Adam Shostack  

Academic friends, if a PhD thesis starts with a factually wrong representation of your work, do you

Thesis: "Asset-based modelling in particular has been shown to be advantageous in a number of respects (Shostack (2014)), including its capacity for conducting automated reasoning over a threat knowledge base."

In fact, I say something on the order of: "This is presented to explain why you shouldn't do it."

Ignore it
5.9%
send an email to their professors?
76.5%
subtweet?
17.6%
Poll ended at .
Apr 5 at 5:27pmWeb
Show threadAdam Shostack  3d ago
Generally I just ignore misunderstandings of my work, but here it's mis-used at the very start of section 1 to frame a research problem in a way that's the opposite of what I say.
Show threadChris Petrilli3d ago

@adamshostack it seems an indication of a fundamental mistake in research. Which seems fundamental to the purpose of a dissertation. I might try and reach out to the author rather than the professor.

And definitely subtoot

Show threadBrahms3d ago
@petrillic @adamshostack +1 on the author. Then again, this is something the professor should have definitely catched ...
Show threadWendy Nather3d ago
@adamshostack Sounds kinda, idk, like an LLM wrote it
Show threadAdam Shostack  3d ago
@wendynather Couldn't be! My books predate LLMs!
Show threadAdam Shostack  3d ago
@wendynather 😉
Show threadWendy Nather3d ago
@adamshostack The dissertation, silly, not your magnum opus 😂
Show threadPaul_IPv63d ago

@adamshostack

i'd say leave this to their thesis advisors. one of the advidor's jobs is to point out flawed starting assumptions and guide the PhD candidate into more solid footing.

Show thread🐀 ␆3d ago
@adamshostack If the dissertation has been accepted, the cow is out of the barn. At MOST, I would collegially reach out to the author and inform them of the misinterpretation. If, as is often the case, they extend their research, they may have an opportunity to correct . Contacting anyone on their committee is the last thing I would do - the onus was on them to know whether the work they are supervising is correct in this regard. (I am NOT a Ph.D-haver, so...)
Show threadAdam Shostack  3d ago

@walshman23 right. It's both out of the bag, and represents a failure of the supervision process...

It's not subtle either. What I say:

Focusing on Assets
It seems very natural to center your approach on assets, or things of value.
After all, if a thing has no value, why worry about how someone might attack it? It turns out that focusing on assets is less useful than you may hope, and is therefore not the best approach to threat modeling.

Show threadDoug Everson3d ago
@adamshostack +1 on letting the author know first. I’d be honored by the contact and grateful for the correction.
Show threadDavid Schuetz ** looking for work **3d ago
@adamshostack No reason you can’t do both. Better — phrase the subtweet as a poll for maximum engagement! :)
Show threadRichard "mtfnpy" Harman (he/him)3d ago
@adamshostack @darthnull write the name down, put it in your phone's contacts, and 10 years from now when a special someone tries to interview for Shostack & Associates, have the thesis paper ready.
Show threaditgrrl 3d ago
@adamshostack a subset of the population seems always determined to interpret cautionary tales as instruction manuals 😕