Attrition, DEFCON 20, and a Bit of Advice
Sun Jul 15 19:59:56 CDT 2012
staff[at]attrition.org
Attrition.org will have a small representation at DEFCON 20 this year. Throughout next week, you can
find Jericho and cji at different venues and events. As two of the staff members that work on Errata,
we will be available to answer questions about the project. In the past year there have been occasional
questions about availability and the perception that once we publish something, it is set in stone.
This is absolutely not the case. At DEFCON 19, after a 1+ hour sitdown with someone listed on Errata,
they were ultimately removed. The Errata project is a guideline, not gospel. For DEFCON 20, we already
have a sitdown scheduled with one person that is on the unpublished charlatan watch list, so that
we can get more information and also discuss his concerns.
Jericho will be presenting "Errata Hits Puberty: 13 Years of Chagrin" on Wednesday afternoon at
the BlackHat Briefings. This is the same talk (with minor enhancements) that was given at RVAsec
last month. He will be around the BlackHat venue before and after the talk for any questions or
discussions, except perhaps for HTBridge employees (as they have filed criminal defamation charges
against him in Switzerland [1/2/13 Update: Charges since dropped]). Everyone else, feel free to chat. Jericho will be at BSidesLV for part
of Wednesday, and all day Thursday. You can find him at the OSF booth being a 'babe'. Questions
about the Open Source Vulnerability Database? Discussion about VDBs in general? Bring them. Friday
and Saturday, both Jericho and cji will be around the DEFCON venue with no schedule in mind. Look
for the squirrely types.
First, as some noticed last night, we sold 3 of the badges on eBay. This was done to cover the cost of
all 25 badges, so we break even on them. The new shirts will be the same way; enough will be sold
so that the cost to make them is recovered. We don't care about profiting off of this glorious
merchandise, but remember that the Errata project already costs money to run. Historically, we're
in the hole several thousand dollars. The money spent on marketing (e.g., shirts, wristbands, stickers)
is also out of our pocket in the past. Since we have had to cover one court case related to Errata,
and are currently wrapped up in a second, money for legal fees is a must. While some people think
that selling merchandise is lame, to each their own. These are very small runs that are primarily
given to friends and supporters of our project. Now the part you care about. How can you get your grubby
hands on some Attrition.org schwag? Read on, heathens.
There will be a handful of badges and shirts available next week. They are on a
first-come-first-serve-and-our-mood-depending basis. Some are already spoken for, some
have already asked where we will be early in the week to mug us for one. If you have
something to barter, that may increase your chances of getting one. Have tips about companies
or individuals that should be on the Errata radar? Cough them up, and cite your sources!
Have a shirt or badge from your organization or project? Maybe a swap is in order.
In addition, there will be quite a few wristbands and a lot of stickers to give away.
Don't be shy, find Jericho or cji and banter.
Conference Advice
jericho
If you are still reading, I would like to offer some advice for the conferences next week.
This goes for BlackHat, BSidesLV, and DEFCON 20. As a long time con-goer, there is one thing that
consistantly disappoints me at conferences. This came to a breaking point at DEFCON 18 when
one talk I attended came with a disclaimer; no questions or comments during the talk. Any
questions would only come after the talk, in a separate 'media' room, away from the crowd,
despite the talk topic being big in the news, and controversial to some.
This rule was absurd, especially for a conference that has a history of crowd participation.
To me, if a speaker says something that is questionable or inaccurate, the audience should hear
any objections or corrections. Having a speaker tell hundreds of people incorrect information,
then be corrected after the talk in a room with a dozen people simply isn't right. In this case,
I walked out of the talk halfway through when the speaker got some things provably wrong. So my
advice to you is this; speak up. Rules be damned. Be respectful, but don't be afraid to interrupt
a speaker if they are spewing bullshit. If you have a question that is timely, raise your hand
to encourage the speaker to turn it into an open forum. Why?
Because the odds are good he is not the most knowledgeable person in the room on the topic.
That is a growing trend in our industry, where people that are quite new to InfoSec end up
speaking on a topic they have little experience with (relatively speaking). Speakers, you have
a responsibility to ask yourself questions before you submit a talk to any conference. First,
why are you speaking and not someone else? Second, are you in the top 5% of the industry regarding
your given topic? Third, if you aren't, are you bringing a truly new and refreshing angle to
a topic? If you can't answer the first, or answer "no" to the other two questions, don't submit
a talk. Audience, think of these questions in the context of the speaker you are watching. If you
have doubts, ask the speaker these questions. The presentation bio slide should explain the
first two questions. We don't care that you were a VMS admin in 1993, if you are giving a talk
about social engineering. Speakers need to list their relevant experience to the topic
at hand. Further, speakers should encourage discussion. They should not hide from potential
criticism. If they are truly an expert on their topic, then they will be able to defend any
point they make.
Finally, if you are in a talk that falls short, tell the speaker. Be polite, but voice your
concerns! If all they hear is polite applause after, they may have no idea the talk was a joke.
Does the conference give you a chance to submit feedback? DO IT. Conference CFP teams have
very little information to go on for new speakers. If a talk wasn't worth the time, tell them
so that next year they are better prepared to recognize talks that are potentially lacking.
Let them know so the same person doesn't get accepted again to give another crappy talk.
In short, it is on you to police the industry. This starts with standing up for your right
not to have your time wasted in a presentation.
