)

I would call that hacking in Elisp, not on Elisp, which is why I asked.