21 ms·
Entropic Engineering DEFCON 32 Statement
- Fokamul 2y ago[flagged]
- ksplicer 2y ago"I always avoid working with EU firms, they are way too lazy. You give them a clear deadline and the next thing you know they tell you everyone went on vacation." I'm sure you've heard that before. It's exactly the same kind of shit "woman-owned, queer- and POC-driven" firms hear. I'm sure they are happy for the occasional person that wants to hire them due to prejudices considering how much more work they are losing for the same reason.
- iseanstevens 2y agoVery classy response. I hope things get worked out
- tptacek 2y agoI regret that I have only two eyes to roll at this: We are especially grateful that Dmitry was not hurt in the physical removal he was subjected to as a result of his demonstration of solidarity. We want to extend our thanks to all attendees who have been asking questions, reaching out, attending surprise side-walk cons, displaying the about page badge on the con floor, and, especially, keeping a community eye on law enforcement and conference security to help ensure our friend Dmitry’s safety in the last 48 hours. The guy deliberately crashed the stage, knowing his invitation had been rescinded, demanding that "security" (read: random goobers who volunteer for this role in exchange for a colored t-shirt) remove him. He's fine. He got literally the thing he wanted, and "Entropic" knows that full well. You're a vendor in a contract dispute, Entropic, not Poland's organized effort to throw off Soviet Communism. Miss me with this "solidarity" stuff.
- doctorpangloss 2y agoYou’d feel different if it were you getting stiffed payment! After reading the further responses, I am convinced that DEF CON is kind of a crummy business. This commenter, who does not deserve to be downvoted, and the vendor were both stiffed by DEF CON. There seems to be a lot of drama attached to this organization that unfairly rubs off on its well meaning collaborators. In the interest of curiosity, I wonder why IT organizations built on the free contributions of others can ever treat their collaborators indelicately. It would be one thing if DEF CON were some superstar artist, where taking the kid gloves off and delivering harsh feedback is part of the learning process, but it’s just a conference organizer.
- tptacek 2y agoWho, Dmitry? Dmitry had no arrangement with DEF CON. Entropic? I've been (I think!) where Entropic has been many times, and you've never read about any of them because, like most professionals, I didn't make a huge stink about it.
- threatofrain 2y agoIf Dmitry had no arrangement with defcon, why was he invited (looks like consideration), and why did he do work after the request to stop work? Dmitry maintains that he was not doing contractual work for Entropic. Was anything ever written down on paper with regards to Dmitry's relationship to anything?
- adw 2y agoIs it reasonable to expect better of a prominent institution like DEFCON than from some other typical company?
- metadat 2y agoI'm struggling to reconcile this response vs the Bitcoin address "Easter egg" and the other claims in the prior article (https://news.ycombinator.com/item?id=41211519 https://news.ycombinator.com/item?id=41211519), and a few other aspects. Such a gross "oversight" does not reflect the care they're claiming to have exercised. This part also seems a tad over the top and dramatic: > We are especially grateful that Dmitry was not hurt in the physical removal he was subjected to as a result of his demonstration of solidarity This individual chose to not comply with the venue operator's request to leave the stage, so they pretty gently escorted him away, as can be seen in the video which has been linked in every prior submission. Risk of injury was negligible, if any. So I'm left uncertain which story is to be trusted here. To be fair, it's clear DefCon has previously been fueled by Supermen and Superwomen who threw themselves under the bus (possibly were exploited) by working for free or nearly free to deliver. People deserve to be compensated for their work according to the terms of whatever employment agreement was signed, not the games that have been played here. If quality of work was misaligned, it'd be another matter, but neither party has alluded to this.
- wokwokwok 2y ago> So I'm left uncertain which story is to be trusted here I mean, it seems pretty clear to me that defcon is in the wrong here, and everything else is just drama. Filing the serial numbers off to hide that EE was to credit for it, getting f’d at a hidden screen that credited them. Come on, fuck off. EE did the work here. Not crediting them sucks. The rest of the stuff, I really dont care about, but you can’t put a ribbon on what they did. Remastering the injection mold cast? Removing the logo? That sucks. :( Give credit where credit is due. If you didn’t make it, don’t try to pretend you did.
- deleted 2y ago[deleted]
- dylan604 2y ago> If you didn’t make it, don’t try to pretend you did. Just because you don't visibly put the creator's logo on the thing does not mean you are pretending that you made the thing. Your Ford F150 does not have the logos of the 3rd party companies that programmed the ECUs, made the brake pads, etc, and yet I doubt anyone here would think that Ford is pretending they did whatever. This is not agreeing with what was done, just brake checking your broadbrushing
- tedunangst 2y agoDid the contract between defcon and EE include working firmware? If Dmitry rescinds the license, is the deliverable now even more short of specification?
- ChrisArchitect 2y agoRelated: Defcon stiffs badge HW vendor, drags FW author offstage during talk https://news.ycombinator.com/item?id=41207221 https://news.ycombinator.com/item?id=41207221
- numpad0 2y agoDo this look like someone mistook budget allotted by a magnitude, or was too scared to speak up until it's too late and situation had to be escalated to (no offense)an adult to initiate shutdown?
- rcxdude 2y agoI was thinking it may have been something like that. But it's still shitty to a) wait until the project is complete to tell them they're not getting paid, and b) erase credit (I don't see any good justification for this. It's literally the reason they were getting a discount in the first place, and they went to quite some effort to do it)
- Aurornis 2y agoThey didn’t wait until the project was complete. They issued a stop work order due to being over budget and also some “bad faith” charges they noticed. DEFCON then sent their own team to handle the production run. Credit was not erased from the PCB nor the software, which were the parts Entropic was contracted to do. They declined to include entropic on the plastics, which is understandable given that Entropic didn’t do the plastics. It also likely saved machining costs on the mold for a project that was already over budget. The original accusations appear to be a little exaggerated.
- rcxdude 2y agoThey also don't credit them in the con booklet either (but did credit Rpi). And the credit in the software is what got the firmware author kicked out, so it very much feels like defcon went out of their way to avoid crediting them for some reason. And issuing a stop work order doesn't mean you can just not pay for the work done so far. It means you're not paying for any further work.
- trickstra 2y ago> They didn’t wait until the project was complete These two statements cannot be both true at the same time 🠉 🠋 > Once a month, we billed for our work and submitted an updated estimated per badge final cost - committing as costs built to discount our work as necessary in order to hit DEFCON’s per unit cost targets. https://www.entropicengineering.com/defcon-32-statement https://www.entropicengineering.com/defcon-32-statement
- commercialnix 2y ago[flagged]
- nubinetwork 2y ago> Even I, as a gay half-Asian Muslim, not that any of that should matter, feel this needs to be pointed out: How is it not racist and sexist? Because if you're not very publicly and loudly checking off all the DEI boxes, you're just hiring a bunch of white cisgender heterosexual men. This isn't just defcon, this is how every company acts these days.
- deleted 2y ago[deleted]
- commercialnix 2y agoI feel like at some of my previous jobs I'd never have been hired if I weren't half negro.
- nubinetwork 2y agoAfter the US had the BLM protests, Canada has had the same DEI drive towards indigenous people. I worry for the future generations of students who just want to find a job without having to be a part of some label.
- consp 2y agoUsually inclusive hires are forced because they have a lower chance of getting though a normal process. If it was an actual level playing field this would not matter but it isn't, and it's not even close. The goal is for those policies to make themselves obsolete (at least where I live there is always a clear cutoff point where they should stop)
- hosteur 2y ago> This isn't just defcon, this is how every company acts these days. Does not make it less racist.
- Aurornis 2y agoDEFCON’s response was posted on Reddit: https://www.reddit.com/r/Defcon/s/NVw5T4LXQR https://www.reddit.com/r/Defcon/s/NVw5T4LXQR Unsurprisingly, it contradicts some of the claims Entropic has been making. Entropic admits to having exceeded agreed upon budgets by a significant amount, which DEFCON corroborates. There is some disagreement about what has been paid, though, as DEFCON believes they have paid for the hardware development. Some of the other claims also appear to have been exaggerated or at least phrased in misleading ways. The Entropic Engineering logo was not removed from the PCBs. Their logo was not included on the plastics because Entropic was not responsible for the plastics and the initial plan to include their logo was only a courtesy before the relationship soured. The DEFCON statement alludes to budgets being exceeded by a significant margin (not covered by minor reductions in hourly rate as the other statement implied) and even calls out some “bad-faith” charges. I’m also confused about the earlier threats to use the DMCA against DEFCON for using the firmware without a license. As far as I can tell, the firmware was produced as part of the agreement between DEFCON and Entropic, in which case there shouldn’t be much question about the license as it’s a work for hire. Imagine hiring a company to write software to your spec and then to have them later try to claim they’re going to pursue legal action for using the software you paid them to write. Something is strange here. It also appears that the firmware engineer’s dismissal from the talk was communicated before it began, so his choice to get on stage anyway knowingly violated that decision. Regardless of what we think should have happened, getting up on stage after being told not to isn’t going to go well at any conference for any reason. I think there’s a lot more to this story than the initial round of accusations let on. I think the first movers in publishing their narrative often win the public opinion debate, but if even half of what DEFCON is saying is true then Entropic and their team don’t appear to be operating entirely in good faith with the way they’ve handled this publicity.
- deleted 2y ago[deleted]
- gizmo686 2y ago> there shouldn’t be much question about the license as it’s a work for hire. Work for hire is about employees. Entropic is not an employee of DEFCON, it is a company with a contractual agreement to provide something in exchange for money. The details of when, if ever, IP rights are transferred to DEFCON should be spelled out in the contract. I have seen all sorts of arrangements for that. However, in a well drafted contract, IP ownership probably wouldn't transfer prior to payment. Also, the firmware author isn't an employee of anyone. In a lawyerly world, that would be resolved with a clear copyright assignment or license, but I have no idea if that happened.
- jmward01 2y agoIt sounds like an independent third party needs to review what happened.
- firesteelrain 2y agoNo, that’s entirely unnecessary and unrealistic. This happens nearly every day between a Buyer and Seller. Entropic was basically on a Time and Materials (T&M) contract. Buyer (DEFCON) had every right to terminate when it looked like costs were starting to soar. Entropic appears to pulling at some emotional response with their initial introduction in regards to LBGTQ, etc. That’s irrelevant information.
- kalleboo 2y agoYou've seen the contract?
- deleted 2y ago[deleted]
- krisoft 2y ago> Entropic was basically on a Time and Materials (T&M) contract. What is your source for this?
- deleted 2y ago[deleted]
- deleted 2y ago[deleted]
- trickstra 2y ago> when it looked like costs were starting to soar. But it appears they waited until the end.
- firesteelrain 2y ago
- j0hnyl 2y agoDEFCON continues to demonstrate year after year just how poorly its run. There are bigger events out there (albeit not hacking cons) that cost less and go much more smoothly. Meanwhile, the price of DEFCON admission continues to increase every year while value diminishes.
- deleted 2y ago[deleted]
- djfergus 2y agoHow does one reconcile the statement below with DEFCON’s claim that they were 60% over budget? > Once a month, we billed for our work and submitted an updated estimated per badge final cost - committing as costs built to discount our work as necessary in order to hit DEFCON’s per unit cost targets.
- jawns 2y agoJust a guess, but the overall budget and the unit cost of the badges are likely two separate things. And you can express unit cost in two different ways: one that includes the cost to develop them, and one that includes only the cost to produce them.
- dmitrygr 2y agodefcon folks rarely looked at those status emails, and more than once ADMITTED having not looked!
- HL33tibCe7 2y ago[flagged]
- krisoft 2y agoAs per usual nobody comes out of these things looking good. To really understand who is right and who is wrong here we would need to read the letter of the agreements between these entities, and cross reference them with facts. Of course neither the contracts, nor the facts are available to us. As is, the best I can do here is to put all participants on my personal “do not work with” list. Who needs the drama. In particular there seems to be at least two points of miscommunication: it sounds like EE were told how much DEFCON can spend per badge. And they took that number to mean only the cost of the board and electrical engineering costs associated with it. Ignoring other costs (lanyard for sure, and maybe the cost of the plastic case too?). The other missed connection seems to be the legal position of the firmware developer. EE seems to say they thought the guy was not their subcontractor but someone working for DEFCON. While DEFCON seems to imply that they thought he was an EE subcontractor. I see a lot comments here with strong opinions on who is right and who is wrong in this dispute. It also seems to be that those strong opinions are based on assumptions. In particular assumptions about what the contract might say, but treated as if it is not a speculation but the truth. That logic is not persuasive to me.
- flumpcakes 2y agoI think this is a very balanced take and probably one that most people should follow. However, I do slightly favour defcon in this mess - why did Entropic take on a project that was nearly "impossible". Why did the firmware engineer add a crypto beg for a "joke".
- tokamak 2y agoSeems like they conveniently omitted some facts here. Very fishy.
- deleted 2y ago[deleted]
- chambers 2y agoReading this statement, DEFCON's, and Reddit: it looks like the lowest bidder was a hired to do a complicated and costly project that the client historically underfunded (paper badges last year). If it's true that DEFCON wanted dirt cheap badges produced in record time, then I think the fault lies not in the project's management & execution but in the client's expectations & resourcing. No accomplished vendor would accept such a low price point, so that just leaves the unaccomplished. Vendors who overpromise and underdeliver, who would accept payment in terms of "clout", or who would be too afraid to pushback on crazy or high pressure expectations until it's too late. A classic set-up-to-fail situation.
- daghamm 2y agoOn the contrary, it seems like EE were chosen due to previous experience and close connections with the pi foundation. This is how they got access to the new chip. For me, this is a clear case of mismanagement and bad communication. DC gave EE the wrong budget (cost for the whole badge instead of the PCB+fw) and then completely ignored the reports they received until it was too late. At which point they decided force EE pay for their mistake instead of man-ing up and accepting at least some responsibility. Don't forget DC gets 460$ × 30k from ticket sales alone, they should be able to handle this better. And this is not the first time they have screwed suppliers.
- olalonde 2y ago> They expressed that they specifically wanted to work with us as a woman-owned, queer- and POC-driven engineering firm Why would someone's gender, sexual orientation or skin color be relevant to developing a badge? This is so weird.
- jawns 2y agoYou're right, it's not relevant to their abilities. It's relevant to the historical opportunities that such companies have had available to them. Likely, the thinking was, "We know that in the past such firms have experienced disadvantages. In years past, bias and discrimination against them may have hurt their chances of procuring a contract like this. Recognizing that historical disadvantage, we now want to give such firms opportunities to show the world that they are every bit as capable."
- fortran77 2y agoCutting edge, avant garde creative companies have for centuries been staffed by non-conforming people. We could give a similar description for the staff of our consulting company. But we don't. We just use our work and our reputation. There's no "historical disadvantage" for a company that supports the hacker community to be full off all sorts of eccentric, non-conforming people.
- firesteelrain 2y agoEspecially since this is JLCPCB type work. It should be fairly automated.
- echoangle 2y agoI would guess most of the work was the design, not the manufacturing.
- firesteelrain 2y ago“ we sourced components, designed all of the hardware, wrote production test software, and organized all circuit board manufacturing, prototype manufacturing, facilitated large volume production manufacturing and logistics, and general project coordination. ”
- maxlin 2y agoWho starts an article, especially one questioning responsibility with the lines in the sort of "woman-owned, queer- and POC-driven ... " ?? It's impossible to try to remove the sense of entitlement one gets from this company after that, given the rest of the situation seems to weight in to that way especially given I've heard of procurement of these badges having no such problems before. EDIT: That said, Defcon doesn't end up looking too good either after this. Nothing good can come of this given things like this are usually probably done in quite good faith.
- waihtis 2y ago> Who starts an article, especially one questioning responsibility with the lines in the sort of "woman-owned, queer- and POC-driven ... " ?? Exactly those type of orgs which exist primarily to fill this quota. Any kind of capacity to actually fulfill project requirements is secondary
- neilv 2y ago> Who starts an article, especially one questioning responsibility with the lines in the sort of "woman-owned, queer- and POC-driven ... " ?? It's impossible to try to remove the sense of entitlement one gets from this company after that, [...] FWIW, I noticed that line as I read it, but it didn't make me prejudge the situation. I mostly noted it as a potential interesting bit of info that might reflect well on DEFCON organizers involved with the badges. Are you critiquing the writer's PR savvy -- that they should know that progressive references can both help and hurt them, due to political polarization? (Examples: Some people warm to them. Others feel skepticism or even anger. Others might be personally indifferent, but assessing the PR situation.) Or are you saying that you think a line like that definitely hurts reception of the writer's argument much more than helps them, with whomever their target audiences are?
- itsoktocry 2y ago>that they should know that progressive references can both help and hurt them, due to political polarization? Why is it "political polarization"? DC hired an engineering firm based on, at least in part, reasons that have nothing to do with engineering. The project fell apart. Should the procurement process not be questioned, along with selection criteria?
- kovacs_x 2y agoOnly meaningful info in whole this is that it was a production of 30'000 units. Any guesses on DEFCON's budgets "targets" and EE billed extra hours (including rates) anyone? :?
- Gud 2y agoWhat would be interesting to see is if this is a pattern. DEFCCON is a yearly convention with many participants. Has others been treated in a similar fashion? Or are they usually fair.