15 ms·
The unnamed Salesforce executive is said to have sent a text message to the duo half an hour before they were expected on stage to not to give the talk, but the
by kafkaesq 9y ago
The unnamed Salesforce executive is said to have sent a text message to the duo half an hour before they were expected on stage to not to give the talk, but the message wasn't seen until after the talk had ended.
Which said unnamed executive should have known was patently unreasonable to expect to be received and read in time.
Sounds like a failure in basic communication, somewhere in the organization. And if someone in the C-level feels they need to intervene at the last minute to set things straight -- this very strongly suggests point source of the failure was most likely somewhere in the middle layers (or at the C-level itself) - not with the frontline engineers.†
But which at Salesforce is apparently no protection against getting hung out to dry.
† Especially when we read the parts about "The talk had been months in the making" and that the executive pulled the plug at the last minute "despite a publicized and widely anticipated release."
- jacquesm 9y agoThere's a good chance that those guys didn't even have their phones on. If something is that urgent you don't text, you call, and if the call doesn't go through you find someone else that you can call who can go to the people involved and so on until you have guaranteed timely delivery and if you can't achieve that then you're going to have to live with the consequences. Doing a 'fire-and-forget' text message and then attaching grave consequences to the timing is ridiculous.
- dsfyu404ed 9y agoIt's defcon. There's a fair chance those guys locked their phones in the hotel safe.
- Sleeep 9y agoAny DEFCON attendee knows the hotel safe is a laughably insecure place to keep valuables.
- Spivak 9y agoSo they would never expect it!
- Sohcahtoa82 9y agoOh god... Reminds me of a friend who said his MySpace password was just "password123" because "It's such a stupid password that nobody would ever use it, so hackers don't even bother trying it!" I wish I had multiple faces so I could palm more than one.
- patcheudor 9y agoHere's what I do with my phone before heading to DEF CON (yes, I don't bother with burners anymore): 1) Make sure it has an Apple logo on the back and is up to date. I'm serious on this one. Too many Android phones don't get updated by the carrier and that's why I'm not a fan. Yes, if you have the latest phone from Google, you are fine. From another manufacturer, very questionable. The sheer number of Android phones which have connected to my open research WiFi networks over the years and exposed some secret is just tragic, from user PINs thanks to a carrier installed warranty app to e-mail passwords thanks to broken Samsung KNOX TLS middling implementations. 2) Shut off all background activity from apps when not on and in front of me: settings -> general -> background app refresh. Slide that one to off for everything. 3) Turn off WiFi and Bluetooth. 4) For added paranoia, put it in airplane mode when not being used. 5) Make sure it doesn't have any information or accounts on it which I'd not like to be made public. 6) Back it up. 7) A quick audit of apps I'll be using at the con to ensure they are reasonably secure on the wire by using working TLS exclusively. Yeah, very few people will ever do this but thankfully 1-6 should be sufficient.
- taneq 9y agoThanks for the rundown. What's your opinion on LineageOS, security-wise?
- patcheudor 9y agoHaven't looked at it.
- pawadu 9y agoLineageOS is pretty good on security and privacy. But IIRC you may NOT have the latest patches even if you have the latest version. There is a XDA post somewhere explaining this.
- pawadu 9y ago> Make sure it has an Apple logo From what I hear all those Chinese dissidents that are tragically no longer with us were all using Apple products...
- steveplace 9y agoI thought it was SOP to not bring your phones to DEFCON
- kafkaesq 9y agoRight - there's that, too. Maybe next time, Salesforce should think twice about sending its executives to DEFCON. Without some basic introduction as to what it's actually about.
- mortenjorck 9y agoFrom what I’ve read, all you really need to do is turn off wi-fi, which is already fairly paranoid given that no one is realistically going to burn a serious chipset zero-day on random people at a conference. Fake cell towers do occasionally happen but rapidly lead to arrests.
- lawnchair_larry 9y agoYou just made that up. There are fake cell stations every year, and there has never been an arrest.
- mortenjorck 9y agoI might be wrong, but I most certainly did not make it up. Will Strafach and Dan Tentler would at least appear to disagree with you: https://twitter.com/chronic/status/884434768380776448 https://twitter.com/chronic/status/884434768380776448
- lawnchair_larry 9y agoYou just pasted a conversation full of people saying that there are rogue base stations. And I don't see anyone reporting arrests!
- chinathrow 9y agoI do, if you scroll down a bit: https://twitter.com/Viss/status/884477320949506048 https://twitter.com/Viss/status/884477320949506048
- TallGuyShort 9y ago>> There's a good chance that those guys didn't even have their phones on. Nevermind the fact that it was defcon, I'm a regular presenter at conferences and meetups, and literally #1 on my last-minute checklist is to text my wife that I'm now unreachable and silence my phone.
- yellowapple 9y agoNevermind the fact that it was defcon. Having your phone on in a place where thousands of security experts are running amok is a surefire recipe for ensuing hilarity.
- joatmon-snoo 9y ago> Having your phone at all FTFY.
- busterarm 9y agoMan, I missed so many good party invitations at Defcon this year just by not checking Facebook until Sunday night!!!
- Piskvorrr 9y ago"Come to Dark Alley 2b, totally great party!!!"
- erik_landerholm 9y agoYes! A million times, yes! Defcon is the only Vegas conference I ever bring a burner too.
- vacri 9y ago> If something is that urgent you don't text, you call SMS is UDP, and voice is TCP?
- amagumori 9y agop good analogy, people will generally ACK a phone call since it implies a higher level of importance and could be about anything under the sun, but right before giving a talk at a conference i think most people would drop that text message UDP packet.
- Piskvorrr 9y agoThey usually ACK...on the happy path. They might RST, for one, or even timeout.
- mattm 9y agoIt's possible the executive knew they wouldn't see it and thereby could then use it as an excuse to fire them.
- doktrin 9y ago> Which said unnamed executive should have known was patently unreasonable to expect to be received and read in time. As others have mentioned, this is Defcon - it's very common for folks (myself included) to go dark while on premises. At one company I worked for that was actually handed down in the form of policy & attendance guidelines. Not only that but the executive in question was physically present and watching the talk. If this was so critical as to warrant the immediate termination of two senior team members, then I have to believe it was critical enough to go talk to them immediately prior or even during the talk if necessary. The entire chain of events makes no logical sense, and does not inspire much faith in the Salesforce executive team.
- Piskvorrr 9y agoIt does make perfect logical sense - as soon as you exclude the requirement "acting in good faith".