<html><head></head><body><div class="gmail_quote">Bear <bear@sonic.net> wrote:<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<pre class="k9mail">On Mon, 2014-01-13 at 15:33 -0500, Phillip Hallam-Baker wrote:<br /><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;">On Mon, Jan 13, 2014 at 3:26 PM, Kent Borg <kentborg@borg.org> wrote:<br />On 01/13/2014 02:35 PM, Phillip Hallam-Baker wrote:<br />There should be a penalty, no question. But what<br />should the penalty be?<br /><br />How important *is* this conference? I admit I have never<br />attended...<br /><br /><br />It is the only international trade show for the IT security industry. <br /><br /><br />Try 10,000 people coming to buy products to protect themselves from<br />the NSA etc.</blockquote><br />I may be excessively cynical here, but when you wrote "etc" I think <br />you might have been misspelling "RSA."<br /><br />Why should we ask someone go to an RSA conference to get products <br />to protect themselves from RSA itself? Considering the conflicts <br />of interest,
that doesn't seem likely to be fruitful, does it?<br /><br />While I think that a simple boycott is too broad, there has to be <br />an alternative course of action. The industry needs conferences <br />(for sales) but would prefer not to have RSA's name plastered on <br />them (for credibility). The public needs conferences (for security<br />information and products) but would prefer not to be going to a <br />conference organized by the very same people they have discovered <br />that they need to secure their business against. <br /><br />Both groups would be well-served by a parallel series of security<br />conferences, scheduled very deliberately to conflict with RSA's <br />conferences and ideally not open to companies who are also presenting <br />the same papers or products at the RSA conferences. <br /><br />That would allow people to actually *do* the boycott of the RSA <br />conferences without missing all possibility of making sales or all <br />possibility of
securing their infrastructure. It would reduce <br />the level of collateral damage and allow the very targeted kind <br />of boycott that I think everyone could support. <br /><br />Can we get a University (one with a hell of a good math program, <br />or who offer graduate degrees in cryptography) to organize one, or<br />if they won't organize it could we get them to host it?<br /><br /><br /><br /><br /><hr /><br />The cryptography mailing list<br />cryptography@metzdowd.com<br /><a href="http://www.metzdowd.com/mailman/listinfo/cryptography">http://www.metzdowd.com/mailman/listinfo/cryptography</a><br /></pre></blockquote></div><br clear="all">I admit I may be coming in at the wrong time /misunderstanding, but RSA IS NOT the only security conference in the world. Nor is it the only industry recognized one. <br>
-- <br>
Sent from my Android phone with K-9 Mail. Please excuse my brevity.</body></html>