I still think DEFCON should've done better. their brand is in the shitter over what $20k?

The idea that DEF CON's brand is "in the shitter" seems risible. I say that ruefully, as (in my declining years) I get more and more bitter about the comic convention spectacle the event has become. Whatever the outcome from "badge-gate", I assure you, they'll set attendance records next year regardless.

Let him give his talk like they promised.

Given literally everyone in that room is using his work in that same moment and they are literally there to hear him speak.

And the original question of how the situation could have been handled better is the most interesting one. The rest is a game of he said/she said, which hn commenters tend to enjoy arguing about but is ultimately not very instructive.

With hindsight it is clear that the situation had been brewing for some time, and the conflict had been escalating slowly. Perhaps due to the pressure ans stress (and time pressure) of organising an event like that nobody managed to have enough distance to deescalate it, which culminated in someone being escorted off stage by security, not a good experience for anyone.

Most likely once the invitation to talk had been rescinded the dice were thrown. It would have been hard for the speaker not to be offended, and unfair on him to expect him to take it quietly and move on without reacting. Someone should have been aware of that and worked with him to control the impact of this on his own reputation.

They made the software for the badge of your entire conference, for free, and then you won’t let them talk about it because what you got for free, wasn’t what you expected/wanted?

That’s just dumb on so many levels I don’t even know where to begin.

It’s like playing, no, selling someone elses mod and complaining it’s not up to the standards of a finished game.

You are saying this like it is unreasonable, but it seems entirely reasonable to me.

Just because you do something for free does not entitile you to a conference talk about it. If you wanted to be paid for it (and make no mistake, a conference talk is a form of compensation. In many conferences companies pay huge sums of money to have a platform) then they should have got a contract.

I think an easter egg that includes a monetary solicitation is (at best) in poor taste, regardless of the circumstances. But canceling his talk 30 minutes prior to its start time for that? Nope, not cool. DEFCON's behavior in disinviting him was much much worse than his action that triggered it.

Especially since they were okay with him giving the talk as long as he apologized. And he offered to say “I didn’t mean to offend anyone”.

So for a misunderstanding and mistake to drag him off the stage is stupid and ridiculous.

> What should they have done better? They didn't have the option of doing better with Dmitry, right? He deliberately set up the confrontation with security.

Maybe I misunderstood, I previously read that as “what could they have done better about the situation”.

Did you mean “what could they have done better once he was at the stage?”

The "drag him off the stage" thing was his own arrangement.

It sounds like defcon was mad at EE for going over budget - which honestly is fair even though they didn’t handle it well. And thought (wrongly) that Dmitry was a salty subcontractor of theirs. Their actions make some sense in that context. Not great, but eh.

But Dmitry has totally owned them in messaging - by forcing them to physically eject him (making a scene), and getting out ahead of the story. It’s great drama. He’s positioned defcon to look like an evil corporate buffoon hating on a hacker who was just donating his time.

At this point, defcon should take the L and apologise, and let him have a session talking about the code. That would be a very satisfying end to the drama for attendees. (Even if it does encourage more drama in future years.)

Either way, I agree - I’m sure attendance will go up next year too. People love this stuff.

It probably shouldn't have had the Bitcoin address, but it doesn't sound like that would have been treated much differently.

But it's objectively an easter egg. Why the scare quotes?

And unpaid programmers doing cheeky things with code because they want to is the heart of DEFCON.

I can see where DEFCON is coming from with the calls they made here. But it’s a mistake to treat Dimitri as if he were a vendor. He's not.

>PS: there are a few easter eggs in the stock badge firmware, try to find them or come to the badge talk at DEFCON to see for yourself ;)

I surveyed the ground tonight and found two that are interesting: Recon (in Montreal) and CCC (in Hamburg).

What do you think?

I've never heard anyone say anything but good things about REcon. I have FOMO about having never been.

It is an excellent conference that I've enjoyed every single time I've gone

Is it though? With 20+ attendances behind my belt, I was already sour on the experience at 2018 and didn't go in 2019 due to a family conflict and haven't been back since.

Not only did "badgelife" absolutely ruin the whole fucking experience, but I started seeing large numbers of people start getting othered and excluded because of running afoul of idpol which IMO is entirely counter to the spirit of what the con had always been about.

It permeates throughout the meta events of the con, like Ollam's Shoot, where you're warned very much in advance with overt threats to not express an opinion that even remotely smells right-wing while his staffers proudly wave antifa banners and shout the merits of being radleft.

At the same time, my experience with the security industry as a whole is that most vendors are completely full of shit and spend all of their time chasing after fake clout (and all of the shady bullshit that goes along with it).

Y’all need project managers, at least someone with a plan! jeez.

Or do what every other event does, and don't make your badges so complicated they need a project manager

Every other event has badges that look like they cost substantially less than $1. I'm not saying they have to go that cheap - but when you're hiring a project manager to coordinate the multiple teams, schedule challenges, and providers biting off more than they can chew? Maybe scale things back a bit.

Me and a partner designed an insert that fit into that injection molded part and it had games. You could even connect via RS232 if you had the right board and it would print out DEFCON in ASCII then it had whole menu of games.

We sold this add on for $20 at cost to recoup our costs. Sold about 100+ of these add ons.

DEFCON definitely bit off more than they could chew.

We designed our add on around a cheap STM32 series chip and wrote the code ourselves in C. It didn’t have an emulator like this as this is like an entire gaming platform that DEFCON created. But ours was more like DOS level game add on that took us a couple months to make and have produced. We made the stickers ourselves and cut acrylic ourselves.

If you're saying not to have a cool gizmo at all, I think that's too harsh of a lesson.

As for the cost of the badge, sourcing even sub-$1 badge is still a project. And especially when your target audience is somewhat skilled at counterfeiting such things.

It requires a very specific skill set to be able to lead a technical project and cut through the bullshit on BOTH SIDES: the client asking for features and the team building the product.

Clients always either ask for stuff they don't really need or have vague requirements that crystallise only 3 days after the deadline. "Of course when we said it needs to do foo, it also MUST do bar, doh!"

And teams tend to overestimate their ability to deliver and underestimate the work needed to get to the finish. (Infinite coast problem).

An exaggerated/anonymized version of a recent one I got, from an otherwise-really-strong senior engineer: "Of course when I said we would put a button there, it also meant we MUST build an entire UI framework from scratch, with full test coverage for the entire thing!"

...actually, that's not even that exaggerated. Shipping software at big companies can be unreasonably difficult, sometimes.

I've studied project management, I've managed projects and lead teams, but holy crap those people are on a whole other level with how well they gather and disseminate information and communicate it effectively.

None of them could code themselves out of a wet paper bag, but that's not the skill they get hired for.

We have better tools today, but it takes a skilled practitioner to wield them well. Yes I'm talking about Jira and I hate sitting down and pointing things too, but managing a large complex project with a large number of humans is real actual work and a full time job in and of itself. sometimes even more than one person can handle. places that I've seen are successful are able to recognize that, and don't treat it as dead weight.

The fact that Dmitry was still pushing changes on the aeroplane, although he seemed to frame this as a positive, doesn't exactly inspire a lot of confidence in their professionalism, viewed from the outside.

Ah yes, classic "insert an unauthorized coin wallet soliciting money from badge owners" easter egg. Timeless prank, how could anyone be mad at such a normal and anodyne "easter egg"?

lmao DEFCON's "brand" isn't in any danger.

edit: And now he's pulling the classic hacker move of (checks notes) enforcing strict software IP ownership rights? Guy's a class act all around. Hope everyone learned an important lesson about Dmitry and Entropic with this mess.

Doing it as counterplay to a lack of credit is a great hack.

When I write code that nobody is paying for, you better believe I’ll write it how I damn well please. If you aren’t paying, you aren’t the customer. And you don’t get to control the output of my work.

The wallet address soliciting donations is for the hardware company, not on his own behalf. But even if it was on his own behalf, would you still be mad? Since when is it a crime to be proud of the code you’ve written, for free, to bring joy to an hacker conference? That deserves mad credit in my book.

I fail to see the problem.

And in this case it wasn’t an ad. It was a page saying you could donate to the hardware company if you want, who were out of pocket $100k for making the hardware. That’s an incredibly tame prank by Defcon standards.

Even if Entropic shat the bed so badly that DEFCON's takeover of badge production was actually warranted (I'm super skeptical of this claim), the badges still consisted nearly entirely of Entropic's & Dmitry's work. DEFCON's removal of credit from the badge case was deeply unethical.

You're under no obligation to write code. You are under an obligation not to sneak an advert into someone else's conference via essentially fraudulent means.

Just because nobody is paying you, doesn't mean you have carte blanche to do whatever you want.

I dont think this is a controversial opinion. If someone created a piece of open source software but hid a trojan or cryptominer in it people would find it objectionable. You could quibble about where the line is, but i think everyone agrees that just because something is free does not give you the absolute right to do whatever you want.

We aren't talking about client work here. We're talking about defcon, where cheekily thumbing your nose at authority through code is the heart and soul of the conference. This single, hidden page asking for donations on behalf of the hardware company is a total nothingburger. Getting up in arms about it for being unprofessional is ridiculous.

People in this thread do seem to be very upset about a hacker doing hacker things. For a bit more irony, we're on Hacker News...

Just imagine what would happen if you created a shareware scene in the software of some company you work for. You would get fired (and possibly sued) so fast it would make your head spin.

"They expressed that they specifically wanted to work with us as a woman-owned, queer- and POC-driven engineering firm to develop an electronic badge with a gaming element for this year’s conference."

I would have expected the core criteria to be ability to execute on time. Choosing an engineering firm based on the race, gender, or sexual orientation of the owner is foolish, and DEF CON is ultimately to blame for introducing superfluous criteria and missing the core criteria.

>and, especially, keeping a community eye on law enforcement and conference security to help ensure our friend Dmitry’s safety in the last 48 hours.

Has there been anything in all this that would suggest anyone was in danger at the conference?

This kind of comment about safety is pretty standard among very progressive communities anytime anyone disagrees with them.

Depends on how much you danger you consider someone making unwanted physical contact and restraining your movements.

Not only did they have law enforcement intervene in his removal, but goons continued to threaten his removal and he was banned from the discord.

Obviously as a private group DEF CON’s organizers have every right to contract with whatever companies they want to. In the same way, obviously the private individuals paying DEF CON’s organizers have every right to criticize them when they treat their contractors so poorly. However , I think it’s short-sighted and self-defeating to suggest that they shouldn’t ALSO have the right to criticize their choice of companies they work with when it impacts the quality of what they’re paying for.

This is not a sexist, anti-POC, or anti-trans criticism. Deciding on contractors for the reasons they claimed they did would be illegal in the public sector under France’s anti-discrimination laws, under Germany’s Grundgesetz, under Japan’s GPA, under the UK’s Equality Act in many cases, etc.

If I remember correctly there are some laws about discrimination by sexual orientation etc

To explain myself, try to imagine that they said to have been picked because white cis men

They could have easily rephrased that sentence to simply say “They expressed interest in working with us” and the point they’re making is the same.

It could easily be that multiple teams looked qualified during bidding for the job and that this was the distinguishing factor.

That's because "ability to do the project" is a given. It is always a requirement, outside of specific corruption scenarios.

If it was meant to be a point then it can make people think that those with that societal lean are poor performers. It’s not helping their cause.

If I look at the Defcon30 badge from 2022. It's the same thing. A small random engineering shop is selected and gets the order. And you get a nice little badge that can do stuff.

For the Dutch hacker camps we look a bit more long term and the engineers and designers have been part of the core team since 2017. And for 2025 we're already well underway.

https://badge.team

There's a nice overview website with all the events around The Netherlands. https://hackeropuit.nl/

How can you say that when badges were on time and working at the end of the day?

But this breakdown in trust, too short timescales, using a new chip, not backing it up with extra funding and choosing this engineering company remains Defcons responsibility for running the project and realising a product.

Without full payment of the development costs, the IP for the PCB probably was still owned by EE and they could have stopped production. This shit show could have been prevented.

[0] the boring version without moving obstacles, PVC pipes, or fiberglass dinosaurs - further adding insult to injury

Or some less formal consent was understood, and considered low-risk?

Or were they otherwise legally empowered to do that?

(I'm thinking about civil and criminal liability.)

I'm asking out of curiosity about how that actually works, in practice, not what arguments we could imagine.

(For example: Say, someone rushes up on stage during a rock music concert. Was removal covered in the fine print terms of the ticket? Are the security personnel deputized by local law enforcement? Are there special ordinances applying to security at some kinds of events? Do the event organizers fall back on the claim that they felt safety was threatened? Do the event organizers think any risk of penalties or lawsuit is less than the cost of disrupting the event? Does setting precedent for response also factor into the calculus? How is insurance and venue contracts involved? Etc. There's a some related history, involving the Hell's Angels at a concert, but I don't know how practice has evolved since then.)

America relevant: It's similar to security anywhere, including "loss prevention" at a grocery store. They can tell you to leave, and if you don't, they can physically remove you from the property. That's pretty well established. It also applies to kicking someone out of your house that doesn't have a right to be there.

If they hurt you inappropriately (there's a wide range between a trespasser bruising their fist on a guard's face and a guard holding someone down and pummeling them for no reason), they've committed a crime and might lose a civil lawsuit. Some places won't let guards touch trespassers. Other places lean on discretion and the training they've given to the guard, the cameras they have spammed everywhere, etc.

The removal is usually covered in something like "we have the right to kick you out at any time, even if you paid." That doesn't cover all bases, but it covers a lot. If you never signed a contract with a venue, the removal is covered by the fact that you have zero intrinsic right to be there.

For more examples, you can look at casinos in Vegas trespassing people. If you act out of line or gamble in a way they don't like (like successfully counting cards at blackjack,) they'll boot you. They might spread your name to other casinos if they really don't like you. And if you enter one again, it's criminal trespass. They can do it for anything that isn't legally protected.

They can not grab you and physically remove you. This is called battery and it’s illegal. You can actually be charged with a crime as a security officer for this. Along with fined and lose your license.

What actually happens is them physically restraining you is a form of citizens arrest. They then hold you and call police to take you.

The issue with trespassing is it can only be charged if the individual continually refuses to leave. This means the moment they choose to leave, you must let them.

If in the act of being arrested they fight or assault people. They can be arrested for that. If they are violating the peace or committing another crime, they can be arrested for that.

However if it’s SOLELY trespassing. The moment they agree to leave; you need to let them leave.

The casinos do have police officers inside them and some security officers ARE deputized. A security officer can have powers to arrest as a security officer and powers to arrest as a police officer. They are entirely different things and have different levels of responsibility and liability.

Cops do not want to be called for every bouncer action.

The owner (or the one renting the property) has legal rights and set the rules. You break the rules, by beeing somewhere you are not supposed to be - any staff member can act as security to physically remove you.

They may not beat you, though. Or otherwise act escalating.

But forcefully leading (or carrying) out someone breaking the house rules (by using minimum of violence) is legal and standard procesure on every big event.

Certainly, and usually in broad terms, like "event security may remove any person from the premises for any reason they believe is necessary to ensure the security and safety of the event". Once designated agents of the owners of the venue have told you to leave, you are illegally trespassing if you stay.