11 ms·

DEF CON's response to the badge controversy

274 points by mmastrac 2y ago

mmastrac 2y ago
There's basically three sides to the story now, for reference: Entropic statement: https://www.entropicengineering.com/defcon-32-statement https://www.entropicengineering.com/defcon-32-statement dmitrygr statement: https://news.ycombinator.com/item?id=41207469 https://news.ycombinator.com/item?id=41207469 dmitrygr being removed: https://x.com/dmitrygr/status/1822124650547257637 https://x.com/dmitrygr/status/1822124650547257637
- sergiotapia 2y ago
  tldr: entropic made some mistakes because they're a small team with a very tight deadline. defcon shit the bed and refused to pay them over those problems. and dmitry forgot about an easter egg and was OK with being removed from speaking, but wanted security to pull him off stage for his clout. I still think DEFCON should've done better. their brand is in the shitter over what $20k?
  - tptacek 2y ago
    What should they have done better? They didn't have the option of doing better with Dmitry, right? He deliberately set up the confrontation with security. The idea that DEF CON's brand is "in the shitter" seems risible. I say that ruefully, as (in my declining years) I get more and more bitter about the comic convention spectacle the event has become. Whatever the outcome from "badge-gate", I assure you, they'll set attendance records next year regardless.
    - ibash 2y ago
      > They didn't have the option of doing better with Dmitry, right? Let him give his talk like they promised. Given literally everyone in that room is using his work in that same moment and they are literally there to hear him speak.
      - tptacek 2y ago
        Fuck no. People don't get to re-invite themselves to stages they've been disinvited from.
        mynameisvlad 2y ago
        You asked someone to give you options and they did. Just because you don't like it doesn't mean it's not what you asked for.
        aaplok 2y ago
        OP asked for a better option. He was offered one, which he disagreed with. Because he doesn't like it precisely means that (in his view at least) it is not what he asked for.
        tptacek 2y ago
        I take their point; I didn't mean to be slapping back at them for taking the time to write a response!
        aaplok 2y ago
        Your point was valid though. You can't let someone rock up to the stage uninvited. This would open the door to all kinds of issues. And the original question of how the situation could have been handled better is the most interesting one. The rest is a game of he said/she said, which hn commenters tend to enjoy arguing about but is ultimately not very instructive. With hindsight it is clear that the situation had been brewing for some time, and the conflict had been escalating slowly. Perhaps due to the pressure and stress (and time pressure) of organising an event like that nobody managed to have enough distance to deescalate it, which culminated in someone being escorted off stage by security, not a good experience for anyone. Most likely once the invitation to talk had been rescinded the dice were thrown. It would have been hard for the speaker not to be offended, and unfair on him to expect him to take it quietly and move on without reacting. Someone should have been aware of that and worked with him to control the impact of this on his own reputation.
    - tedunangst 2y ago
      I would simply level up charisma and speech check him off the stage.
    - josephg 2y ago
      It was a huge mistake to uninvite him from the session. It sounds like defcon was mad at EE for going over budget - which honestly is fair even though they didn’t handle it well. And thought (wrongly) that Dmitry was a salty subcontractor of theirs. Their actions make some sense in that context. Not great, but eh. But Dmitry has totally owned them in messaging - by forcing them to physically eject him (making a scene), and getting out ahead of the story. It’s great drama. He’s positioned defcon to look like an evil corporate buffoon hating on a hacker who was just donating his time. At this point, defcon should take the L and apologise, and let him have a session talking about the code. That would be a very satisfying end to the drama for attendees. (Even if it does encourage more drama in future years.) Either way, I agree - I’m sure attendance will go up next year too. People love this stuff.
      - tptacek 2y ago
        It sounds to me like they were mad at Dmitry for including an "easter egg" in their badge firmware that solicited donations to a Bitcoin address.
        josephg 2y ago
        Yep. Given that they thought Dmitry was a subcontractor of EE, them being mad about that makes a lot more sense.
        Dylan16807 2y ago
        It was definitely an easter egg. A secret screen that gives credit to someone that worked on a thing and otherwise wouldn't get credit is the textbook example of an easter egg. It probably shouldn't have had the Bitcoin address, but it doesn't sound like that would have been treated much differently.
        tptacek 2y ago
        I think you're going to find that firms who contract embedded designs have viewpoints about "easter eggs" that would be surprising, even off-putting, to message board communities that savor them like single malts. Generally, when firms arrange to deliver hardware/software to their own customers sourced from vendors, they want a clear understanding of what the software actually does.
    - hnthrowaway0315 2y ago
      I'd like to ask as someone who is interested in RE/Security/Malware in general but without experience. Which events are good for me if I have to pay out of my own pocket? I don't work in related fields so education stipend does not apply. I surveyed the ground tonight and found two that are interesting: Recon (in Montreal) and CCC (in Hamburg). What do you think?
      - tptacek 2y ago
        I think CCC is basically in the same bracket as DEF CON in terms of seriousness. Someone's going to get mad at me for saying that, but I'll note that serious people go to DEF CON too, even though it is 100% a cultural event and not a real part of the cite record for our field. I've never heard anyone say anything but good things about REcon. I have FOMO about having never been.
        hnthrowaway0315 2y ago
        Thanks for sharing. I'm actually close to Montreal so REcon is probably my best bet. The ticket is more expensive but I save lodging and transportation.
        thequux 2y ago
        Hugo, the organizer of Recon, has historically been willing to work with people who are attending on their own dime. I suspect that if you were to send him an email explaining your situation, you'd be very happy with the response you received. It is an excellent conference that I've enjoyed every single time I've gone
        hnthrowaway0315 2y ago
        Thanks a lot! I'll definitely reach out to him next year.
    - busterarm 2y ago
      > The idea that DEF CON's brand is "in the shitter" seems risible. Is it though? With 20+ attendances behind my belt, I was already sour on the experience at 2018 and didn't go in 2019 due to a family conflict and haven't been back since. Not only did "badgelife" absolutely ruin the whole fucking experience, but I started seeing large numbers of people start getting othered and excluded because of running afoul of idpol which IMO is entirely counter to the spirit of what the con had always been about. It permeates throughout the meta events of the con, like Ollam's Shoot, where you're warned very much in advance with overt threats to not express an opinion that even remotely smells right-wing while his staffers proudly wave antifa banners and shout the merits of being radleft. At the same time, my experience with the security industry as a whole is that most vendors are completely full of shit and spend all of their time chasing after fake clout (and all of the shady bullshit that goes along with it).
  - BoredPositron 2y ago
    Honestly sounds like typical "CON" stuff. Just children all around no matter the topic.
    - sergiotapia 2y ago
      my perception of them was they are hyper intelligent hackers, who have morals and clear north. if anybody would do the right thing it's these guys. but that illusion is no more. they are just normal dudes after all for better or worse.
      - NegativeK 2y ago
        I'm not sure if you're referring to the badge team or the Defcon people, but pretty much every group is just normal people.
    - Aeolun 2y ago
      That’s because that’s ultimately what happens everywhere. We just paper over it by paying people for their time so they have to listen to you. When you go back to being all volunteer driven the drama increases correspondingly.
    - numpad0 2y ago
      >90% of the world is run by dumb unqualified children. It's not worth trying to get everyone up to your supreme standards(you'll get it later at no cost).
  - ryandrake 2y ago
    Reading both accounts of the story, it sounds like a small company bit off more than it could chew, couldn’t manage cost and schedule, and when it got to the drop-dead date, even though they say it was basically done (how many times did the client hear that one), the client pulled the plug and tried to salvage it some other way. Y’all need project managers, at least someone with a plan! jeez.
    - A4ET8a8uTh0 2y ago
      I think I agree with the assessment. Especially the part about PM hits close to home. It seems how a lot of projects I was involved lately lacked an actual project manager. Is the problem that it is a hard job to do right?
      - theshrike79 2y ago
        The thing is that people on here think project managers are evil incarnate and just useless middle management. It requires a very specific skill set to be able to lead a technical project and cut through the bullshit on BOTH SIDES: the client asking for features and the team building the product. Clients always either ask for stuff they don't really need or have vague requirements that crystallise only 3 days after the deadline. "Of course when we said it needs to do foo, it also MUST do bar, doh!" And teams tend to overestimate their ability to deliver and underestimate the work needed to get to the finish. (Infinite coast problem).
        q7xvh97o2pDhNrh 2y ago
        There's also several more classes of B.S., for what it's worth. An exaggerated/anonymized version of a recent one I got, from an otherwise-really-strong senior engineer: "Of course when I said we would put a button there, it also meant we MUST build an entire UI framework from scratch, with full test coverage for the entire thing!" ...actually, that's not even that exaggerated. Shipping software at big companies can be unreasonably difficult, sometimes.
        2y ago
  - viccis 2y ago
    >dmitry forgot about an easter egg Ah yes, classic "insert an unauthorized coin wallet soliciting money from badge owners" easter egg. Timeless prank, how could anyone be mad at such a normal and anodyne "easter egg"? lmao DEFCON's "brand" isn't in any danger. edit: And now he's pulling the classic hacker move of (checks notes) enforcing strict software IP ownership rights? Guy's a class act all around. Hope everyone learned an important lesson about Dmitry and Entropic with this mess.
    - josephg 2y ago
      He wasn’t employed by anyone, and didn’t get paid by anyone for his work. (Defcon is wrong about this in their statement, and admitted as such in the comment thread). When I write code that nobody is paying for, you better believe I’ll write it how I damn well please. If you aren’t paying, you aren’t the customer. And you don’t get to control the output of my work. The wallet address soliciting donations is for the hardware company, not on his own behalf. But even if it was on his own behalf, would you still be mad? Since when is it a crime to be proud of the code you’ve written, for free, to bring joy to an hacker conference? That deserves mad credit in my book.
      - viccis 2y ago
        I don't really care whether money changed hands. Secretly putting an ad into software that you know will be distributed to many people is the oldest scumbag move in the scumbag book. All sympathy ended there, and that was weeks before he trespassed.
        josephg 2y ago
        Eh. When I was young, I played a demo of Doom that came with a magazine. When you finish the demo level, the game show an ad that said if I ponied up money, I could play the whole game. I fail to see the problem. And in this case it wasn’t an ad. It was a page saying you could donate to the hardware company if you want, who were out of pocket $100k for making the hardware. That’s an incredibly tame prank by Defcon standards.
        2y ago
  - deleted 2y ago
    [deleted]
- simpaticoder 2y ago
  Thank you. This stood out to me: "They expressed that they specifically wanted to work with us as a woman-owned, queer- and POC-driven engineering firm to develop an electronic badge with a gaming element for this year’s conference." I would have expected the core criteria to be ability to execute on time. Choosing an engineering firm based on the race, gender, or sexual orientation of the owner is foolish, and DEF CON is ultimately to blame for introducing superfluous criteria and missing the core criteria.
  - kcmastrpc 2y ago
    [flagged]
  - cj 2y ago
    That sentence seems like the most irrelevant part of all of what I’ve read. They could have easily rephrased that sentence to simply say “They expressed interest in working with us” and the point they’re making is the same.
    - echoangle 2y ago
      Isn’t the implication of the sentence that they were chosen specifically for those properties and wouldn’t have been chosen otherwise?
      - superb_dev 2y ago
        The implication is that they were chosen because of that, but not that this was the only qualification. It could easily be that multiple teams looked qualified during bidding for the job and that this was the distinguishing factor.
        simpaticoder 2y ago
        [flagged]
        2y ago
- neilv 2y ago
  Regarding "https://x.com/dmitrygr/status/1822124650547257637 https://x.com/dmitrygr/status/1822124650547257637", was there some kind of written consent involved in being removed like that? Or some less formal consent was understood, and considered low-risk? Or were they otherwise legally empowered to do that? (I'm thinking about civil and criminal liability.)
  - metadat 2y ago
    It's a private event on private property. There is no inherent right to be there, especially up on stage without invitation (TFA mentions this was what happened).
    - neilv 2y ago
      I'm wondering how the organizers of an event cover all the bases sufficiently on something like that. I'm asking out of curiosity about how that actually works, in practice, not what arguments we could imagine. (For example: Say, someone rushes up on stage during a rock music concert. Was removal covered in the fine print terms of the ticket? Are the security personnel deputized by local law enforcement? Are there special ordinances applying to security at some kinds of events? Do the event organizers fall back on the claim that they felt safety was threatened? Do the event organizers think any risk of penalties or lawsuit is less than the cost of disrupting the event? Does setting precedent for response also factor into the calculus? How is insurance and venue contracts involved? Etc. There's a some related history, involving the Hell's Angels at a concert, but I don't know how practice has evolved since then.)
      - lukan 2y ago
        I only know german law from a short time as a security, but I assume it is quite similar: Cops do not want to be called for every bouncer action. The owner (or the one renting the property) has legal rights and set the rules. You break the rules, by beeing somewhere you are not supposed to be - any staff member can act as security to physically remove you. They may not beat you, though. Or otherwise act escalating. But forcefully leading (or carrying) out someone breaking the house rules (by using minimum of violence) is legal and standard procesure on every big event.
- perihelions 2y ago
  [flagged]
  - whamlastxmas 2y ago
    The vast majority of news is non-actionable information, and most of it is written with enough bias and hidden motivations to the point of effectively not even being true
  - firesteelrain 2y ago
    I love this take. Thank you
    - deleted 2y ago
      [deleted]
tptacek 2y ago
I believe DEF CON on this, because the other side of the story --- that they vindictively withheld payment from Entropic and later harassed the firmware developer --- just doesn't make any sense. We are probably talking about rounding error sums of money for the conference organizers themselves.
- gavinhoward 2y ago
  National politicians have taken bribes for less.
  - woodruffw 2y ago
    National politicians have legible incentives. What’s the incentive for DEF CON here? It’s not like they’re apart from the community; people know exactly who they are, and the existence of their conference is tied entirely to the community’s perception of their leadership.
- JonChesterfield 2y ago
  People do petty stupid things. My priors align with the client having unreasonable expectations and then squabbling over the inconsequential bill. That is totally a thing that clients sometimes do.
  - tptacek 2y ago
    Having spent a very long time as a consultant, a thing vendors sometimes do is commit to unrealistic project schedules and then attempt to invoice their way out of the hole they've dug for themselves, and by "sometimes" I mean "every times, every of the times", it is one of the most common ways consulting projects blow up. When your project blows up, the professional thing to do is to resolve the problem with the client before billing another hour over the SOW. The common, crazy thing to do instead is optimistic invoicing: the client must share our priors, we're all reasonable people, so we'll just implicitly revise the SOW to match our learnings on this project and proceed, prioritizing what we believe would be a successful delivery of the project over everything else. That rarely works. Serious consultancies routinely eat billable weeks of time in order to meet client success criteria and retain relationships.
ionwake 2y ago
[flagged]
- tptacek 2y ago
  In any message board dispute you can generally work out who the underdog is and bet on things "not looking great" for whoever their adversary is.
- RandomThoughts3 2y ago
  It doesn’t look great for DEFCON in that the whole thing seems to have been widely mismanaged from the choice of their partner up to the timeline for what is in the end a bunch of badges. The rest is just a whole lot of finger pointing with very little in the way of actually verifiable facts.
bawolff 2y ago
If the "joke" involved shilling for crypto, that instantly makes me more sympathetic to the defcon side.
- lowkey 2y ago
  I genuinely don’t mean to be snarky but I don’t think the method of soliciting donations is at all relevant here. It sounds like you would have otherwise been fine if he handed out a hat and asked for cash in USD.
  - lmm 2y ago
    Are they wrong? Passing around a hat for USD might be unprofessional but it's a lot more open and honest.
    - kelnos 2y ago
      How so? The inappropriate act in question is soliciting donations; the method to transfer the money for those donations is immaterial. I have a dim view of cryptocurrency in general, but I don't see how that fact of it is relevant.
      - lmm 2y ago
        I think soliciting donations via something hidden/obscure/confusing is a lot more dubious than soliciting them openly. And the very act of using crypto suggests that you're doing something that you know is wrong.
  - superb_dev 2y ago
    Crypto has a bad reputation, it makes sense to be more upset about someone soliciting donations in crypto over USD. Especially in a branded product
    - mouse_ 2y ago
      I mean... it makes sense that internet people would be interested in donations by mean of internet currency.
aaron695 2y ago
[dead]
drno123 2y ago
[flagged]
mvdtnz 2y ago
This is a great example of why both sides of a story are needed. From DEF CON's perspective, assuming this is all true, there's nothing unreasonable here. It sounds like Dmitry was a subcontractor of Entropic and producing a screen asking for money after their contract had been terminated (for good-sounding reasons) was bad form. I'm not commenting on the legalities (I don't know anything about contract law) and I don't necessarily take either side's account at face value, but this response doesn't sound unreasonable to me.
- notinmykernel 2y ago
  Dmitry didn't ask for money. He raised awareness that DEFCON had slinked away from its financial obligation to Entropic, and asked that Entropic be paid what they are owed for their work on the hardware. Cool spin though.
- mintplant 2y ago
  Dmitry was a volunteer and did all the firmware work for free. "Subcontractor" is DEF CON PR spin.
  - yunohn 2y ago
    Who forced him to do all this work, if neither DEFCON nor EE were employing/contracting him? Why was he even given access to this project then?
  - lolc 2y ago
    If we believe the firmware's author that it was volunteer work, who was relying on him? Entropic or Defcon? Did Entropic promise to deliver the firmware? And assuming Entropic did promise a firmware, would the "stop work" order also affect firmware? Apparently the "easter egg" was added after that order.
    - cdchn 2y ago
      >If we believe the firmware's author that it was volunteer work, who was relying on him? Entropic or Defcon? This really is the fulcrum of which way this drama tips.
timthelion 2y ago
Am I the only pne who lmthinks it is rediculously wastefull to have electronic badges for all atendees?
- wmf 2y ago
  It's a form of swag and one of the reasons for attending.
- cdchn 2y ago
  No, when the point of the badges is to hack and repurpose them, they're arguably _less_ wasteful than a simple paper & plastic badge.
  - kelnos 2y ago
    I don't disagree with the joy in producing these kinds of badges, but I do wonder how many people actually do anything with them after the conference, aside from tossing them on a shelf to collect dust for years. Which IMO is genuinely sad! But I suspect that's what happens to the majority of them, even considering the type of person who attends a conference like DEFCON.
- JKCalhoun 2y ago
  From the outside, it certainly looks to me like the whole badge thing has become a monster. Something that began as cute, clever — but one-upmanship over the years has taken a toll.
mvdtnz 2y ago
This is a great example of why both sides of a story are needed. From DEF CON's perspective, assuming this is all true, there's nothing unreasonable here. It sounds like Dmitry was a subcontractor of Entropic and producing a screen asking for money after their contract had been terminated (for good-sounding reasons) was bad form. I'm not commenting on the legalities (I don't know anything about contract law) and I don't necessarily take either side's account at face value, but this response doesn't sound unreasonable to me.
- theogravity 2y ago
  Dmitry has repeatedly stated he was not hired by Entropic nor was asking to be paid for his work. He did it for fun. I'm not sure where this misunderstanding is coming from.
  - luckylion 2y ago
    He apparently put in extra code showing a wallet address (presumably his) and the request to "donate". Does sound like "asking to be paid", even if it's then switched to "it was all a prank, bro" when it turns out that wasn't the greatest idea.
    - kelnos 2y ago
      The wallet address he put in there was Entropic's, not his own. He was soliciting donations for Entropic, presumably because he was unhappy that DEFCON stopped paying them.
    - theogravity 2y ago
      From what I've read, it's very difficult to access the easter egg. It's not clear if the address belongs to him or not. Despite that, he has refused donations the entire time.
      - JoshTriplett 2y ago
        > From what I've read, it's very difficult to access the easter egg. The reports I've seen have said "Go to the about screen and press the select button". That's not difficult.
dang 2y ago
Previous related thread: Defcon stiffs badge HW vendor, drags FW author offstage during talk - https://news.ycombinator.com/item?id=41207221 https://news.ycombinator.com/item?id=41207221 - Aug 2024 (118 comments)
briandear 2y ago
What’s a badge and why does it need firmware? This is a conference right? Not a nuclear silo?
- ironhaven 2y ago
  DEF CON as a hacking convention has a long tradition of sometimes instead of giving printed name tags during registration like normal conferences but printed circuit boards with microcontrollers and firmware (aka software). Some years had ctf challenges in the firmware this year there was a playable game boy emulator.
mafuyu 2y ago
Reading EE and DEFCON’s statements, I’m inclined to think whoever was managing this on DEFCON’s side was not on top of things and blinked at the last minute. I’m sure there were delays and issues on EE’s end, as it always goes with hardware, but it’s still EE’s design, parts sourcing, and manufacturing run that DEFCON just took over last minute? I don’t know the terms of their contract, but that wouldn’t fly in a typical contractor setup. You can’t just cut out the contractors labor costs after the fact. I’d be more inclined to give DEFCON the benefit of the doubt if they canceled the entire project earlier on and engaged a different contractor to build an entirely different badge from scratch. Given that dimitri wasn’t even paid for the firmware(!), my guess is this was low budget. For something of DEFCON’s scale, this can’t really be a “for fun” hacker project if you want to guarantee results. The “for fun” part is ensuring the attendees can all have a good time hacking on the badge, not the people doing the labor.
- tptacek 2y ago
  On the contrary, if you have a signed master and SOW for a project, you absolutely cannot just bill over or outside of the SOW because of "contractors labor costs". The whole point of contracts is to agree to costs up front and eliminate these kinds of on-the-fly disputes.
  - minkles 2y ago
    Clearly you've never worked on a government project! I was on a defence project that overshot by a cool billion dollars on the SOW...
    - tptacek 2y ago
      I've made a point of not working on government projects, so yes, this is a blind spot for me.
    - deleted 2y ago
      [deleted]
    - cowsandmilk 2y ago
ThinkBeat 2y ago
Man DefCon has changed since I was a regular. Back when all tickets were sold by cash only A hacker conference is upset that someone "hacked" their badges. and put unwanted code into the firmware. Users are (meant) to be hacking these boards. That is the entire point isn't it? Have guys who did it come in in, talk about the exploit, share how they did it. Then the corpDefCon can talk about what they missed and how to avoid it. Have a talk "How DefCon got hacked" Have some fun for f-sake. Tangent man, come on. "" Unfortunately, shortly before the talk was set to take place DEF CON became aware that unauthorized code had been included in the firmware we had paid Entropic Engineering to produce, ""
- willcipriano 2y ago
  You have to get into something cool before it has a reddit dedicated to it otherwise the killjoys will infest it and their calls of "actually!" will ruin all your fun.
guardiangod 2y ago
It seems that 2 issues are conflated together- 1. The badge manufacturing issue and subsequent non-payment due to contract dispute. 2. The firmware author (not hired by the manufacturer) put in unauthorized 'easter egg' code that asks for money via crypto. I am not familiar with 1 so I can't comment on a contract dispute. But 2 is definitely over the line, and this is coming from me who is supportive of some usage of cryptocurrency. You don't put in unexpected monetization mechanisms into your volunteer work, without asking the charity organization for permission. Asking for money secretly is way different than putting in a harmless Easter egg. At that point, it's not a harmless easter egg anymore. Maybe the money is for the manufacturer. In that case, do what a normal person would do and raise the issue on a social channel (eg. Twitter, Thread, blog).
- kelnos 2y ago
  > Maybe the money is for the manufacturer. Yes, it was for the manufacturer, not for the firmware author himself. I agree that he shouldn't have put in the donation solicitation, but I think DEFCON's response to kick him out of his talk was an overreaction. Especially considering what prompted the easter egg was DEFCON removing the Entropic's badge credit from the badge case that they were promised. Even if DEFCON's statement about the manufacturing/cost issues with the badge (your point 1) was entirely true, the final badge that ended up in attendees' hands was still almost completely Entropic's and Dmitry's work, and they deserve credit for putting together something of that complexity in such a short time frame. No one is coming out of this looking perfectly rosy, regardless of the truth behind things. The donation link was over the line, but DEFCON's change to the badge case was completely unethical, and disinviting Dmitry from the badge talk over an inappropriate easter egg was a dirty thing to do.
mrandish 2y ago
Just skimming the top level of various back and forth claims, I can already tell this is one of those situations where there are too many variables, disparate communications, perspectives, individual recollections and partial retellings, all about a unique, one-off transaction, and all evolving over a significant period of time between individuals who are not deeply experienced business people - to confidently conclude anything about ultimate fault based on the currently available statements and posts. Given this complexity and confusion, short of conducting a full court trial with months of document subpoenas and depositions under oath, IMHO, confidently believing you've arrived at a complete, objective understanding of who is right or wrong is as likely to be incorrect as it is correct. And, at this point, this probably holds true for most of the actual participants too. I base this on decades of experience untangling screwed up business transactions and communications. No matter how thorough, credible and complete a certain retelling seems, I've often discovered there is another layer (sometimes even unknown to many of those involved) which changes enough to shift whatever I initially believed. I've had this cycle of "Aha, now I understand" / "Oh... wait. No I don't" repeat several times while digging through a single incident.
WalterBright 2y ago
"Badges? We ain't got no badges. We don't need no badges. I don't have to show you any steenkin badges."
xyst 2y ago
I have read all accounts and points of view. Defcon clearly dropped the ball here. Whoever was managing this badge creation team should never be allowed near defcon again. I am very unlikely to recommend or go to any future defcon events unless defcon makes this right with the vendor. > The DEFCON community is and has always been near and dear to my heart; I started my local DEFCON group as a kid growing up in Malaysia decades ago Sad that people (defcon) use and abuse the passion of others. EE let DEFCON step all over them. EE even discounted the labor in the invoices to defcon to meet whatever vague budget they had. This is just a reminder that you should never meet or work with your childhood heroes. The reality is they will most likely take advantage of this.
the_real_cher 2y ago
Def Con is the Coachella of tech conferences. Its an event kids go to to have fun with their friends. They have game rooms and furry parades karaoke and cool badges! And their website doesnt work. https://forum.defcon.org/calendar https://forum.defcon.org/calendar Its not a serious event any more. What are the real infosec conferences these days?
- SSchick 2y ago
  The furry part is most certainly true.
  - the_real_cher 2y ago
    All of it is true.
- Sytten 2y ago
  Have you even attended? It is not a corporate event doesn't mean it is not serious. Real conf, what sort of gatekeeping is that. There is still zero days being dropped and you meet a lot of the smartest people in infosec.
  - the_real_cher 2y ago
    "Gatekeeping"
  - cdchn 2y ago
    There are a ton of other infosec conferences where you'll meet just as many if not more of the smartest people, with a much better SNR.
- bitexploder 2y ago
  Cansecwest, recon, there are tons of great, much smaller venues. Blackhat is more and more like RSA, and DC is more and more just a time to hang out with friends and catch up. The size of crowds is just unbelievable. My first DefCon was 18 years ago. It’s just so different.
- 2y ago
cdchn 2y ago
Dmitry is posted on reddit that he is going to DMCA DEFCON for using his code unauthorized and is granting napkin licenses to people in reddit comments or who had the badge signed at DC https://www.reddit.com/user/dmitrygr/ https://www.reddit.com/user/dmitrygr/
- thomascountz 2y ago
  If the agreement with EE included the delivery of firmware (of which Dmitry is the original license holder), DF is responsible for acquiring the software licensing agreement. If EE signed the licensing agreement, claiming to be the license holder, it would be EE who misrepresented their claim and would be noncompliant. DF has a duty to verify that EE can issue licenses, but I'm unsure how far is considered adequate with respect to damages or license violations.
  - jdnsndn 2y ago
    There is also a thing called concludent action. If the FW author gave DC the firmware with the expectation the firmware will be used on the devices and DC did just that, there might be an implicit license granted
chriscappuccio 2y ago
These badges sound pretty cool. I'd like to get one without attending.
rasz 2y ago
>After going overbudget by more than 60% >discount our work as necessary in order to hit DEFCON’s per unit cost targets Sounds like DEF CON established a budged and you kept going over it. No wonder they did a stop work order.
thomascountz 2y ago
> The specifics of what they requested in January were extremely difficult / almost impossible, but we had been working with Raspberry Pi as a Design Partner and had early access to the unreleased Raspberry Pi RP 2350, a chip that would enable exactly the kind of device DEFCON was requesting. Dmitry and Entropic had already been working on a GB emulator and were thrilled to be able to contribute our work to a project directly for and by the community. [0] Despite the project being "impossible," EE made some sort of agreement to complete the work and deliver within time and budget. EE, not DC, made the decision to work with Dmitry. > I am not a subcontractor of anyone. I was doing this in my own free time for fun so attendees have a fun badge. There exist no contracts between me and anyone. It was an evenings-and-weekends project for me [1] This work by Dmitry was unpaid, presumed: uninvoiced and not under contract directly with DF, and is not an agent of ES. > While we as a company did not ask Dmitry to program the easter egg, the outpouring of support and community for EE has been appreciated and inspiring. [0] EE did not request the Easter egg be included by Dmitry. As a free agent (not under contract) Dmitry is free to do as they wish. Dmitry's involvement with DF was an invitation to participate on a panel. Given the discovery of the Easter egg, DF withdrew the invitation. Without any explicit agreement, it is irrelevant as to why DF would withdraw their invitation as it is presumed DF can withdraw any such privileges at anytime for any reason, though a reason was given in the case. > At this point, all work had been completed except our physically attending the overseas production run and providing ongoing troubleshooting/debugging. In fact, the day we received this surprising news, we were actively working on the SD card debug that became a central concern earlier this week. [0] This sounds consistent with DF's claim that the product was still in pre-production and all services had not yet fully been rendered, therefore, the original agreement may already have been breached at this point. What is "owed," is likely no longer stipulated under the main clauses of the contract. > EE has tried multiple times over the past months to negotiate fair compensation for work completed prior to June 7th, but attempts at resolution have been unsuccessful. [0] > Once a month, we billed for our work and submitted an updated estimated per badge final cost - committing as costs built to discount our work as necessary in order to hit DEFCON’s per unit cost targets. [0] > Once the manufacturing was fully completed, we were offered a one-time “take it or leave it” amount worth well under half of what we were owed pre-stoppage. Given that what we were owed was already discounted by 25% in order to hit agreed upon cost targets, this has had a huge impact on our small team. [0] > We have also continued to pour lots of time, effort, and love into the project post-stoppage. I want to be clear that we never expected to be paid for this post-stoppage work, but simply did it as a labor of love for the community. [0] This is contract dispute. What EE is "owed" is defined (or should be defined) in the agreement. What is "invoiced," despite any "discount", does not, on its own, constitute what is owed by DF. Unbilled and discounted labor significantly complicates this, especially if it was not itemized as such on the invoices sent to DF. Parts and materials, which come with invoices attached, should be paid per the agreement. > Any claims that DEF CON did not pay Entropic Engineering for its hardware or firmware development are false.[OP source] My assumption is the agreement was for a fixed-cost fixed-timeline per-badge payment and the targets were not met, despite EE trying their best. The claims made by both sides are verifiable by receipts and, should it come to that, can be arbitrated either by a court of law or the court of PR (public relations, ie, the internet). Regarding Dmitry's experience and the Easter egg, for better or worse, DF can make whatever decision they please at their conference. The Easter egg was antagonistic towards DF and is significantly unrelated to the payment dispute with EE. The Easter egg being a "prank" or "difficult to find" or "not technically owned by DF," is also unrelated (although the code seems to be part of services rendered to DF by the agreement with EE [0]). > We were clear as early as our first conversation in January that the risk in trying to push to mass production of this size and on this timeline was immense, even advocating for a DEFCON 2025 release of this particular badge. DEFCON’s Badge Team remained confident that they could meet and mitigate this risk. [0] EE' admissions illustrates that DF's decision to push forward with this vendor was ill-advised. Given their experience, it would have been charitable to not put EE in this position. Arguably, DF did mitigate their risk (financial and reputational risk) by issuing a stop order and seeing the product to completion by other means; attendees did get their badges after all. By admission, EE also recognized the risk themselves and continuing their attempt to render the agreement under the circumstances was also ill-advised. Their risk (to reputation) was also managed by providing free labor. This is unrelated to the payment dispute as both parties chose, and were not forced, to continue to engage under the terms of their agreement until such time the agreement was made null. The only dispute is in regards to the original agreement, which should be rendered whole by the terms of the contract that were completed and satisfied by EE. [0]: EE's statement. https://www.entropicengineering.com/defcon-32-statement https://www.entropicengineering.com/defcon-32-statement [1]: https://www.reddit.com/r/Defcon/s/OwxYvX1Z5z https://www.reddit.com/r/Defcon/s/OwxYvX1Z5z
rdl 2y ago
I don't understand how volunteer, non-sworn officer, non nevada licensed security guards (volunteer "goons", who are just private citizens at a private event in a public convention center) can use physical force to take a non-violent trespasser off stage without exposing themselves personally and their organization to substantial liability. Not super familiar with Nevada law. (Obviously doing crowd control, providing information, and front line emergency response is absolutely fine, although tbh even that they should probably have guard cards in most jurisdictions for liability reasons. If someone is violently disruptive, as a private citizen go for it, but unauthorized speaking on stage is pretty far from that. Would be hilarious if dude makes more money from that than he was stiffed by his employer.)
- tptacek 2y ago
  I doubt this is anywhere even close to the frontier of physical confrontation DEF CON goons have been involved in in the last 10 years; it's a drunk, druggy conference. I imagine at this point they know what the boundaries are. And if you're going to use words like "non-sworn", let's acknowledge that Dmitry was surely better off being escorted out by the Goons than by actual Vegas security.
  - ensignavenger 2y ago
    The USA has fairly robust personal property laws. Each state is a little different, but for the most part, you have a right to defend yourself and your property, including removing trespassers from your property.
- mindslight 2y ago
  I'm not trying to defend DEF CON's overall actions here, but in this case it looks like the physical interaction itself was essentially consensual? The goons asked Dmitry to leave, his response indicated that he wasn't going to leave voluntarily on his own but also that he would cooperate with a minimal physical display that demonstrated the non-voluntary dynamic. I suspect that if he had physically resisted or even just gone limp, they would have escalated to actual security guards, who then may have laid actual criminal trespassing charges (if for nothing else than to cover themselves).
DarkmSparks 2y ago
defcon complaining that firmware they dont have a licence to use and distribute has a semi malicious easter egg.... defcon cheats, defcon loses.
creer 2y ago
More summary of how it apparently went at defcon https://old.reddit.com/r/Defcon/comments/1eoe4u7/so_the_guy_who_wrote_the_badge_firmware_and/ https://old.reddit.com/r/Defcon/comments/1eoe4u7/so_the_guy_...
fsckboy 2y ago
I can't reply to dang's informational post, but in light of the new claims from defcon, isn't the previous discussion title potentially defamatory? > (dang) Previous related thread: Defcon stiffs badge HW vendor, drags FW author offstage during talk
rurban 2y ago
I don't know DT (Dark Tangent) aka Jeff Moss, the one who got pissed at dmitryg to throw him out. Is this his usual behavior? From his time-line https://en.m.wikipedia.org/wiki/Jeff_Moss_(hacker) https://en.m.wikipedia.org/wiki/Jeff_Moss_(hacker) "Later career" he seems to be CIA: Council of Foreign Relations member, and Atlantic Council member. But it would fit to the other folks who I got to know from this background.
Broere 2y ago
[flagged]
kazinator 2y ago
I like M. Hutchins' take: https://infosec.exchange/@malwaretech/112947643197413295 https://infosec.exchange/@malwaretech/112947643197413295

274 points by mmastrac 2y ago

There's basically three sides to the story now, for reference: Entropic statement: https://www.entropicengineering.com/defcon-32-statement https://www.entropicengineering.com/defcon-32-statement dmitrygr statement: https://news.ycombinator.com/item?id=41207469 https://news.ycombinator.com/item?id=41207469 dmitrygr being removed: https://x.com/dmitrygr/status/1822124650547257637 https://x.com/dmitrygr/status/1822124650547257637

sergiotapia 2y ago
tldr: entropic made some mistakes because they're a small team with a very tight deadline. defcon shit the bed and refused to pay them over those problems. and dmitry forgot about an easter egg and was OK with being removed from speaking, but wanted security to pull him off stage for his clout. I still think DEFCON should've done better. their brand is in the shitter over what $20k?
- tptacek 2y ago
  What should they have done better? They didn't have the option of doing better with Dmitry, right? He deliberately set up the confrontation with security. The idea that DEF CON's brand is "in the shitter" seems risible. I say that ruefully, as (in my declining years) I get more and more bitter about the comic convention spectacle the event has become. Whatever the outcome from "badge-gate", I assure you, they'll set attendance records next year regardless.
  - ibash 2y ago
    > They didn't have the option of doing better with Dmitry, right? Let him give his talk like they promised. Given literally everyone in that room is using his work in that same moment and they are literally there to hear him speak.
    - tptacek 2y ago
      Fuck no. People don't get to re-invite themselves to stages they've been disinvited from.
      - mynameisvlad 2y ago
        You asked someone to give you options and they did. Just because you don't like it doesn't mean it's not what you asked for.
        aaplok 2y ago
        OP asked for a better option. He was offered one, which he disagreed with. Because he doesn't like it precisely means that (in his view at least) it is not what he asked for.
        tptacek 2y ago
        I take their point; I didn't mean to be slapping back at them for taking the time to write a response!
        aaplok 2y ago
        Your point was valid though. You can't let someone rock up to the stage uninvited. This would open the door to all kinds of issues. And the original question of how the situation could have been handled better is the most interesting one. The rest is a game of he said/she said, which hn commenters tend to enjoy arguing about but is ultimately not very instructive. With hindsight it is clear that the situation had been brewing for some time, and the conflict had been escalating slowly. Perhaps due to the pressure and stress (and time pressure) of organising an event like that nobody managed to have enough distance to deescalate it, which culminated in someone being escorted off stage by security, not a good experience for anyone. Most likely once the invitation to talk had been rescinded the dice were thrown. It would have been hard for the speaker not to be offended, and unfair on him to expect him to take it quietly and move on without reacting. Someone should have been aware of that and worked with him to control the impact of this on his own reputation.
  - tedunangst 2y ago
    I would simply level up charisma and speech check him off the stage.
  - josephg 2y ago
    It was a huge mistake to uninvite him from the session. It sounds like defcon was mad at EE for going over budget - which honestly is fair even though they didn’t handle it well. And thought (wrongly) that Dmitry was a salty subcontractor of theirs. Their actions make some sense in that context. Not great, but eh. But Dmitry has totally owned them in messaging - by forcing them to physically eject him (making a scene), and getting out ahead of the story. It’s great drama. He’s positioned defcon to look like an evil corporate buffoon hating on a hacker who was just donating his time. At this point, defcon should take the L and apologise, and let him have a session talking about the code. That would be a very satisfying end to the drama for attendees. (Even if it does encourage more drama in future years.) Either way, I agree - I’m sure attendance will go up next year too. People love this stuff.
    - tptacek 2y ago
      It sounds to me like they were mad at Dmitry for including an "easter egg" in their badge firmware that solicited donations to a Bitcoin address.
      - josephg 2y ago
        Yep. Given that they thought Dmitry was a subcontractor of EE, them being mad about that makes a lot more sense.
      - Dylan16807 2y ago
        It was definitely an easter egg. A secret screen that gives credit to someone that worked on a thing and otherwise wouldn't get credit is the textbook example of an easter egg. It probably shouldn't have had the Bitcoin address, but it doesn't sound like that would have been treated much differently.
        tptacek 2y ago
        I think you're going to find that firms who contract embedded designs have viewpoints about "easter eggs" that would be surprising, even off-putting, to message board communities that savor them like single malts. Generally, when firms arrange to deliver hardware/software to their own customers sourced from vendors, they want a clear understanding of what the software actually does.
  - hnthrowaway0315 2y ago
    I'd like to ask as someone who is interested in RE/Security/Malware in general but without experience. Which events are good for me if I have to pay out of my own pocket? I don't work in related fields so education stipend does not apply. I surveyed the ground tonight and found two that are interesting: Recon (in Montreal) and CCC (in Hamburg). What do you think?
    - tptacek 2y ago
      I think CCC is basically in the same bracket as DEF CON in terms of seriousness. Someone's going to get mad at me for saying that, but I'll note that serious people go to DEF CON too, even though it is 100% a cultural event and not a real part of the cite record for our field. I've never heard anyone say anything but good things about REcon. I have FOMO about having never been.
      - hnthrowaway0315 2y ago
        Thanks for sharing. I'm actually close to Montreal so REcon is probably my best bet. The ticket is more expensive but I save lodging and transportation.
        thequux 2y ago
        Hugo, the organizer of Recon, has historically been willing to work with people who are attending on their own dime. I suspect that if you were to send him an email explaining your situation, you'd be very happy with the response you received. It is an excellent conference that I've enjoyed every single time I've gone
        hnthrowaway0315 2y ago
        Thanks a lot! I'll definitely reach out to him next year.
  - busterarm 2y ago
    > The idea that DEF CON's brand is "in the shitter" seems risible. Is it though? With 20+ attendances behind my belt, I was already sour on the experience at 2018 and didn't go in 2019 due to a family conflict and haven't been back since. Not only did "badgelife" absolutely ruin the whole fucking experience, but I started seeing large numbers of people start getting othered and excluded because of running afoul of idpol which IMO is entirely counter to the spirit of what the con had always been about. It permeates throughout the meta events of the con, like Ollam's Shoot, where you're warned very much in advance with overt threats to not express an opinion that even remotely smells right-wing while his staffers proudly wave antifa banners and shout the merits of being radleft. At the same time, my experience with the security industry as a whole is that most vendors are completely full of shit and spend all of their time chasing after fake clout (and all of the shady bullshit that goes along with it).
- BoredPositron 2y ago
  Honestly sounds like typical "CON" stuff. Just children all around no matter the topic.
  - sergiotapia 2y ago
    my perception of them was they are hyper intelligent hackers, who have morals and clear north. if anybody would do the right thing it's these guys. but that illusion is no more. they are just normal dudes after all for better or worse.
    - NegativeK 2y ago
      I'm not sure if you're referring to the badge team or the Defcon people, but pretty much every group is just normal people.
  - Aeolun 2y ago
    That’s because that’s ultimately what happens everywhere. We just paper over it by paying people for their time so they have to listen to you. When you go back to being all volunteer driven the drama increases correspondingly.
  - numpad0 2y ago
    >90% of the world is run by dumb unqualified children. It's not worth trying to get everyone up to your supreme standards(you'll get it later at no cost).
- ryandrake 2y ago
  Reading both accounts of the story, it sounds like a small company bit off more than it could chew, couldn’t manage cost and schedule, and when it got to the drop-dead date, even though they say it was basically done (how many times did the client hear that one), the client pulled the plug and tried to salvage it some other way. Y’all need project managers, at least someone with a plan! jeez.
  - A4ET8a8uTh0 2y ago
    I think I agree with the assessment. Especially the part about PM hits close to home. It seems how a lot of projects I was involved lately lacked an actual project manager. Is the problem that it is a hard job to do right?
    - theshrike79 2y ago
      The thing is that people on here think project managers are evil incarnate and just useless middle management. It requires a very specific skill set to be able to lead a technical project and cut through the bullshit on BOTH SIDES: the client asking for features and the team building the product. Clients always either ask for stuff they don't really need or have vague requirements that crystallise only 3 days after the deadline. "Of course when we said it needs to do foo, it also MUST do bar, doh!" And teams tend to overestimate their ability to deliver and underestimate the work needed to get to the finish. (Infinite coast problem).
      - q7xvh97o2pDhNrh 2y ago
        There's also several more classes of B.S., for what it's worth. An exaggerated/anonymized version of a recent one I got, from an otherwise-really-strong senior engineer: "Of course when I said we would put a button there, it also meant we MUST build an entire UI framework from scratch, with full test coverage for the entire thing!" ...actually, that's not even that exaggerated. Shipping software at big companies can be unreasonably difficult, sometimes.
        2y ago
- viccis 2y ago
  >dmitry forgot about an easter egg Ah yes, classic "insert an unauthorized coin wallet soliciting money from badge owners" easter egg. Timeless prank, how could anyone be mad at such a normal and anodyne "easter egg"? lmao DEFCON's "brand" isn't in any danger. edit: And now he's pulling the classic hacker move of (checks notes) enforcing strict software IP ownership rights? Guy's a class act all around. Hope everyone learned an important lesson about Dmitry and Entropic with this mess.
  - josephg 2y ago
    He wasn’t employed by anyone, and didn’t get paid by anyone for his work. (Defcon is wrong about this in their statement, and admitted as such in the comment thread). When I write code that nobody is paying for, you better believe I’ll write it how I damn well please. If you aren’t paying, you aren’t the customer. And you don’t get to control the output of my work. The wallet address soliciting donations is for the hardware company, not on his own behalf. But even if it was on his own behalf, would you still be mad? Since when is it a crime to be proud of the code you’ve written, for free, to bring joy to an hacker conference? That deserves mad credit in my book.
    - viccis 2y ago
      I don't really care whether money changed hands. Secretly putting an ad into software that you know will be distributed to many people is the oldest scumbag move in the scumbag book. All sympathy ended there, and that was weeks before he trespassed.
      - josephg 2y ago
        Eh. When I was young, I played a demo of Doom that came with a magazine. When you finish the demo level, the game show an ad that said if I ponied up money, I could play the whole game. I fail to see the problem. And in this case it wasn’t an ad. It was a page saying you could donate to the hardware company if you want, who were out of pocket $100k for making the hardware. That’s an incredibly tame prank by Defcon standards.
      - 2y ago
- deleted 2y ago
  [deleted]
simpaticoder 2y ago
Thank you. This stood out to me: "They expressed that they specifically wanted to work with us as a woman-owned, queer- and POC-driven engineering firm to develop an electronic badge with a gaming element for this year’s conference." I would have expected the core criteria to be ability to execute on time. Choosing an engineering firm based on the race, gender, or sexual orientation of the owner is foolish, and DEF CON is ultimately to blame for introducing superfluous criteria and missing the core criteria.
- kcmastrpc 2y ago
  [flagged]
- cj 2y ago
  That sentence seems like the most irrelevant part of all of what I’ve read. They could have easily rephrased that sentence to simply say “They expressed interest in working with us” and the point they’re making is the same.
  - echoangle 2y ago
    Isn’t the implication of the sentence that they were chosen specifically for those properties and wouldn’t have been chosen otherwise?
    - superb_dev 2y ago
      The implication is that they were chosen because of that, but not that this was the only qualification. It could easily be that multiple teams looked qualified during bidding for the job and that this was the distinguishing factor.
      - simpaticoder 2y ago
        [flagged]
        2y ago
neilv 2y ago
Regarding "https://x.com/dmitrygr/status/1822124650547257637 https://x.com/dmitrygr/status/1822124650547257637", was there some kind of written consent involved in being removed like that? Or some less formal consent was understood, and considered low-risk? Or were they otherwise legally empowered to do that? (I'm thinking about civil and criminal liability.)
- metadat 2y ago
  It's a private event on private property. There is no inherent right to be there, especially up on stage without invitation (TFA mentions this was what happened).
  - neilv 2y ago
    I'm wondering how the organizers of an event cover all the bases sufficiently on something like that. I'm asking out of curiosity about how that actually works, in practice, not what arguments we could imagine. (For example: Say, someone rushes up on stage during a rock music concert. Was removal covered in the fine print terms of the ticket? Are the security personnel deputized by local law enforcement? Are there special ordinances applying to security at some kinds of events? Do the event organizers fall back on the claim that they felt safety was threatened? Do the event organizers think any risk of penalties or lawsuit is less than the cost of disrupting the event? Does setting precedent for response also factor into the calculus? How is insurance and venue contracts involved? Etc. There's a some related history, involving the Hell's Angels at a concert, but I don't know how practice has evolved since then.)
    - lukan 2y ago
      I only know german law from a short time as a security, but I assume it is quite similar: Cops do not want to be called for every bouncer action. The owner (or the one renting the property) has legal rights and set the rules. You break the rules, by beeing somewhere you are not supposed to be - any staff member can act as security to physically remove you. They may not beat you, though. Or otherwise act escalating. But forcefully leading (or carrying) out someone breaking the house rules (by using minimum of violence) is legal and standard procesure on every big event.
perihelions 2y ago
[flagged]
- whamlastxmas 2y ago
  The vast majority of news is non-actionable information, and most of it is written with enough bias and hidden motivations to the point of effectively not even being true
- firesteelrain 2y ago
  I love this take. Thank you
  - deleted 2y ago
    [deleted]

tptacek 2y ago

I believe DEF CON on this, because the other side of the story --- that they vindictively withheld payment from Entropic and later harassed the firmware developer --- just doesn't make any sense. We are probably talking about rounding error sums of money for the conference organizers themselves.

gavinhoward 2y ago
National politicians have taken bribes for less.
- woodruffw 2y ago
  National politicians have legible incentives. What’s the incentive for DEF CON here? It’s not like they’re apart from the community; people know exactly who they are, and the existence of their conference is tied entirely to the community’s perception of their leadership.
JonChesterfield 2y ago
People do petty stupid things. My priors align with the client having unreasonable expectations and then squabbling over the inconsequential bill. That is totally a thing that clients sometimes do.
- tptacek 2y ago
  Having spent a very long time as a consultant, a thing vendors sometimes do is commit to unrealistic project schedules and then attempt to invoice their way out of the hole they've dug for themselves, and by "sometimes" I mean "every times, every of the times", it is one of the most common ways consulting projects blow up. When your project blows up, the professional thing to do is to resolve the problem with the client before billing another hour over the SOW. The common, crazy thing to do instead is optimistic invoicing: the client must share our priors, we're all reasonable people, so we'll just implicitly revise the SOW to match our learnings on this project and proceed, prioritizing what we believe would be a successful delivery of the project over everything else. That rarely works. Serious consultancies routinely eat billable weeks of time in order to meet client success criteria and retain relationships.

ionwake 2y ago

[flagged]

tptacek 2y ago
In any message board dispute you can generally work out who the underdog is and bet on things "not looking great" for whoever their adversary is.
RandomThoughts3 2y ago
It doesn’t look great for DEFCON in that the whole thing seems to have been widely mismanaged from the choice of their partner up to the timeline for what is in the end a bunch of badges. The rest is just a whole lot of finger pointing with very little in the way of actually verifiable facts.

bawolff 2y ago

If the "joke" involved shilling for crypto, that instantly makes me more sympathetic to the defcon side.

lowkey 2y ago
I genuinely don’t mean to be snarky but I don’t think the method of soliciting donations is at all relevant here. It sounds like you would have otherwise been fine if he handed out a hat and asked for cash in USD.
- lmm 2y ago
  Are they wrong? Passing around a hat for USD might be unprofessional but it's a lot more open and honest.
  - kelnos 2y ago
    How so? The inappropriate act in question is soliciting donations; the method to transfer the money for those donations is immaterial. I have a dim view of cryptocurrency in general, but I don't see how that fact of it is relevant.
    - lmm 2y ago
      I think soliciting donations via something hidden/obscure/confusing is a lot more dubious than soliciting them openly. And the very act of using crypto suggests that you're doing something that you know is wrong.
- superb_dev 2y ago
  Crypto has a bad reputation, it makes sense to be more upset about someone soliciting donations in crypto over USD. Especially in a branded product
  - mouse_ 2y ago
    I mean... it makes sense that internet people would be interested in donations by mean of internet currency.

aaron695 2y ago

[dead]

drno123 2y ago

[flagged]

mvdtnz 2y ago

This is a great example of why both sides of a story are needed. From DEF CON's perspective, assuming this is all true, there's nothing unreasonable here. It sounds like Dmitry was a subcontractor of Entropic and producing a screen asking for money after their contract had been terminated (for good-sounding reasons) was bad form. I'm not commenting on the legalities (I don't know anything about contract law) and I don't necessarily take either side's account at face value, but this response doesn't sound unreasonable to me.

notinmykernel 2y ago
Dmitry didn't ask for money. He raised awareness that DEFCON had slinked away from its financial obligation to Entropic, and asked that Entropic be paid what they are owed for their work on the hardware. Cool spin though.
mintplant 2y ago
Dmitry was a volunteer and did all the firmware work for free. "Subcontractor" is DEF CON PR spin.
- yunohn 2y ago
  Who forced him to do all this work, if neither DEFCON nor EE were employing/contracting him? Why was he even given access to this project then?
- lolc 2y ago
  If we believe the firmware's author that it was volunteer work, who was relying on him? Entropic or Defcon? Did Entropic promise to deliver the firmware? And assuming Entropic did promise a firmware, would the "stop work" order also affect firmware? Apparently the "easter egg" was added after that order.
  - cdchn 2y ago
    >If we believe the firmware's author that it was volunteer work, who was relying on him? Entropic or Defcon? This really is the fulcrum of which way this drama tips.

timthelion 2y ago

Am I the only pne who lmthinks it is rediculously wastefull to have electronic badges for all atendees?

wmf 2y ago
It's a form of swag and one of the reasons for attending.
cdchn 2y ago
No, when the point of the badges is to hack and repurpose them, they're arguably _less_ wasteful than a simple paper & plastic badge.
- kelnos 2y ago
  I don't disagree with the joy in producing these kinds of badges, but I do wonder how many people actually do anything with them after the conference, aside from tossing them on a shelf to collect dust for years. Which IMO is genuinely sad! But I suspect that's what happens to the majority of them, even considering the type of person who attends a conference like DEFCON.
JKCalhoun 2y ago
From the outside, it certainly looks to me like the whole badge thing has become a monster. Something that began as cute, clever — but one-upmanship over the years has taken a toll.

mvdtnz 2y ago

theogravity 2y ago
Dmitry has repeatedly stated he was not hired by Entropic nor was asking to be paid for his work. He did it for fun. I'm not sure where this misunderstanding is coming from.
- luckylion 2y ago
  He apparently put in extra code showing a wallet address (presumably his) and the request to "donate". Does sound like "asking to be paid", even if it's then switched to "it was all a prank, bro" when it turns out that wasn't the greatest idea.
  - kelnos 2y ago
    The wallet address he put in there was Entropic's, not his own. He was soliciting donations for Entropic, presumably because he was unhappy that DEFCON stopped paying them.
  - theogravity 2y ago
    From what I've read, it's very difficult to access the easter egg. It's not clear if the address belongs to him or not. Despite that, he has refused donations the entire time.
    - JoshTriplett 2y ago
      > From what I've read, it's very difficult to access the easter egg. The reports I've seen have said "Go to the about screen and press the select button". That's not difficult.

dang 2y ago

Previous related thread: Defcon stiffs badge HW vendor, drags FW author offstage during talk - https://news.ycombinator.com/item?id=41207221 https://news.ycombinator.com/item?id=41207221 - Aug 2024 (118 comments)

briandear 2y ago

What’s a badge and why does it need firmware? This is a conference right? Not a nuclear silo?

ironhaven 2y ago
DEF CON as a hacking convention has a long tradition of sometimes instead of giving printed name tags during registration like normal conferences but printed circuit boards with microcontrollers and firmware (aka software). Some years had ctf challenges in the firmware this year there was a playable game boy emulator.

mafuyu 2y ago

Reading EE and DEFCON’s statements, I’m inclined to think whoever was managing this on DEFCON’s side was not on top of things and blinked at the last minute. I’m sure there were delays and issues on EE’s end, as it always goes with hardware, but it’s still EE’s design, parts sourcing, and manufacturing run that DEFCON just took over last minute? I don’t know the terms of their contract, but that wouldn’t fly in a typical contractor setup. You can’t just cut out the contractors labor costs after the fact. I’d be more inclined to give DEFCON the benefit of the doubt if they canceled the entire project earlier on and engaged a different contractor to build an entirely different badge from scratch. Given that dimitri wasn’t even paid for the firmware(!), my guess is this was low budget. For something of DEFCON’s scale, this can’t really be a “for fun” hacker project if you want to guarantee results. The “for fun” part is ensuring the attendees can all have a good time hacking on the badge, not the people doing the labor.

tptacek 2y ago
On the contrary, if you have a signed master and SOW for a project, you absolutely cannot just bill over or outside of the SOW because of "contractors labor costs". The whole point of contracts is to agree to costs up front and eliminate these kinds of on-the-fly disputes.
- minkles 2y ago
  Clearly you've never worked on a government project! I was on a defence project that overshot by a cool billion dollars on the SOW...
  - tptacek 2y ago
    I've made a point of not working on government projects, so yes, this is a blind spot for me.
  - deleted 2y ago
    [deleted]
  - cowsandmilk 2y ago

ThinkBeat 2y ago

Man DefCon has changed since I was a regular. Back when all tickets were sold by cash only A hacker conference is upset that someone "hacked" their badges. and put unwanted code into the firmware. Users are (meant) to be hacking these boards. That is the entire point isn't it? Have guys who did it come in in, talk about the exploit, share how they did it. Then the corpDefCon can talk about what they missed and how to avoid it. Have a talk "How DefCon got hacked" Have some fun for f-sake. Tangent man, come on. "" Unfortunately, shortly before the talk was set to take place DEF CON became aware that unauthorized code had been included in the firmware we had paid Entropic Engineering to produce, ""

willcipriano 2y ago
You have to get into something cool before it has a reddit dedicated to it otherwise the killjoys will infest it and their calls of "actually!" will ruin all your fun.

guardiangod 2y ago

It seems that 2 issues are conflated together- 1. The badge manufacturing issue and subsequent non-payment due to contract dispute. 2. The firmware author (not hired by the manufacturer) put in unauthorized 'easter egg' code that asks for money via crypto. I am not familiar with 1 so I can't comment on a contract dispute. But 2 is definitely over the line, and this is coming from me who is supportive of some usage of cryptocurrency. You don't put in unexpected monetization mechanisms into your volunteer work, without asking the charity organization for permission. Asking for money secretly is way different than putting in a harmless Easter egg. At that point, it's not a harmless easter egg anymore. Maybe the money is for the manufacturer. In that case, do what a normal person would do and raise the issue on a social channel (eg. Twitter, Thread, blog).

kelnos 2y ago
> Maybe the money is for the manufacturer. Yes, it was for the manufacturer, not for the firmware author himself. I agree that he shouldn't have put in the donation solicitation, but I think DEFCON's response to kick him out of his talk was an overreaction. Especially considering what prompted the easter egg was DEFCON removing the Entropic's badge credit from the badge case that they were promised. Even if DEFCON's statement about the manufacturing/cost issues with the badge (your point 1) was entirely true, the final badge that ended up in attendees' hands was still almost completely Entropic's and Dmitry's work, and they deserve credit for putting together something of that complexity in such a short time frame. No one is coming out of this looking perfectly rosy, regardless of the truth behind things. The donation link was over the line, but DEFCON's change to the badge case was completely unethical, and disinviting Dmitry from the badge talk over an inappropriate easter egg was a dirty thing to do.

mrandish 2y ago

Just skimming the top level of various back and forth claims, I can already tell this is one of those situations where there are too many variables, disparate communications, perspectives, individual recollections and partial retellings, all about a unique, one-off transaction, and all evolving over a significant period of time between individuals who are not deeply experienced business people - to confidently conclude anything about ultimate fault based on the currently available statements and posts. Given this complexity and confusion, short of conducting a full court trial with months of document subpoenas and depositions under oath, IMHO, confidently believing you've arrived at a complete, objective understanding of who is right or wrong is as likely to be incorrect as it is correct. And, at this point, this probably holds true for most of the actual participants too. I base this on decades of experience untangling screwed up business transactions and communications. No matter how thorough, credible and complete a certain retelling seems, I've often discovered there is another layer (sometimes even unknown to many of those involved) which changes enough to shift whatever I initially believed. I've had this cycle of "Aha, now I understand" / "Oh... wait. No I don't" repeat several times while digging through a single incident.

WalterBright 2y ago

"Badges? We ain't got no badges. We don't need no badges. I don't have to show you any steenkin badges."

xyst 2y ago

I have read all accounts and points of view. Defcon clearly dropped the ball here. Whoever was managing this badge creation team should never be allowed near defcon again. I am very unlikely to recommend or go to any future defcon events unless defcon makes this right with the vendor. > The DEFCON community is and has always been near and dear to my heart; I started my local DEFCON group as a kid growing up in Malaysia decades ago Sad that people (defcon) use and abuse the passion of others. EE let DEFCON step all over them. EE even discounted the labor in the invoices to defcon to meet whatever vague budget they had. This is just a reminder that you should never meet or work with your childhood heroes. The reality is they will most likely take advantage of this.

the_real_cher 2y ago

Def Con is the Coachella of tech conferences. Its an event kids go to to have fun with their friends. They have game rooms and furry parades karaoke and cool badges! And their website doesnt work. https://forum.defcon.org/calendar https://forum.defcon.org/calendar Its not a serious event any more. What are the real infosec conferences these days?

SSchick 2y ago
The furry part is most certainly true.
- the_real_cher 2y ago
  All of it is true.
Sytten 2y ago
Have you even attended? It is not a corporate event doesn't mean it is not serious. Real conf, what sort of gatekeeping is that. There is still zero days being dropped and you meet a lot of the smartest people in infosec.
- the_real_cher 2y ago
  "Gatekeeping"
- cdchn 2y ago
  There are a ton of other infosec conferences where you'll meet just as many if not more of the smartest people, with a much better SNR.
bitexploder 2y ago
Cansecwest, recon, there are tons of great, much smaller venues. Blackhat is more and more like RSA, and DC is more and more just a time to hang out with friends and catch up. The size of crowds is just unbelievable. My first DefCon was 18 years ago. It’s just so different.
2y ago

cdchn 2y ago

Dmitry is posted on reddit that he is going to DMCA DEFCON for using his code unauthorized and is granting napkin licenses to people in reddit comments or who had the badge signed at DC https://www.reddit.com/user/dmitrygr/ https://www.reddit.com/user/dmitrygr/

thomascountz 2y ago
If the agreement with EE included the delivery of firmware (of which Dmitry is the original license holder), DF is responsible for acquiring the software licensing agreement. If EE signed the licensing agreement, claiming to be the license holder, it would be EE who misrepresented their claim and would be noncompliant. DF has a duty to verify that EE can issue licenses, but I'm unsure how far is considered adequate with respect to damages or license violations.
- jdnsndn 2y ago
  There is also a thing called concludent action. If the FW author gave DC the firmware with the expectation the firmware will be used on the devices and DC did just that, there might be an implicit license granted

chriscappuccio 2y ago

These badges sound pretty cool. I'd like to get one without attending.

rasz 2y ago

>After going overbudget by more than 60% >discount our work as necessary in order to hit DEFCON’s per unit cost targets Sounds like DEF CON established a budged and you kept going over it. No wonder they did a stop work order.

thomascountz 2y ago

> The specifics of what they requested in January were extremely difficult / almost impossible, but we had been working with Raspberry Pi as a Design Partner and had early access to the unreleased Raspberry Pi RP 2350, a chip that would enable exactly the kind of device DEFCON was requesting. Dmitry and Entropic had already been working on a GB emulator and were thrilled to be able to contribute our work to a project directly for and by the community. [0] Despite the project being "impossible," EE made some sort of agreement to complete the work and deliver within time and budget. EE, not DC, made the decision to work with Dmitry. > I am not a subcontractor of anyone. I was doing this in my own free time for fun so attendees have a fun badge. There exist no contracts between me and anyone. It was an evenings-and-weekends project for me [1] This work by Dmitry was unpaid, presumed: uninvoiced and not under contract directly with DF, and is not an agent of ES. > While we as a company did not ask Dmitry to program the easter egg, the outpouring of support and community for EE has been appreciated and inspiring. [0] EE did not request the Easter egg be included by Dmitry. As a free agent (not under contract) Dmitry is free to do as they wish. Dmitry's involvement with DF was an invitation to participate on a panel. Given the discovery of the Easter egg, DF withdrew the invitation. Without any explicit agreement, it is irrelevant as to why DF would withdraw their invitation as it is presumed DF can withdraw any such privileges at anytime for any reason, though a reason was given in the case. > At this point, all work had been completed except our physically attending the overseas production run and providing ongoing troubleshooting/debugging. In fact, the day we received this surprising news, we were actively working on the SD card debug that became a central concern earlier this week. [0] This sounds consistent with DF's claim that the product was still in pre-production and all services had not yet fully been rendered, therefore, the original agreement may already have been breached at this point. What is "owed," is likely no longer stipulated under the main clauses of the contract. > EE has tried multiple times over the past months to negotiate fair compensation for work completed prior to June 7th, but attempts at resolution have been unsuccessful. [0] > Once a month, we billed for our work and submitted an updated estimated per badge final cost - committing as costs built to discount our work as necessary in order to hit DEFCON’s per unit cost targets. [0] > Once the manufacturing was fully completed, we were offered a one-time “take it or leave it” amount worth well under half of what we were owed pre-stoppage. Given that what we were owed was already discounted by 25% in order to hit agreed upon cost targets, this has had a huge impact on our small team. [0] > We have also continued to pour lots of time, effort, and love into the project post-stoppage. I want to be clear that we never expected to be paid for this post-stoppage work, but simply did it as a labor of love for the community. [0] This is contract dispute. What EE is "owed" is defined (or should be defined) in the agreement. What is "invoiced," despite any "discount", does not, on its own, constitute what is owed by DF. Unbilled and discounted labor significantly complicates this, especially if it was not itemized as such on the invoices sent to DF. Parts and materials, which come with invoices attached, should be paid per the agreement. > Any claims that DEF CON did not pay Entropic Engineering for its hardware or firmware development are false.[OP source] My assumption is the agreement was for a fixed-cost fixed-timeline per-badge payment and the targets were not met, despite EE trying their best. The claims made by both sides are verifiable by receipts and, should it come to that, can be arbitrated either by a court of law or the court of PR (public relations, ie, the internet). Regarding Dmitry's experience and the Easter egg, for better or worse, DF can make whatever decision they please at their conference. The Easter egg was antagonistic towards DF and is significantly unrelated to the payment dispute with EE. The Easter egg being a "prank" or "difficult to find" or "not technically owned by DF," is also unrelated (although the code seems to be part of services rendered to DF by the agreement with EE [0]). > We were clear as early as our first conversation in January that the risk in trying to push to mass production of this size and on this timeline was immense, even advocating for a DEFCON 2025 release of this particular badge. DEFCON’s Badge Team remained confident that they could meet and mitigate this risk. [0] EE' admissions illustrates that DF's decision to push forward with this vendor was ill-advised. Given their experience, it would have been charitable to not put EE in this position. Arguably, DF did mitigate their risk (financial and reputational risk) by issuing a stop order and seeing the product to completion by other means; attendees did get their badges after all. By admission, EE also recognized the risk themselves and continuing their attempt to render the agreement under the circumstances was also ill-advised. Their risk (to reputation) was also managed by providing free labor. This is unrelated to the payment dispute as both parties chose, and were not forced, to continue to engage under the terms of their agreement until such time the agreement was made null. The only dispute is in regards to the original agreement, which should be rendered whole by the terms of the contract that were completed and satisfied by EE. [0]: EE's statement. https://www.entropicengineering.com/defcon-32-statement https://www.entropicengineering.com/defcon-32-statement [1]: https://www.reddit.com/r/Defcon/s/OwxYvX1Z5z https://www.reddit.com/r/Defcon/s/OwxYvX1Z5z

rdl 2y ago

I don't understand how volunteer, non-sworn officer, non nevada licensed security guards (volunteer "goons", who are just private citizens at a private event in a public convention center) can use physical force to take a non-violent trespasser off stage without exposing themselves personally and their organization to substantial liability. Not super familiar with Nevada law. (Obviously doing crowd control, providing information, and front line emergency response is absolutely fine, although tbh even that they should probably have guard cards in most jurisdictions for liability reasons. If someone is violently disruptive, as a private citizen go for it, but unauthorized speaking on stage is pretty far from that. Would be hilarious if dude makes more money from that than he was stiffed by his employer.)

tptacek 2y ago
I doubt this is anywhere even close to the frontier of physical confrontation DEF CON goons have been involved in in the last 10 years; it's a drunk, druggy conference. I imagine at this point they know what the boundaries are. And if you're going to use words like "non-sworn", let's acknowledge that Dmitry was surely better off being escorted out by the Goons than by actual Vegas security.
- ensignavenger 2y ago
  The USA has fairly robust personal property laws. Each state is a little different, but for the most part, you have a right to defend yourself and your property, including removing trespassers from your property.
mindslight 2y ago
I'm not trying to defend DEF CON's overall actions here, but in this case it looks like the physical interaction itself was essentially consensual? The goons asked Dmitry to leave, his response indicated that he wasn't going to leave voluntarily on his own but also that he would cooperate with a minimal physical display that demonstrated the non-voluntary dynamic. I suspect that if he had physically resisted or even just gone limp, they would have escalated to actual security guards, who then may have laid actual criminal trespassing charges (if for nothing else than to cover themselves).

DarkmSparks 2y ago

defcon complaining that firmware they dont have a licence to use and distribute has a semi malicious easter egg.... defcon cheats, defcon loses.

creer 2y ago

More summary of how it apparently went at defcon https://old.reddit.com/r/Defcon/comments/1eoe4u7/so_the_guy_who_wrote_the_badge_firmware_and/ https://old.reddit.com/r/Defcon/comments/1eoe4u7/so_the_guy_...

fsckboy 2y ago

I can't reply to dang's informational post, but in light of the new claims from defcon, isn't the previous discussion title potentially defamatory? > (dang) Previous related thread: Defcon stiffs badge HW vendor, drags FW author offstage during talk

rurban 2y ago

I don't know DT (Dark Tangent) aka Jeff Moss, the one who got pissed at dmitryg to throw him out. Is this his usual behavior? From his time-line https://en.m.wikipedia.org/wiki/Jeff_Moss_(hacker) https://en.m.wikipedia.org/wiki/Jeff_Moss_(hacker) "Later career" he seems to be CIA: Council of Foreign Relations member, and Atlantic Council member. But it would fit to the other folks who I got to know from this background.

Broere 2y ago

[flagged]

kazinator 2y ago

I like M. Hutchins' take: https://infosec.exchange/@malwaretech/112947643197413295 https://infosec.exchange/@malwaretech/112947643197413295