Dear @usenixassociation Security: this is a security conference.

[stevebellovin@infosec.exchange]

Dear @usenixassociation Security: this is a security conference. Are you seriously asking folks to download and run a 500+ Python program downloaded from a random site I've never heard of? If you really want people to use a PDF format-checker, install it as a web app on your web site.

[phf@dmv.community]

@SteveBellovin @usenixassociation I guess they wanna keep you on your toes? 🤔

[rogandawes@infosec.exchange]

@SteveBellovin @usenixassociation maybe they’re interviewing for a new head of CISA?

[nomad@masto.hackers.town]

@SteveBellovin @usenixassociation They're just checking to make sure you're paying attention, right?

Right?

<sigh>

[usenixassociation@infosec.exchange]

@SteveBellovin Please contact the program co-chairs directly with any questions related to the papers submission process.

[mattblaze@federate.social]

@usenixassociation @SteveBellovin Hey, good folks of @usenixassociation, you really should take Steve more seriously than that.

[stevebellovin@infosec.exchange]

@usenixassociation I already did…

[adamshostack@infosec.exchange]

@SteveBellovin @usenixassociation Your tweet raises a lot of questions answered by my paper "Building practical security sandboxes for untrusted python code" which reviewer 2 called "Overly practical and lacking in LaTeX flair." Reviewer 3 said it "needed more math" and questioned "It works in practice, but does it work in theory?"

[n1xnx@tilde.zone]

@usenixassociation @SteveBellovin

This conversation, and the above @usenixassociation response IN PARTICULAR, is giving me the impression that someone involved in the conference organization doesn't know what they are doing and should not be trusted around security matters.

You'd better do something substantive to correct that impression, 'cause you're leaking credibility.

[phf@dmv.community]

@usenixassociation I'm impressed that this account actually replies! Kudos! That's so much more than most organizations do! ❤️

[willenck@ioc.exchange]

@SteveBellovin - Note that running the tool isn't required. The chairs are trying to be helpful and transparent. There are A LOT of submissions and there were lot of questions about administrative rejections in Cycle 1.

I encourage you to read Elissa and Ben's between-cycle transparency report: https://docs.google.com/document/d/e/2PACX-1vSnHpeTFReelMZ124SzmgObXrHDN_B-UgxhOaE2RKfnfHn_qWuobI7kPg4TKBMhhZy_qxYtggCo7vjK/pub

For what it's worth, the Python program is hosted on the co-chair's research group's website at CISPA. If this is something USENIX wants to use going forward, we will definitely host it directly.

[tarah@infosec.exchange]

@adamshostack @SteveBellovin @usenixassociation ahhh, Reviewer 2.

[stevebellovin@infosec.exchange]

@willenck Yes, I've heard back from the chair. It also is not obvious to me that cispa.saarland — the hosting site — is the same as cispa.de.
Look—I know Python well enough that I can probably spot (most) dangerous things. But that isn't the point. A security conference should not be training people to run random stuff that an apparently authoritative email address sent them. I just finished writing something that includes the following two adages:

Never trust a URL in an inbound email or text message: It’s extremely hard, and sometimes impossible, to tell if it’s legitimate or not.
Trust nothing you receive: If you’re concerned about information you’ve received, use information you already have to contact the organization.

[laukidh@infosec.exchange]

@usenixassociation as the a public point of contact, you really should be able to forward that up the chain yourself