4 ms·

Private presentations of things that will be made public are often a win win for researcher and industry. It might even be an education for an industry that ha

Private presentations of things that will be made public are often a win win for researcher and industry. It might even be an education for an industry that has historically not taken security seriously. In this particular case, though, I do detect a principle from the author even though you don't. The gist of the article seems to me to be that the GSMA is seen as a "bad guy" with corporate self interest first over public good and their interest in the talk is to get info (unsaid but presumably to give grounds for an injunction) rather than to get patching...?

tptacek 10y ago
Right, so don't present to the GSMA for free; offer an exorbitant but plausible rate for the presentation.
- willvarfar 10y ago
  And if they are seen as the "bad guy" then refusing is a principled thing to do...?
  - nickpsecurity 10y ago
    Then that person is naive. The people at these conferences are just employees of companies doing their job. They're there to network & discuss issues. The reception of such a presentation would range from apathy to interest in fixes depending on which participants we're talking about. Theres a small chance of some changes happening. Whereas, that same presentation delivered to people outside the industry has near-zero chance of changes happening. I'm not seeing the conference participants as the "bad guy" if they wanted the hacker to teach them about the problems. I'm not going to say the hacker was the "bad guy" either so much as taking a selfish strategy that only reinforces the problems they research and present on.
    - willvarfar 10y ago
      My personal experience of these kinds of industry groups is that the participants who are technical and mean well are misunderstanding their part in the committee and eventually get replaced by political non-techies who better act in their companies interests. Sad but routine.
- micaksica 10y ago
  The GSMA could attempt to frame this as an extortion attempt against the company, as you have sensitive information you are asking them to pay for that you will be releasing to the public. How do you protect yourself against an angry consortium with deep pockets?
  - delinka 10y ago
    There's a difference between "publication" and "presentation." Have the potential client acknowledge this in writing. You get paid for "presentation" of the material. It'll be "published" for anyone to read after the paid public "presentation" next month.
  - raesene9 10y ago
    If they asked him to present, replying with "Sure I'd be happy to present, my fee is $xxx" doesn't seem likely to be construed as extortion and more than any other speaker charging for their time (be that research time, speaking time or both). If he had approached them cold it may have been a different matter, but that's not what happened here.
  - tptacek 10y ago
    No they wouldn't; in fact, if they attempted to claim that a demand for payment for a private presentation was "extortion", it might actually be their organization that ended up with legal liability, since that sounds an awful lot like per se commercial defamation. You can't "threaten" someone by refusing to give a presentation to them.

tptacek 10y ago

Right, so don't present to the GSMA for free; offer an exorbitant but plausible rate for the presentation.

willvarfar 10y ago
And if they are seen as the "bad guy" then refusing is a principled thing to do...?
- nickpsecurity 10y ago
  Then that person is naive. The people at these conferences are just employees of companies doing their job. They're there to network & discuss issues. The reception of such a presentation would range from apathy to interest in fixes depending on which participants we're talking about. Theres a small chance of some changes happening. Whereas, that same presentation delivered to people outside the industry has near-zero chance of changes happening. I'm not seeing the conference participants as the "bad guy" if they wanted the hacker to teach them about the problems. I'm not going to say the hacker was the "bad guy" either so much as taking a selfish strategy that only reinforces the problems they research and present on.
  - willvarfar 10y ago
    My personal experience of these kinds of industry groups is that the participants who are technical and mean well are misunderstanding their part in the committee and eventually get replaced by political non-techies who better act in their companies interests. Sad but routine.
micaksica 10y ago
The GSMA could attempt to frame this as an extortion attempt against the company, as you have sensitive information you are asking them to pay for that you will be releasing to the public. How do you protect yourself against an angry consortium with deep pockets?
- delinka 10y ago
  There's a difference between "publication" and "presentation." Have the potential client acknowledge this in writing. You get paid for "presentation" of the material. It'll be "published" for anyone to read after the paid public "presentation" next month.
- raesene9 10y ago
  If they asked him to present, replying with "Sure I'd be happy to present, my fee is $xxx" doesn't seem likely to be construed as extortion and more than any other speaker charging for their time (be that research time, speaking time or both). If he had approached them cold it may have been a different matter, but that's not what happened here.
- tptacek 10y ago
  No they wouldn't; in fact, if they attempted to claim that a demand for payment for a private presentation was "extortion", it might actually be their organization that ended up with legal liability, since that sounds an awful lot like per se commercial defamation. You can't "threaten" someone by refusing to give a presentation to them.