News for hackers. Stuff that matters.
Re:DEF CON's response to the badge controversy by tptacek on Saturday August 10, 2024 @04:06PM (#41211844)
What should they have done better? They didn't have the option of doing better with Dmitry, right? He deliberately set up the confrontation with security.

The idea that DEF CON's brand is "in the shitter" seems risible. I say that ruefully, as (in my declining years) I get more and more bitter about the comic convention spectacle the event has become. Whatever the outcome from "badge-gate", I assure you, they'll set attendance records next year regardless.

Re:DEF CON's response to the badge controversy by ibash on Saturday August 10, 2024 @05:52PM (#41212503)
> They didn't have the option of doing better with Dmitry, right?

Let him give his talk like they promised.

Given literally everyone in that room is using his work in that same moment and they are literally there to hear him speak.

Re:DEF CON's response to the badge controversy by tptacek on Saturday August 10, 2024 @05:56PM (#41212532)
Fuck no. People don't get to re-invite themselves to stages they've been disinvited from.
Re:DEF CON's response to the badge controversy by mynameisvlad on Saturday August 10, 2024 @06:00PM (#41212556)
You asked someone to give you options and they did. Just because you don't like it doesn't mean it's not what you asked for.
Re:DEF CON's response to the badge controversy by aaplok on Saturday August 10, 2024 @06:45PM (#41212784)
OP asked for a better option. He was offered one, which he disagreed with. Because he doesn't like it precisely means that (in his view at least) it is not what he asked for.
Re:DEF CON's response to the badge controversy by tptacek on Saturday August 10, 2024 @07:06PM (#41212879)
I take their point; I didn't mean to be slapping back at them for taking the time to write a response!
Re:DEF CON's response to the badge controversy by aaplok on Saturday August 10, 2024 @08:13PM (#41213128)
Your point was valid though. You can't let someone rock up to the stage uninvited. This would open the door to all kinds of issues.

And the original question of how the situation could have been handled better is the most interesting one. The rest is a game of he said/she said, which hn commenters tend to enjoy arguing about but is ultimately not very instructive.

With hindsight it is clear that the situation had been brewing for some time, and the conflict had been escalating slowly. Perhaps due to the pressure ans stress (and time pressure) of organising an event like that nobody managed to have enough distance to deescalate it, which culminated in someone being escorted off stage by security, not a good experience for anyone.

Most likely once the invitation to talk had been rescinded the dice were thrown. It would have been hard for the speaker not to be offended, and unfair on him to expect him to take it quietly and move on without reacting. Someone should have been aware of that and worked with him to control the impact of this on his own reputation.

Re:DEF CON's response to the badge controversy by Aeolun on Saturday August 10, 2024 @09:39PM (#41213433)
People don’t get to dis-invite people from stages when that is quite literally the only compensation given either.

They made the software for the badge of your entire conference, for free, and then you won’t let them talk about it because what you got for free, wasn’t what you expected/wanted?

That’s just dumb on so many levels I don’t even know where to begin.

It’s like playing, no, selling someone elses mod and complaining it’s not up to the standards of a finished game.

Re:DEF CON's response to the badge controversy by bawolff on Sunday August 11, 2024 @12:14AM (#41213940)
> They made the software for the badge of your entire conference, for free, and then you won’t let them talk about it because what you got for free, wasn’t what you expected/wanted?

You are saying this like it is unreasonable, but it seems entirely reasonable to me.

Just because you do something for free does not entitile you to a conference talk about it. If you wanted to be paid for it (and make no mistake, a conference talk is a form of compensation. In many conferences companies pay huge sums of money to have a platform) then they should have got a contract.

Re:DEF CON's response to the badge controversy by tptacek on Saturday August 10, 2024 @09:43PM (#41213457)
They absolutely do get to do that. Absolutely, and without qualification. It's their stage. There's a whole long history of this with DC/BH.
Re:DEF CON's response to the badge controversy by kelnos on Sunday August 11, 2024 @12:40AM (#41214023)
I don't think GP meant "don't get to" as in it's not their legal right to do so (which of course it is). I think they meant that it's a profoundly shitty thing to do to someone, and DEFCON should rightly be criticized for disinviting him in the first place.

I think an easter egg that includes a monetary solicitation is (at best) in poor taste, regardless of the circumstances. But canceling his talk 30 minutes prior to its start time for that? Nope, not cool. DEFCON's behavior in disinviting him was much much worse than his action that triggered it.

Re:DEF CON's response to the badge controversy by ibash on Saturday August 10, 2024 @11:51PM (#41213867)
He was given a 30 minute notice that he was disinvited. That’s pretty egregious.

Especially since they were okay with him giving the talk as long as he apologized. And he offered to say “I didn’t mean to offend anyone”.

So for a misunderstanding and mistake to drag him off the stage is stupid and ridiculous.

> What should they have done better? They didn't have the option of doing better with Dmitry, right? He deliberately set up the confrontation with security.

Maybe I misunderstood, I previously read that as “what could they have done better about the situation”.

Did you mean “what could they have done better once he was at the stage?”

Re:DEF CON's response to the badge controversy by tptacek on Sunday August 11, 2024 @12:02AM (#41213899)
I got locked in a hotel room by an actual goon who demanded a line-item veto of my slides (clients! what you'll do to keep clients happy!), and ask Mike Lynn how he feels about the response to his talk. Being asked not to take a stage to take credit for the annual DEF CON badge toy seems pretty low on the scale of security conference dramas.

The "drag him off the stage" thing was his own arrangement.

Re:DEF CON's response to the badge controversy by CyberDildonics on Sunday August 11, 2024 @08:20AM (#41215666)
What does that have to do with anything?
Re:DEF CON's response to the badge controversy by tedunangst on Saturday August 10, 2024 @06:09PM (#41212609)
I would simply level up charisma and speech check him off the stage.
Re:DEF CON's response to the badge controversy by josephg on Saturday August 10, 2024 @06:25PM (#41212685)
It was a huge mistake to uninvite him from the session.

It sounds like defcon was mad at EE for going over budget - which honestly is fair even though they didn’t handle it well. And thought (wrongly) that Dmitry was a salty subcontractor of theirs. Their actions make some sense in that context. Not great, but eh.

But Dmitry has totally owned them in messaging - by forcing them to physically eject him (making a scene), and getting out ahead of the story. It’s great drama. He’s positioned defcon to look like an evil corporate buffoon hating on a hacker who was just donating his time.

At this point, defcon should take the L and apologise, and let him have a session talking about the code. That would be a very satisfying end to the drama for attendees. (Even if it does encourage more drama in future years.)

Either way, I agree - I’m sure attendance will go up next year too. People love this stuff.

Re:DEF CON's response to the badge controversy by tptacek on Saturday August 10, 2024 @06:36PM (#41212734)
It sounds to me like they were mad at Dmitry for including an "easter egg" in their badge firmware that solicited donations to a Bitcoin address.
Re:DEF CON's response to the badge controversy by Dylan16807 on Saturday August 10, 2024 @07:34PM (#41212994)
It was definitely an easter egg. A secret screen that gives credit to someone that worked on a thing and otherwise wouldn't get credit is the textbook example of an easter egg.

It probably shouldn't have had the Bitcoin address, but it doesn't sound like that would have been treated much differently.

Re:DEF CON's response to the badge controversy by tptacek on Saturday August 10, 2024 @07:39PM (#41213010)
I think you're going to find that firms who contract embedded designs have viewpoints about "easter eggs" that would be surprising, even off-putting, to message board communities that savor them like single malts. Generally, when firms arrange to deliver hardware/software to their own customers sourced from vendors, they want a clear understanding of what the software actually does.
Re:DEF CON's response to the badge controversy by Dylan16807 on Saturday August 10, 2024 @07:42PM (#41213018)
I know some companies dislike easter eggs a lot, and some of their reasons are valid.

But it's objectively an easter egg. Why the scare quotes?

Re:DEF CON's response to the badge controversy by tptacek on Saturday August 10, 2024 @07:44PM (#41213029)
Because it solicited money.
Re:DEF CON's response to the badge controversy by Dylan16807 on Saturday August 10, 2024 @07:50PM (#41213049)
I will note that it's not soliciting money for the person that put it there. So I don't think that's even close to disqualifying it.
Re:DEF CON's response to the badge controversy by tptacek on Saturday August 10, 2024 @08:05PM (#41213094)
You do you!
Re:DEF CON's response to the badge controversy by jsjohnst on Saturday August 10, 2024 @11:36PM (#41213827)
I mean, you are you, but maybe take a breath and stop picking fights?
Re:DEF CON's response to the badge controversy by josephg on Saturday August 10, 2024 @08:33PM (#41213200)
Yep. But again, it’s really not clear in this case if DEFCON was paying their vendor (EE) for software at all. I can see how it was ambiguous from their side given Dimitri was friends with the hardware design company. But from the POV of Dimitri and EE, DEFCON was paying for hardware and a separate 3rd party (Dimitri) volunteered to write the software. It’s very spicy to attack people in your community who volunteer their time.

And unpaid programmers doing cheeky things with code because they want to is the heart of DEFCON.

I can see where DEFCON is coming from with the calls they made here. But it’s a mistake to treat Dimitri as if he were a vendor. He's not.

Re:DEF CON's response to the badge controversy by kalleboo on Saturday August 10, 2024 @10:17PM (#41213576)
This is a hacker con, not an enterprise engineering con, Easter eggs have always been a part of hacker culture.
Re:DEF CON's response to the badge controversy by tptacek on Saturday August 10, 2024 @10:21PM (#41213594)
Tell me more about DEF CON.
Re:DEF CON's response to the badge controversy by rrix2 on Saturday August 10, 2024 @11:14PM (#41213768)
I heard they got canceled this year
Re:DEF CON's response to the badge controversy by kalleboo on Sunday August 11, 2024 @12:28AM (#41213994)
It's a con that apparently gives out game boy emulators to attendees
Re:DEF CON's response to the badge controversy by josephg on Saturday August 10, 2024 @07:08PM (#41212889)
Yep. Given that they thought Dmitry was a subcontractor of EE, them being mad about that makes a lot more sense.
Re:DEF CON's response to the badge controversy by garaetjjte on Sunday August 11, 2024 @09:57AM (#41216178)
It's not that letting him do the talk would be any better for defcon, given that he literally said he will present these "easter eggs".

>PS: there are a few easter eggs in the stock badge firmware, try to find them or come to the badge talk at DEFCON to see for yourself ;)

Re:DEF CON's response to the badge controversy by hnthrowaway0315 on Saturday August 10, 2024 @10:51PM (#41213697)
I'd like to ask as someone who is interested in RE/Security/Malware in general but without experience. Which events are good for me if I have to pay out of my own pocket? I don't work in related fields so education stipend does not apply.

I surveyed the ground tonight and found two that are interesting: Recon (in Montreal) and CCC (in Hamburg).

What do you think?

Re:DEF CON's response to the badge controversy by tptacek on Saturday August 10, 2024 @11:05PM (#41213747)
I think CCC is basically in the same bracket as DEF CON in terms of seriousness. Someone's going to get mad at me for saying that, but I'll note that serious people go to DEF CON too, even though it is 100% a cultural event and not a real part of the cite record for our field.

I've never heard anyone say anything but good things about REcon. I have FOMO about having never been.

Re:DEF CON's response to the badge controversy by hnthrowaway0315 on Saturday August 10, 2024 @11:34PM (#41213822)
Thanks for sharing. I'm actually close to Montreal so REcon is probably my best bet. The ticket is more expensive but I save lodging and transportation.
Re:DEF CON's response to the badge controversy by thequux on Sunday August 11, 2024 @04:02AM (#41214660)
Hugo, the organizer of Recon, has historically been willing to work with people who are attending on their own dime. I suspect that if you were to send him an email explaining your situation, you'd be very happy with the response you received.

It is an excellent conference that I've enjoyed every single time I've gone

Re:DEF CON's response to the badge controversy by hnthrowaway0315 on Sunday August 11, 2024 @08:28AM (#41215701)
Thanks a lot! I'll definitely reach out to him next year.
Re:DEF CON's response to the badge controversy by busterarm on Monday August 19, 2024 @01:58PM (#41293170)
> The idea that DEF CON's brand is "in the shitter" seems risible.

Is it though? With 20+ attendances behind my belt, I was already sour on the experience at 2018 and didn't go in 2019 due to a family conflict and haven't been back since.

Not only did "badgelife" absolutely ruin the whole fucking experience, but I started seeing large numbers of people start getting othered and excluded because of running afoul of idpol which IMO is entirely counter to the spirit of what the con had always been about.

It permeates throughout the meta events of the con, like Ollam's Shoot, where you're warned very much in advance with overt threats to not express an opinion that even remotely smells right-wing while his staffers proudly wave antifa banners and shout the merits of being radleft.

At the same time, my experience with the security industry as a whole is that most vendors are completely full of shit and spend all of their time chasing after fake clout (and all of the shady bullshit that goes along with it).