Mastodawn

Academic friends, if a PhD thesis starts with a factually wrong representation of your work, do you

Thesis: "Asset-based modelling in particular has been shown to be advantageous in a number of respects (Shostack (2014)), including its capacity for conducting automated reasoning over a threat knowledge base."

In fact, I say something on the order of: "This is presented to explain why you shouldn't do it."

Ignore it

5.9%

send an email to their professors?

76.5%

subtweet?

17.6%

Poll ended at Apr 6 at 5:27pm.

Show thread

🐀 ␆4d ago

@adamshostack If the dissertation has been accepted, the cow is out of the barn. At MOST, I would collegially reach out to the author and inform them of the misinterpretation. If, as is often the case, they extend their research, they may have an opportunity to correct . Contacting anyone on their committee is the last thing I would do - the onus was on them to know whether the work they are supervising is correct in this regard. (I am NOT a Ph.D-haver, so...)

Show thread

Adam Shostack

@walshman23 right. It's both out of the bag, and represents a failure of the supervision process...

It's not subtle either. What I say:

Focusing on Assets
It seems very natural to center your approach on assets, or things of value.
After all, if a thing has no value, why worry about how someone might attack it? It turns out that focusing on assets is less useful than you may hope, and is therefore not the best approach to threat modeling.