Usenix Workshop on Offensive Technology
Thomas Ptacek | April 30th, 2007 | Filed Under: Uncategorized
One of the weird thing about Black Hat is that there are no papers. You pitch a talk and deliver it in slides. The only lasting artifact is a video of your presentation. Which is too bad; it makes Black Hat research harder to cite.
If you’re doing vulnerability and reversing research this year, you have a new venue: the First USENIX Workshop on Offensive Technologies (WOOT ‘07). Think of WOOT as a peer-reviewed Black Hat and you’re not far off (from what I can tell, there isn’t a single technical topic that’s germane at Black Hat and not germane at WOOT).
Read the CFP. You don’t have much time! But then, if you’ve put together a pitch for Black Hat, you’ve got most of what you need already. I’m on the program committee, so I guess that means I look forward to reading your submissions.
[Update: 5/1]
It’s official: you can absolutely submit something to Black Hat and WOOT. Your WOOT submission is an academic paper; your Black Hat submission is a talk.
bubba
April 30th, 2007 7:27 pmso whats with the new fad of invitation only events. Is Al Gore going to be there or something?
Thomas Ptacek
April 30th, 2007 7:42 pmI’m not going to pretend to understand the logic either, but let’s leave it at “they’re taking this first event to try to get the kinks out with a smaller audience”, and “there’s zero chance you won’t find out about anything interesting presented there”.
Matt
April 30th, 2007 7:54 pmI think a lot of workshops want to keep attendance small to foster more conversation and useful feedback. Thomas’s second point is also spot on: USENIX will publish all of the accepted papers on their web site, and maybe they’ll even make them publicly available immediately, like they did for HotSec. Trawling the USENIX recent conferences proceedings is a great way to kill an afternoon every now and then
Brad
April 30th, 2007 8:35 pm“if you’ve put together a pitch for Black Hat, you’ve got most of what you need already” . . . IFF you don’t actually want to submit it to Black Hat, that is.
From the WOOT CFP page: “Simultaneous submission of the same work to multiple venues, submission of previously published work, and plagiarism constitute dishonesty or fraud.”
Do Black Hat and other conventions that don’t publish not count? And what about Black Hat’s new requirement this year that a full white paper accompany every presentation?
You have a pretty tough sell for a researcher working commercially to submit to the invite-only WOOT instead of Black Hat - especially with it happening a week after Black Hat. (which will consider previously presented work if truthfully represented as such)
nobody
April 30th, 2007 8:48 pmjust clearing out the scary ip-based cache here, eh.
Thomas Ptacek
April 30th, 2007 11:49 pmBlack Hat doesn’t count.
HAL
May 1st, 2007 11:51 amTom,
Sounds like the organizers are expecting something a bit more formal, with some discrete math included, that could pass muster in an ACM/IEEE forum publication; evidence of intellectual rigor (but not rigor-mortis).
Would it be fair to say that the argument being offered in defense of the ‘your telling the bad guys too much’ line is that ‘Defense’ types do not understand how they are being attacked, so their defenses, in general, are becoming wholly inadequate from conception?
Best, H
newsham
May 1st, 2007 3:02 pmYou can write a perfectly good security paper without using any discrete math.
Take a look at some recent relevant academic papers and you’ll notice them citing phrack articles and text philes such as Aleph1’s famous stack smashing paper. The idea is to get some of this type of work represented in a more academic setting, with proper cites and presentation. The idea is to bring together practioners who are outside of academia and academics who are less familiar with pragmatic issues.
The formality of citing (and knowing) prior art and peer review should be beneficial to all involved, including the authors, the reviewers, the conference attendees and the readers.
ivan
May 1st, 2007 4:15 pmright on! newsham said it clearly. I think this is the kind of think that the infosec. community and particularly the infosec industry really needs to start moving away from witch doctor mercantilism and closer towards a scientific discipline. But Brad’s comment is also spot on, i think it will be hard for some industry researchers to submit proposals to WOOT if that implies excluding them from BH. I can certainly imagine what our marketing department would favor
HAL
May 1st, 2007 5:36 pmGood, looks like minds are beginning to work. Of course one can write a paper, without any formal work, and remain valid. Offering effective argument without it has been the province of jurists for centuries. However, writing a properly footnoted article is somewhat less than revolutionary. Would you care to consider the latter half of my comment? That would go to the usefulness of this event. Thanks for you thoughts in advance.
H
Dominique Brezinski
May 10th, 2007 1:16 amAs someone pointed out, Black Hat does require whitepapers for accepted submissions as of 2007. I just posted to Daily Dave on the subject of citing and commercial versus academic conferences, so I won’t duplicate that here. Tom’s opening point about having a remaining artifact that serves as a meaningful reference is exactly the reason we implemented the whitepaper requirement for Black Hat. However, Black Hat is not trying to deliver the same product as academic conferences; the product differences serve separate needs within our industry.
The program committee of WOOT is definitely more of a peer group than myself (what you get at Black Hat, give or take), and I think WOOT could serve a very interesting purpose in the security research space.
HAL
May 16th, 2007 3:30 pmDom,
I would second your statement, and add that WOOT is a great idea. Looking forward to being impressed by their acumen.
Be seeing you,
H
Leave a reply