5 ms·
Reading EE and DEFCON’s statements, I’m inclined to think whoever was managing this on DEFCON’s side was not on top of things and blinked at the last minute. I’
by mafuyu 2y ago
Reading EE and DEFCON’s statements, I’m inclined to think whoever was managing this on DEFCON’s side was not on top of things and blinked at the last minute. I’m sure there were delays and issues on EE’s end, as it always goes with hardware, but it’s still EE’s design, parts sourcing, and manufacturing run that DEFCON just took over last minute?
I don’t know the terms of their contract, but that wouldn’t fly in a typical contractor setup. You can’t just cut out the contractors labor costs after the fact. I’d be more inclined to give DEFCON the benefit of the doubt if they canceled the entire project earlier on and engaged a different contractor to build an entirely different badge from scratch.
Given that dimitri wasn’t even paid for the firmware(!), my guess is this was low budget. For something of DEFCON’s scale, this can’t really be a “for fun” hacker project if you want to guarantee results. The “for fun” part is ensuring the attendees can all have a good time hacking on the badge, not the people doing the labor.
- tptacek 2y agoOn the contrary, if you have a signed master and SOW for a project, you absolutely cannot just bill over or outside of the SOW because of "contractors labor costs". The whole point of contracts is to agree to costs up front and eliminate these kinds of on-the-fly disputes.
- minkles 2y agoClearly you've never worked on a government project! I was on a defence project that overshot by a cool billion dollars on the SOW...
- tptacek 2y agoI've made a point of not working on government projects, so yes, this is a blind spot for me.
- deleted 2y ago[deleted]
- cowsandmilk 2y agoThere are multiple ways government contracts (and contracts in general) are billed. Blanket statements about billing for government and non-government contracts are not accurate.
- ipaddr 2y agoWhy not share some facts. A blanket statement about blanket statements is something a bot would do.
- mafuyu 2y agoAgreed. I’m honestly not familiar with how they’re structured for hardware contracts like this. I was imagining some sort of cost plus structure. No point in speculating on the details of a contract dispute where we don’t have the contract, I suppose. I was under the mistaken understanding that EE was not paid out at all. Rereading their statement, they say they were partially paid, so I think I was overly harsh. This is firmly in “boring, messy contract dispute” territory now, I’d say. :)
- bjornsing 2y agoBut as I understand it EE did not bill outside or over the SOW. They just sent updated cost estimates indicating that they wanted to.
- tptacek 2y agoAll we have to go on are the statements, but DEF CON's statement is falsifiable and direct: After going overbudget by more than 60%, [and] several bad-faith charges Which, again, pattern matches to a pretty common mode in which consulting projects blow up: you give an optimistic estimate, learn partway into the project that you were hopelessly off, and then try to invoice your way through it.
- aestetix 2y agoI would be very interested to know what DefCon's budget for the badges is, and how much latitude was built in for things like chip shortages, rush shipping, etc. A big project like this, especially during major geopolitical strive, could have all sorts of unforseen complications. DefCon has been around the block a few times and should know how to handle things. But without details, it's impossible to know for sure.
- 5ci3nc3 2y agoI'd like to know why badges are being used at all. It's DefCon- isn't there a more creative way to handle security?
- firesteelrain 2y agoWhat kind of contract was it? If it’s cost plus you sure can
- dredmorbius 2y agoSOW: Statement of work. <https://legal.thomsonreuters.com/blog/what-is-a-sow/ https://legal.thomsonreuters.com/blog/what-is-a-sow/>
- thelittleone 2y agoIts not uncommon for a contract and SOW to include an hourly rate for approved out of scope items.
- tptacek 2y agoYes. https://news.ycombinator.com/item?id=31526196 https://news.ycombinator.com/item?id=31526196 I'm guessing that's not what they did, though, since DEF CON comes right out and says they submitted bad-faith invoices. That's a factual, falsifiable claim, and a commercially damaging, actionable claim if it's false.
- jhaand 2y agoIt depends on the contract. I will never just do a single SOW contract and risk it all. I will do an hourly contract and maybe give a discount if a certain amount of money is spent because things get tough. The client will get an estimation but in this day and age, prices will vary in a few months. Entropic Engineering should not have gone through with this project on this timescale of 6 months with a new chip. Defcon badge team doesn't know how to properly outsource electronics, collaborate and do risk management.
- mlyle 2y agoDEF CON's response reeks of petty; characterizing dmitry as a "subcontractor" rather than a volunteer for spin purposes, and the choice to remove Entropic's logo from the case based on this budget dispute.
- echoangle 2y agoI think the point of calling Dmitry a subcontractor was to make clear that dmitry worked for/with EE, not DEF CON.
- mjw1007 2y agoBut surely DEF CON know that isn't true, because Dmitry evidently provided them with the firmware after the "stop work" order to EE (otherwise it couldn't have included the easter egg).
- echoangle 2y agoThat’s a good point. From reading DEF CONs statement again, I could imagine that they would claim they issued the stop work order and then got delivery of the current state, which then included the Easter egg. That’s the only way I can come up with where this makes sense. It’s also not clear to me if DEF CON really got the firmware from dmitry or if he gave the firmware to EE which then delivered it together with everything else to DEF CON.
- Aeolun 2y agoIf he was working on the firmware until the moment of his flight to Defcon, then clearly they were happy to continue taking his time and effort for free. This also seems to be implied by Entropic, which say they did work on the badge after DEF CON stopped paying them for it.
- crest 2y agoThe term implies the existence of a contract. By his own clear statements Dmitry did the firmware on his own as a volunteer because he liked the RP2350 and wanted to to contribute to the badge project.
- rasz 2y ago>You can’t just cut out the contractors labor costs after the fact. Its not after the fact, thats exactly what Stop-Work Order was for.
- bjornsing 2y agoEE claims that DEF CON does not want to pay up until the stop-work order though. So it seems to be at least a bit “after the fact”.
- darksim905 2y agowhy would DEFCON go with such a small outfit?