5 ms·

tldr: entropic made some mistakes because they're a small team with a very tight deadline. defcon shit the bed and refused to pay them over those problems. and

tldr: entropic made some mistakes because they're a small team with a very tight deadline. defcon shit the bed and refused to pay them over those problems. and dmitry forgot about an easter egg and was OK with being removed from speaking, but wanted security to pull him off stage for his clout. I still think DEFCON should've done better. their brand is in the shitter over what $20k?

tptacek 2y ago
What should they have done better? They didn't have the option of doing better with Dmitry, right? He deliberately set up the confrontation with security. The idea that DEF CON's brand is "in the shitter" seems risible. I say that ruefully, as (in my declining years) I get more and more bitter about the comic convention spectacle the event has become. Whatever the outcome from "badge-gate", I assure you, they'll set attendance records next year regardless.
- ibash 2y ago
  > They didn't have the option of doing better with Dmitry, right? Let him give his talk like they promised. Given literally everyone in that room is using his work in that same moment and they are literally there to hear him speak.
  - tptacek 2y ago
    Fuck no. People don't get to re-invite themselves to stages they've been disinvited from.
    - mynameisvlad 2y ago
      You asked someone to give you options and they did. Just because you don't like it doesn't mean it's not what you asked for.
      - aaplok 2y ago
        OP asked for a better option. He was offered one, which he disagreed with. Because he doesn't like it precisely means that (in his view at least) it is not what he asked for.
        tptacek 2y ago
        I take their point; I didn't mean to be slapping back at them for taking the time to write a response!
        aaplok 2y ago
        Your point was valid though. You can't let someone rock up to the stage uninvited. This would open the door to all kinds of issues. And the original question of how the situation could have been handled better is the most interesting one. The rest is a game of he said/she said, which hn commenters tend to enjoy arguing about but is ultimately not very instructive. With hindsight it is clear that the situation had been brewing for some time, and the conflict had been escalating slowly. Perhaps due to the pressure and stress (and time pressure) of organising an event like that nobody managed to have enough distance to deescalate it, which culminated in someone being escorted off stage by security, not a good experience for anyone. Most likely once the invitation to talk had been rescinded the dice were thrown. It would have been hard for the speaker not to be offended, and unfair on him to expect him to take it quietly and move on without reacting. Someone should have been aware of that and worked with him to control the impact of this on his own reputation.
    - Aeolun 2y ago
      People don’t get to dis-invite people from stages when that is quite literally the only compensation given either. They made the software for the badge of your entire conference, for free, and then you won’t let them talk about it because what you got for free, wasn’t what you expected/wanted? That’s just dumb on so many levels I don’t even know where to begin. It’s like playing, no, selling someone elses mod and complaining it’s not up to the standards of a finished game.
      - tptacek 2y ago
        They absolutely do get to do that. Absolutely, and without qualification. It's their stage. There's a whole long history of this with DC/BH.
        kelnos 2y ago
        I don't think GP meant "don't get to" as in it's not their legal right to do so (which of course it is). I think they meant that it's a profoundly shitty thing to do to someone, and DEFCON should rightly be criticized for disinviting him in the first place. I think an easter egg that includes a monetary solicitation is (at best) in poor taste, regardless of the circumstances. But canceling his talk 30 minutes prior to its start time for that? Nope, not cool. DEFCON's behavior in disinviting him was much much worse than his action that triggered it.
      - bawolff 2y ago
        > They made the software for the badge of your entire conference, for free, and then you won’t let them talk about it because what you got for free, wasn’t what you expected/wanted? You are saying this like it is unreasonable, but it seems entirely reasonable to me. Just because you do something for free does not entitile you to a conference talk about it. If you wanted to be paid for it (and make no mistake, a conference talk is a form of compensation. In many conferences companies pay huge sums of money to have a platform) then they should have got a contract.
        deleted 2y ago
        [deleted]
    - ibash 2y ago
      He was given a 30 minute notice that he was disinvited. That’s pretty egregious. Especially since they were okay with him giving the talk as long as he apologized. And he offered to say “I didn’t mean to offend anyone”. So for a misunderstanding and mistake to drag him off the stage is stupid and ridiculous. > What should they have done better? They didn't have the option of doing better with Dmitry, right? He deliberately set up the confrontation with security. Maybe I misunderstood, I previously read that as “what could they have done better about the situation”. Did you mean “what could they have done better once he was at the stage?”
      - tptacek 2y ago
        I got locked in a hotel room by an actual goon who demanded a line-item veto of my slides (clients! what you'll do to keep clients happy!), and ask Mike Lynn how he feels about the response to his talk. Being asked not to take a stage to take credit for the annual DEF CON badge toy seems pretty low on the scale of security conference dramas. The "drag him off the stage" thing was his own arrangement.
        CyberDildonics 2y ago
        What does that have to do with anything?
- tedunangst 2y ago
  I would simply level up charisma and speech check him off the stage.
- josephg 2y ago
  It was a huge mistake to uninvite him from the session. It sounds like defcon was mad at EE for going over budget - which honestly is fair even though they didn’t handle it well. And thought (wrongly) that Dmitry was a salty subcontractor of theirs. Their actions make some sense in that context. Not great, but eh. But Dmitry has totally owned them in messaging - by forcing them to physically eject him (making a scene), and getting out ahead of the story. It’s great drama. He’s positioned defcon to look like an evil corporate buffoon hating on a hacker who was just donating his time. At this point, defcon should take the L and apologise, and let him have a session talking about the code. That would be a very satisfying end to the drama for attendees. (Even if it does encourage more drama in future years.) Either way, I agree - I’m sure attendance will go up next year too. People love this stuff.
  - tptacek 2y ago
    It sounds to me like they were mad at Dmitry for including an "easter egg" in their badge firmware that solicited donations to a Bitcoin address.
    - josephg 2y ago
      Yep. Given that they thought Dmitry was a subcontractor of EE, them being mad about that makes a lot more sense.
    - Dylan16807 2y ago
      It was definitely an easter egg. A secret screen that gives credit to someone that worked on a thing and otherwise wouldn't get credit is the textbook example of an easter egg. It probably shouldn't have had the Bitcoin address, but it doesn't sound like that would have been treated much differently.
      - tptacek 2y ago
        I think you're going to find that firms who contract embedded designs have viewpoints about "easter eggs" that would be surprising, even off-putting, to message board communities that savor them like single malts. Generally, when firms arrange to deliver hardware/software to their own customers sourced from vendors, they want a clear understanding of what the software actually does.
- hnthrowaway0315 2y ago
  I'd like to ask as someone who is interested in RE/Security/Malware in general but without experience. Which events are good for me if I have to pay out of my own pocket? I don't work in related fields so education stipend does not apply. I surveyed the ground tonight and found two that are interesting: Recon (in Montreal) and CCC (in Hamburg). What do you think?
  - tptacek 2y ago
    I think CCC is basically in the same bracket as DEF CON in terms of seriousness. Someone's going to get mad at me for saying that, but I'll note that serious people go to DEF CON too, even though it is 100% a cultural event and not a real part of the cite record for our field. I've never heard anyone say anything but good things about REcon. I have FOMO about having never been.
    - hnthrowaway0315 2y ago
      Thanks for sharing. I'm actually close to Montreal so REcon is probably my best bet. The ticket is more expensive but I save lodging and transportation.
      - thequux 2y ago
        Hugo, the organizer of Recon, has historically been willing to work with people who are attending on their own dime. I suspect that if you were to send him an email explaining your situation, you'd be very happy with the response you received. It is an excellent conference that I've enjoyed every single time I've gone
        hnthrowaway0315 2y ago
        Thanks a lot! I'll definitely reach out to him next year.
- busterarm 2y ago
  > The idea that DEF CON's brand is "in the shitter" seems risible. Is it though? With 20+ attendances behind my belt, I was already sour on the experience at 2018 and didn't go in 2019 due to a family conflict and haven't been back since. Not only did "badgelife" absolutely ruin the whole fucking experience, but I started seeing large numbers of people start getting othered and excluded because of running afoul of idpol which IMO is entirely counter to the spirit of what the con had always been about. It permeates throughout the meta events of the con, like Ollam's Shoot, where you're warned very much in advance with overt threats to not express an opinion that even remotely smells right-wing while his staffers proudly wave antifa banners and shout the merits of being radleft. At the same time, my experience with the security industry as a whole is that most vendors are completely full of shit and spend all of their time chasing after fake clout (and all of the shady bullshit that goes along with it).
BoredPositron 2y ago
Honestly sounds like typical "CON" stuff. Just children all around no matter the topic.
- sergiotapia 2y ago
  my perception of them was they are hyper intelligent hackers, who have morals and clear north. if anybody would do the right thing it's these guys. but that illusion is no more. they are just normal dudes after all for better or worse.
  - NegativeK 2y ago
    I'm not sure if you're referring to the badge team or the Defcon people, but pretty much every group is just normal people.
- Aeolun 2y ago
  That’s because that’s ultimately what happens everywhere. We just paper over it by paying people for their time so they have to listen to you. When you go back to being all volunteer driven the drama increases correspondingly.
- numpad0 2y ago
  >90% of the world is run by dumb unqualified children. It's not worth trying to get everyone up to your supreme standards(you'll get it later at no cost).
ryandrake 2y ago
Reading both accounts of the story, it sounds like a small company bit off more than it could chew, couldn’t manage cost and schedule, and when it got to the drop-dead date, even though they say it was basically done (how many times did the client hear that one), the client pulled the plug and tried to salvage it some other way. Y’all need project managers, at least someone with a plan! jeez.
- A4ET8a8uTh0 2y ago
  I think I agree with the assessment. Especially the part about PM hits close to home. It seems how a lot of projects I was involved lately lacked an actual project manager. Is the problem that it is a hard job to do right?
  - theshrike79 2y ago
    The thing is that people on here think project managers are evil incarnate and just useless middle management. It requires a very specific skill set to be able to lead a technical project and cut through the bullshit on BOTH SIDES: the client asking for features and the team building the product. Clients always either ask for stuff they don't really need or have vague requirements that crystallise only 3 days after the deadline. "Of course when we said it needs to do foo, it also MUST do bar, doh!" And teams tend to overestimate their ability to deliver and underestimate the work needed to get to the finish. (Infinite coast problem).
    - q7xvh97o2pDhNrh 2y ago
      There's also several more classes of B.S., for what it's worth. An exaggerated/anonymized version of a recent one I got, from an otherwise-really-strong senior engineer: "Of course when I said we would put a button there, it also meant we MUST build an entire UI framework from scratch, with full test coverage for the entire thing!" ...actually, that's not even that exaggerated. Shipping software at big companies can be unreasonably difficult, sometimes.
      - 2y ago
viccis 2y ago
>dmitry forgot about an easter egg Ah yes, classic "insert an unauthorized coin wallet soliciting money from badge owners" easter egg. Timeless prank, how could anyone be mad at such a normal and anodyne "easter egg"? lmao DEFCON's "brand" isn't in any danger. edit: And now he's pulling the classic hacker move of (checks notes) enforcing strict software IP ownership rights? Guy's a class act all around. Hope everyone learned an important lesson about Dmitry and Entropic with this mess.
- josephg 2y ago
  He wasn’t employed by anyone, and didn’t get paid by anyone for his work. (Defcon is wrong about this in their statement, and admitted as such in the comment thread). When I write code that nobody is paying for, you better believe I’ll write it how I damn well please. If you aren’t paying, you aren’t the customer. And you don’t get to control the output of my work. The wallet address soliciting donations is for the hardware company, not on his own behalf. But even if it was on his own behalf, would you still be mad? Since when is it a crime to be proud of the code you’ve written, for free, to bring joy to an hacker conference? That deserves mad credit in my book.
  - viccis 2y ago
    I don't really care whether money changed hands. Secretly putting an ad into software that you know will be distributed to many people is the oldest scumbag move in the scumbag book. All sympathy ended there, and that was weeks before he trespassed.
    - josephg 2y ago
      Eh. When I was young, I played a demo of Doom that came with a magazine. When you finish the demo level, the game show an ad that said if I ponied up money, I could play the whole game. I fail to see the problem. And in this case it wasn’t an ad. It was a page saying you could donate to the hardware company if you want, who were out of pocket $100k for making the hardware. That’s an incredibly tame prank by Defcon standards.
    - 2y ago
deleted 2y ago
[deleted]

tptacek 2y ago

What should they have done better? They didn't have the option of doing better with Dmitry, right? He deliberately set up the confrontation with security. The idea that DEF CON's brand is "in the shitter" seems risible. I say that ruefully, as (in my declining years) I get more and more bitter about the comic convention spectacle the event has become. Whatever the outcome from "badge-gate", I assure you, they'll set attendance records next year regardless.

ibash 2y ago
> They didn't have the option of doing better with Dmitry, right? Let him give his talk like they promised. Given literally everyone in that room is using his work in that same moment and they are literally there to hear him speak.
- tptacek 2y ago
  Fuck no. People don't get to re-invite themselves to stages they've been disinvited from.
  - mynameisvlad 2y ago
    You asked someone to give you options and they did. Just because you don't like it doesn't mean it's not what you asked for.
    - aaplok 2y ago
      OP asked for a better option. He was offered one, which he disagreed with. Because he doesn't like it precisely means that (in his view at least) it is not what he asked for.
      - tptacek 2y ago
        I take their point; I didn't mean to be slapping back at them for taking the time to write a response!
        aaplok 2y ago
        Your point was valid though. You can't let someone rock up to the stage uninvited. This would open the door to all kinds of issues. And the original question of how the situation could have been handled better is the most interesting one. The rest is a game of he said/she said, which hn commenters tend to enjoy arguing about but is ultimately not very instructive. With hindsight it is clear that the situation had been brewing for some time, and the conflict had been escalating slowly. Perhaps due to the pressure and stress (and time pressure) of organising an event like that nobody managed to have enough distance to deescalate it, which culminated in someone being escorted off stage by security, not a good experience for anyone. Most likely once the invitation to talk had been rescinded the dice were thrown. It would have been hard for the speaker not to be offended, and unfair on him to expect him to take it quietly and move on without reacting. Someone should have been aware of that and worked with him to control the impact of this on his own reputation.
  - Aeolun 2y ago
    People don’t get to dis-invite people from stages when that is quite literally the only compensation given either. They made the software for the badge of your entire conference, for free, and then you won’t let them talk about it because what you got for free, wasn’t what you expected/wanted? That’s just dumb on so many levels I don’t even know where to begin. It’s like playing, no, selling someone elses mod and complaining it’s not up to the standards of a finished game.
    - tptacek 2y ago
      They absolutely do get to do that. Absolutely, and without qualification. It's their stage. There's a whole long history of this with DC/BH.
      - kelnos 2y ago
        I don't think GP meant "don't get to" as in it's not their legal right to do so (which of course it is). I think they meant that it's a profoundly shitty thing to do to someone, and DEFCON should rightly be criticized for disinviting him in the first place. I think an easter egg that includes a monetary solicitation is (at best) in poor taste, regardless of the circumstances. But canceling his talk 30 minutes prior to its start time for that? Nope, not cool. DEFCON's behavior in disinviting him was much much worse than his action that triggered it.
    - bawolff 2y ago
      > They made the software for the badge of your entire conference, for free, and then you won’t let them talk about it because what you got for free, wasn’t what you expected/wanted? You are saying this like it is unreasonable, but it seems entirely reasonable to me. Just because you do something for free does not entitile you to a conference talk about it. If you wanted to be paid for it (and make no mistake, a conference talk is a form of compensation. In many conferences companies pay huge sums of money to have a platform) then they should have got a contract.
      - deleted 2y ago
        [deleted]
  - ibash 2y ago
    He was given a 30 minute notice that he was disinvited. That’s pretty egregious. Especially since they were okay with him giving the talk as long as he apologized. And he offered to say “I didn’t mean to offend anyone”. So for a misunderstanding and mistake to drag him off the stage is stupid and ridiculous. > What should they have done better? They didn't have the option of doing better with Dmitry, right? He deliberately set up the confrontation with security. Maybe I misunderstood, I previously read that as “what could they have done better about the situation”. Did you mean “what could they have done better once he was at the stage?”
    - tptacek 2y ago
      I got locked in a hotel room by an actual goon who demanded a line-item veto of my slides (clients! what you'll do to keep clients happy!), and ask Mike Lynn how he feels about the response to his talk. Being asked not to take a stage to take credit for the annual DEF CON badge toy seems pretty low on the scale of security conference dramas. The "drag him off the stage" thing was his own arrangement.
      - CyberDildonics 2y ago
        What does that have to do with anything?
tedunangst 2y ago
I would simply level up charisma and speech check him off the stage.
josephg 2y ago
It was a huge mistake to uninvite him from the session. It sounds like defcon was mad at EE for going over budget - which honestly is fair even though they didn’t handle it well. And thought (wrongly) that Dmitry was a salty subcontractor of theirs. Their actions make some sense in that context. Not great, but eh. But Dmitry has totally owned them in messaging - by forcing them to physically eject him (making a scene), and getting out ahead of the story. It’s great drama. He’s positioned defcon to look like an evil corporate buffoon hating on a hacker who was just donating his time. At this point, defcon should take the L and apologise, and let him have a session talking about the code. That would be a very satisfying end to the drama for attendees. (Even if it does encourage more drama in future years.) Either way, I agree - I’m sure attendance will go up next year too. People love this stuff.
- tptacek 2y ago
  It sounds to me like they were mad at Dmitry for including an "easter egg" in their badge firmware that solicited donations to a Bitcoin address.
  - josephg 2y ago
    Yep. Given that they thought Dmitry was a subcontractor of EE, them being mad about that makes a lot more sense.
  - Dylan16807 2y ago
    It was definitely an easter egg. A secret screen that gives credit to someone that worked on a thing and otherwise wouldn't get credit is the textbook example of an easter egg. It probably shouldn't have had the Bitcoin address, but it doesn't sound like that would have been treated much differently.
    - tptacek 2y ago
      I think you're going to find that firms who contract embedded designs have viewpoints about "easter eggs" that would be surprising, even off-putting, to message board communities that savor them like single malts. Generally, when firms arrange to deliver hardware/software to their own customers sourced from vendors, they want a clear understanding of what the software actually does.
hnthrowaway0315 2y ago
I'd like to ask as someone who is interested in RE/Security/Malware in general but without experience. Which events are good for me if I have to pay out of my own pocket? I don't work in related fields so education stipend does not apply. I surveyed the ground tonight and found two that are interesting: Recon (in Montreal) and CCC (in Hamburg). What do you think?
- tptacek 2y ago
  I think CCC is basically in the same bracket as DEF CON in terms of seriousness. Someone's going to get mad at me for saying that, but I'll note that serious people go to DEF CON too, even though it is 100% a cultural event and not a real part of the cite record for our field. I've never heard anyone say anything but good things about REcon. I have FOMO about having never been.
  - hnthrowaway0315 2y ago
    Thanks for sharing. I'm actually close to Montreal so REcon is probably my best bet. The ticket is more expensive but I save lodging and transportation.
    - thequux 2y ago
      Hugo, the organizer of Recon, has historically been willing to work with people who are attending on their own dime. I suspect that if you were to send him an email explaining your situation, you'd be very happy with the response you received. It is an excellent conference that I've enjoyed every single time I've gone
      - hnthrowaway0315 2y ago
        Thanks a lot! I'll definitely reach out to him next year.
busterarm 2y ago
> The idea that DEF CON's brand is "in the shitter" seems risible. Is it though? With 20+ attendances behind my belt, I was already sour on the experience at 2018 and didn't go in 2019 due to a family conflict and haven't been back since. Not only did "badgelife" absolutely ruin the whole fucking experience, but I started seeing large numbers of people start getting othered and excluded because of running afoul of idpol which IMO is entirely counter to the spirit of what the con had always been about. It permeates throughout the meta events of the con, like Ollam's Shoot, where you're warned very much in advance with overt threats to not express an opinion that even remotely smells right-wing while his staffers proudly wave antifa banners and shout the merits of being radleft. At the same time, my experience with the security industry as a whole is that most vendors are completely full of shit and spend all of their time chasing after fake clout (and all of the shady bullshit that goes along with it).

BoredPositron 2y ago

Honestly sounds like typical "CON" stuff. Just children all around no matter the topic.

sergiotapia 2y ago
my perception of them was they are hyper intelligent hackers, who have morals and clear north. if anybody would do the right thing it's these guys. but that illusion is no more. they are just normal dudes after all for better or worse.
- NegativeK 2y ago
  I'm not sure if you're referring to the badge team or the Defcon people, but pretty much every group is just normal people.
Aeolun 2y ago
That’s because that’s ultimately what happens everywhere. We just paper over it by paying people for their time so they have to listen to you. When you go back to being all volunteer driven the drama increases correspondingly.
numpad0 2y ago
>90% of the world is run by dumb unqualified children. It's not worth trying to get everyone up to your supreme standards(you'll get it later at no cost).

ryandrake 2y ago

Reading both accounts of the story, it sounds like a small company bit off more than it could chew, couldn’t manage cost and schedule, and when it got to the drop-dead date, even though they say it was basically done (how many times did the client hear that one), the client pulled the plug and tried to salvage it some other way. Y’all need project managers, at least someone with a plan! jeez.

A4ET8a8uTh0 2y ago
I think I agree with the assessment. Especially the part about PM hits close to home. It seems how a lot of projects I was involved lately lacked an actual project manager. Is the problem that it is a hard job to do right?
- theshrike79 2y ago
  The thing is that people on here think project managers are evil incarnate and just useless middle management. It requires a very specific skill set to be able to lead a technical project and cut through the bullshit on BOTH SIDES: the client asking for features and the team building the product. Clients always either ask for stuff they don't really need or have vague requirements that crystallise only 3 days after the deadline. "Of course when we said it needs to do foo, it also MUST do bar, doh!" And teams tend to overestimate their ability to deliver and underestimate the work needed to get to the finish. (Infinite coast problem).
  - q7xvh97o2pDhNrh 2y ago
    There's also several more classes of B.S., for what it's worth. An exaggerated/anonymized version of a recent one I got, from an otherwise-really-strong senior engineer: "Of course when I said we would put a button there, it also meant we MUST build an entire UI framework from scratch, with full test coverage for the entire thing!" ...actually, that's not even that exaggerated. Shipping software at big companies can be unreasonably difficult, sometimes.
    - 2y ago

viccis 2y ago

>dmitry forgot about an easter egg Ah yes, classic "insert an unauthorized coin wallet soliciting money from badge owners" easter egg. Timeless prank, how could anyone be mad at such a normal and anodyne "easter egg"? lmao DEFCON's "brand" isn't in any danger. edit: And now he's pulling the classic hacker move of (checks notes) enforcing strict software IP ownership rights? Guy's a class act all around. Hope everyone learned an important lesson about Dmitry and Entropic with this mess.

josephg 2y ago
He wasn’t employed by anyone, and didn’t get paid by anyone for his work. (Defcon is wrong about this in their statement, and admitted as such in the comment thread). When I write code that nobody is paying for, you better believe I’ll write it how I damn well please. If you aren’t paying, you aren’t the customer. And you don’t get to control the output of my work. The wallet address soliciting donations is for the hardware company, not on his own behalf. But even if it was on his own behalf, would you still be mad? Since when is it a crime to be proud of the code you’ve written, for free, to bring joy to an hacker conference? That deserves mad credit in my book.
- viccis 2y ago
  I don't really care whether money changed hands. Secretly putting an ad into software that you know will be distributed to many people is the oldest scumbag move in the scumbag book. All sympathy ended there, and that was weeks before he trespassed.
  - josephg 2y ago
    Eh. When I was young, I played a demo of Doom that came with a magazine. When you finish the demo level, the game show an ad that said if I ponied up money, I could play the whole game. I fail to see the problem. And in this case it wasn’t an ad. It was a page saying you could donate to the hardware company if you want, who were out of pocket $100k for making the hardware. That’s an incredibly tame prank by Defcon standards.
  - 2y ago

deleted 2y ago

[deleted]