Please create an account to participate in the Slashdot moderation system

 



Forgot your password?
typodupeerror
×
Microsoft Security

Author of Paper Critical of Microsoft is Fired 739

chongo writes "Daniel E. Geer Jr., one of the primary authors of a report Reliance On MS A Danger To National Security, was fired from @stake Thursday morning. @stake said that 'The values an opinions of the report are not in line with @stake's views' and that Geer's participation was 'not sanctioned.' Microsoft, who has worked closely with @stake in the past, denied that it was involved in @stake's decision to fire Dan." There might not be anything fishy going on at all, but that's no reason to stop making perfectly good conspiracy theories.
This discussion has been archived. No new comments can be posted.

Author of Paper Critical of Microsoft is Fired

Comments Filter:
  • Can they do that? (Score:4, Insightful)

    by connsmythe96 ( 576445 ) <slashdot.adamkemp@com> on Thursday September 25, 2003 @11:07PM (#7060580) Homepage
    Did he do this on his own, or as an @stake employee? I find it rather disturbing that a company can fire you for something you do of your own accord. What's next, are companies who like to suck up to MS gonna fire you for developing a linux program?

    Am I just being naiive, or does this bother other people too?
  • Good! (Score:2, Insightful)

    by Ars-Fartsica ( 166957 ) on Thursday September 25, 2003 @11:08PM (#7060601)
    I'm tired of people hashing out their stupid little pet peeves on the basis of 'national security'. Its inane and tiresome to hear people trump up the 'unassailable argument'. Oh now we can't challenge you because if we do we're rooting for terrorists.
  • um.. (Score:2, Insightful)

    by micronix1 ( 590179 ) on Thursday September 25, 2003 @11:09PM (#7060605)
    dont these places have editors? surely, a story that would have gotten someone fired wouldnt get approved.
  • by Infonaut ( 96956 ) <infonaut@gmail.com> on Thursday September 25, 2003 @11:12PM (#7060629) Homepage Journal
    @the Stake fired him because they didn't want to piss off Microsoft. From their point of view it was better to sacrifice an obviously capable and smart employee at the altar of commerce than potentially endanger their working relationship with Microsoft.

    I guess that's where the phrase, "power corrupts" comes from, eh?

  • by ChazeFroy ( 51595 ) on Thursday September 25, 2003 @11:12PM (#7060631) Homepage
    He put his company and title in the paper. If he did not clear that with his company before publishing this paper, @stake has every reason to fire him.

    Not only can it be viewed as damaging to a big client (Microsoft, in this case), but it can also be viewed as competing with your own company since both @stake and the paper deal with security. I'm sure he signed a non-compete agreement with @stake when he was hired.
  • Re:Good! (Score:2, Insightful)

    by Anonymous Coward on Thursday September 25, 2003 @11:13PM (#7060635)
    Why don't you try to challenge the argument he made, and see what happens, instead of complaining that your argument won't be accepted?
  • by catbutt ( 469582 ) on Thursday September 25, 2003 @11:13PM (#7060640)
    Well actually it was Computing Technology Industry Association, but they are funded by MS. The say "the report is flawed by "myopically looking to technology (i.e., 'bad' software OS) instead of addressing the underlying cause -- human behavior -- for cyber breaches." "

    So basically if humans just would stop being mean or stupid, there wouldn't be any problems.

    Isn't that sort of like blaming plane crashes on gravity? I mean, human nature is what it is. There will be virus writers, there will be people who don't always install the patches right away.

    What are they suggesting, that we try to change human nature? Genetically engineer better humans? How about they take human nature as a given (like gravity to an aeronautical engineer), and then fix the damn product?
  • by bersl2 ( 689221 ) on Thursday September 25, 2003 @11:14PM (#7060643) Journal
    The difference is that your consulting job is not on the line when you post alternative viewpoints on Slashdot.

    Now, if you get fired for reading too much Slashdot on company time, we are absolutely not responsible.
  • Wow, bonanza! (Score:5, Insightful)

    by mveloso ( 325617 ) on Thursday September 25, 2003 @11:16PM (#7060667)
    I'm sure the author can sue for unlawful termination. He might even get triple damages!

    Gotta love those @stake guys. Here's a relevant quote from their website:

    "@stake has assembled the best minds in digital security to help you understand and mitigate the security risks inherent in your business model, so that you can maximize the opportunity in front of you. We help you make the hard decisions about what matters most in your business, so that your security investment has the greatest impact. We work in the space where your business and technology meet, because we believe that this is where security is most powerful."

    Talk about blowing it out both ends. You can read their ethical [atstake.com] and guiding principles [atstake.com] as well.

    This is what l0pht has turned into?

  • by jesterzog ( 189797 ) on Thursday September 25, 2003 @11:16PM (#7060674) Journal

    Did he do this on his own, or as an @stake employee?

    The report itself [ccianet.org] stated quite clearly in several places that Dr Geer was the Chief Technical Officer of @Stake.

    I can't find a disclaimer anywhere in the report saying that he wasn't representing @Stake, and yet he used it to back up his authoritarian position, and intentional or not it appear that he was speaking on behalf of the company he worked for.

    Perhaps more details will emerge about what actually went on, but it does seem quite irresponsible to make it appear that you're speaking on behalf of a company if you're not... if that's what happened.

  • by signe ( 64498 ) on Thursday September 25, 2003 @11:17PM (#7060680) Homepage
    If you sign an employment agreement, you'd better stick to it.

    In particular, you shouldn't publish a paper without running it by corporate communications first. You especially shouldn't publish a paper that might be critical of a partner or customer without doing this. You know why? Exactly. You get fired. For violating your employment agreement. If you don't agree with the things that you signed, you shouldn't have signed them. Hell, even if you have permission to publish the paper, you might want to think twice about publishing a paper which is critical of a rather large customer.

    When I worked at AOL, I tried to get some of the execs to realize that some of the employees could be a powerful force in the technical community to raise the image of the company. Just the ability to explain some of the things that weren't confidential, correct some of the misconceptions. It wouldn't be a magical transformation, but it would be an effort. And actually joining the community would be a big step. Peer review and PR oversight could both be used to help make sure that more incorrect information didn't go out, or that the wrong things didn't go out.

    Noone wanted to talk about it. My assumption is that noone I got to wanted to rock the boat, and noone responsible trusted the employees. It's too bad really. But even with something like that in place, this type of paper would never pass muster. Not through a peer review, and not through PR. You just don't criticize a large customer. Especially a customer with as much money as Microsoft.

    -Todd
  • This is why ... (Score:5, Insightful)

    by tessaiga ( 697968 ) on Thursday September 25, 2003 @11:18PM (#7060685)
    university professors are tenured. Speaking your mind on controversial topics can have hazardous consequences for your career.

    This really is something Greer should have seen coming. He published a highly critical, highly-publicized report bashing his consulting company's biggest client. Whether it is true or not is irrelevant; that the client was Microsoft is irrelevant -- replace "MS" with "Sun" or "Oracle" or any other company you like, and I bet his higher-ups still wouldn't be happy about it. You may not like who you work for, but it's not a good idea to bite the hand that feeds you.

  • by Gurudev Das ( 694832 ) on Thursday September 25, 2003 @11:19PM (#7060688)
    @stake was acting in their own interest. For them, Microsoft is a potential customer and keeping good relations is what they had in mind.
  • by Anonymous Coward on Thursday September 25, 2003 @11:20PM (#7060697)
    I think you can do whatever you please on your own time even in the US.

    I also think that employers can fire employees if they please. Unless he can prove that he was discriminated against then he is pretty much out of luck.

    I also don't think that Microsoft had to do anything. @stake just had to believe that Microsoft would never do business with them again.

    Think about it this way - if I worked for Fox News and I wrote a scathing book about GWB on my own my own time then I shouldn't be surprised if I was fired the next day.
  • by ljavelin ( 41345 ) on Thursday September 25, 2003 @11:22PM (#7060712)
    As many, many researchers know, this is why so much commercial research is flawed - there are too many strong influences out there that taint the data.

    This is the first overt firing that I've heard of in the IT industry, but I'm sure there have been thousands that we just never heard of.

    Just think of those poor researchers at the cigarette companies - you know, the ones where if you found that there was a link between cigarettes and cancer, well, you must be fired.

    Or the researchers for pharmacuticals... where if you find that drug X doesn't help cure Y, then you shouldn't expect any grant money next year. Yeah, not fired, but certainly the same net result.

    The fact is that research SHOULD be independent. I don't know or care if this guy's paper was right or wrong. But it should be the research community, not MBAs, who decide the quality of research. Period.

    I think that firing this guy due to his research is wrong. It looks like he was fired for financial relationship reasons, not because his study was consistently rejected by the research community. Should his employers be considered biased? As a potential customer, should I trust this company? If they are motivated more by their relationship with microsoft versus upholding the truth, I'll never recommend anyone to do business with them. And it looks like they are, and so I'll make sure they're scratched off the list.
  • by Shippy ( 123643 ) * on Thursday September 25, 2003 @11:28PM (#7060754)
    And would you? Think about it. They have an awesome working relationship with Microsoft. They get to do exactly what they love to do (finding exploits) in code that is supposedly riddled with problems and get paid tons of money to do it. In addition, they help the world by helping MS identify and fix these bugs.

    If they lost that relationship, that could cause the shareholders to bail out because the company would have to recoup that revenue from elsewhere.

    @Stake is full of tons of smart people. I'm sure they'll survive.
  • by quacking duck ( 607555 ) on Thursday September 25, 2003 @11:32PM (#7060773)
    But even with something like that in place, this type of paper would never pass muster. Not through a peer review, and not through PR. You just don't criticize a large customer. Especially a customer with as much money as Microsoft.

    Perhaps this is why he didn't pass the paper through atStake's legal or communications department. He knew they'd never approve it, and they'd do everything to block them if they knew ahead of time that he and his associates were going to publish it. Better to get the message out in the open and risk being fired, than button up what you strongly believe is in the public's best interest.

    Do whistleblowers ask their organization's legal department for permission before calling the authorities?

  • by turg ( 19864 ) * <turg@winston.CHEETAHorg minus cat> on Thursday September 25, 2003 @11:32PM (#7060777) Journal
    Did he do this on his own, or as an @stake employee?

    In the paper [ccianet.org]'s (pdf) list of authors, he is listed as "Daniel Geer, Sc.D -- Chief Technical Officer, @Stake"

    Also perhaps of interest is the fact that he is listed first of the paper's seven authors

    I find it rather disturbing that a company can fire you for something you do of your own accord. What's next, are companies who like to suck up to MS gonna fire you for developing a linux program?

    If your company has a financial stake in the success of X and you take deliberate action to reduce the success of X (in this case, making a public warning that the success itself results in harm to the public at large), then yes.

  • by LinuxMan ( 3590 ) on Thursday September 25, 2003 @11:35PM (#7060801)
    It's really interesting, because I don't doubt for one second that M$ told them that either they fire them or they loose their business together. It is common sense, one uncloud's their mind, that M$ is a REALLY bad platform to be on in regards to security. It definitely has a wonderful software base, but that is due mostly to really good marketing, including making a visually appealing interface. Lock-in also plays a big role. However, when one has to worry continually about security holes in their systems, that is bad. Linux systems may have a large number of holes, but they are typically in the daemons running on the machine, and one can jail or chroot them into secure directories, but Windows' core services are the ones that are the culprits here-- and they cannot be jailed!

    It's sad that a person who speaks truth gets fired if it is not in the best interest of their companies, but I guess that is why a truly outspoken person must be freelance, because otherwise they WILL be fired eventually for their honesty.

    M$OS-less 15" Powerbook G4 [amazon.com]
  • by macjohn ( 185795 ) <john@digitalmx.com> on Thursday September 25, 2003 @11:38PM (#7060827) Homepage
    Actually, he didn't even criticize Microsoft. What the report said was that having all computers run the same OS was a risk to security. Just like having only one species of a crop would be a huge risk to agriculture. Single species are vulnerable in both biology and computer networks.

    This seems to me to be awfully rational.

    If they fired him for that kind of thinking, then it's probably their loss, not his.
  • by Mr. Slippery ( 47854 ) <tms&infamous,net> on Thursday September 25, 2003 @11:46PM (#7060872) Homepage
    He put his company and title in the paper. If he did not clear that with his company before publishing this paper, @stake has every reason to fire him.

    Nonsense. His company and title are simple facts, not an endorsement by @stake of his ideas or a claim to represent @stake in this matter.

    It's clearly stated in the paper that the author's views are theirs alone.

    @stake's actions are unjustified, ethically if not legally - if the law backs them, it shows only how far into corporate feudalism we've slid.

    Certainly @stake has just been removed from my list of trusted voices on the topic of security.

  • by querencia ( 625880 ) on Thursday September 25, 2003 @11:49PM (#7060890)
    I read the report, and it didn't sound like a "MS is teh ghey" rant to me.

    It sounded more like a new argument against OS monopoly, and one that made sense: it doesn't matter who has the monopoly -- just the mere fact that there is no OS diversity in itself presents a security risk. Whether or not you believe it, it is at least plausible, and a point of view that needed to be heard. Schneier put his name on it, and in my book, even if it's wrong, that at least means you should pay attention.

    How can @stake fire a guy for writing that? I agree, @stake doesn't owe him employment. But how can a company that calls itself a "security consulting company" fire an employee for helping to write a paper suggesting that OS monopoly is bad for security?

    Would you seriously hire @stake now? If your security consultants will be fired if they criticize microsoft?
  • by Cecil ( 37810 ) on Thursday September 25, 2003 @11:49PM (#7060891) Homepage
    What the hell?

    First of all: False and misleading information? Unless you have some magical insider information on what exactly happened, who are you to claim that it's false and misleading? To dismiss it as false without having any facts is no better than accepting it as true without having any of the facts. Different sides of the same coin.

    And second, it looks like a pretty tongue-in-cheek comment. You said it yourself:

    Those sorts of things happen on their own more than enough as is; encouraging it is just unecessary.

    Do you really believe that the editors don't also know this? Contrary to popular opinion they do actually read the site, sometimes. It's pretty clear to me that it's a jab at all the 'perfectly good conspiracy theories' that abound whenever a Microsoft story rolls around. Would you really call them 'perfectly good conspiracy theories' if you weren't against them? Sounds like a pretty sarcastic phrase to me.

    But hey, don't let little old me get in the way of Slashdot's readers bashing Slashdot...
  • by sbranden ( 471243 ) on Thursday September 25, 2003 @11:50PM (#7060894)
    So you would protect your job at the expense of others lives? - nice one.
  • by SatanicPuppy ( 611928 ) <Satanicpuppy.gmail@com> on Thursday September 25, 2003 @11:54PM (#7060921) Journal
    I mean, if you're Microsoft, you've got a thick skin toward bad press.

    I imagine it was just some chickenshit middle management type over at @stake who wet himself when his little pet security project churned out a ton of anti-microsoft press.
  • by The Infamous TommyD ( 21616 ) on Friday September 26, 2003 @12:07AM (#7061006)
    For him to be canned over this report (which is excellent by the way), is awful. Other heavy hitters in infosec also collaborated on this report e.g. Schneier, Becky Bace, and Charles Pfleeger.

    It's not so much that @stake doesn't have the right to fire him, but rather that it's a pity that they can't stand up to the truth. Not that corporations are known for their honor anyway. I would not trust a @stake with my business at this point-what's next? MS buying them into using their clearly superior security products?!
  • by kfg ( 145172 ) on Friday September 26, 2003 @12:07AM (#7061008)
    See Playboy vs. Terri Welles.

    Statements of fact do not imply endorsement.

    Terri Welles was, in fact, a Playmate. Playboy cannot restrict her from saying so, even by attempting to apply trademark law against Ms. Welle's use of the trademarked word "Playboy" in for commercial gain.

    The fact that being able to claim to have been a Playboy Playmate gives her a certain professional standing in her field (tits) and she is free to use that standing for her own benefit even over the objections of Playboy.

    Dr. Geer is (ok, was) the Chief Technical Officer of @Stake. This is a position of authority in a particular field and stating that one has that authority gives one's opinion in that field certain standing. It is a factual statement and does not imply endorsement by his employer. It only imlies that one has recognized special skills.

    If people misconstrue that that is a problem of their understanding, just as it is if people believe that Ms. Welles' personal site is an official Playboy site because she lists her employment by Playboy.

    That doesn't make her an infringer. It makes them morons.

    If the guy down the street who works for a Ford dealership tells me that he thinks Fords suck I too would have to be a moron to believe that was the official position of his employer.

    Whether or not that might be legal grounds for firing said employee is another issue. I'd have to review the relevant law in his jurisdiction and make an examination of his contract to have an opinion on that.

    I'd think his employer was an asshole for doing it though, if he was otherwise performing his duites satisfactorally. That's just my opinion of course, which is colored by knowing many people who worked for companies they don't like. I've even worked for a few myself. Hell, I even owned one of those companies.

    But I didn't fire myself.

    KFG
  • by laird ( 2705 ) <lairdp@gmail.TWAINcom minus author> on Friday September 26, 2003 @12:08AM (#7061017) Journal
    "When you're CTO of a company and repeatedly use that title and the company name in a publication of that sort, the average reader assumes your represent your company."

    You mean "the average Slashdot poster who didn't RTFA assumes...".
  • Re:Yeah... (Score:1, Insightful)

    by Anonymous Coward on Friday September 26, 2003 @12:11AM (#7061036)
    Well, one of the main points of the paper for which he was fired was that _any_ software monoculture is dangerous. So yes, a Linux monoculture _would_ be just as bad as a Windows monoculture. The specific criticism for Microsoft came from the fact that the company puts _so much effort_ into maintaining their Monopoly, and hence the monoculture.
  • by Infonaut ( 96956 ) <infonaut@gmail.com> on Friday September 26, 2003 @12:18AM (#7061081) Homepage Journal
    They have an awesome working relationship with Microsoft. They get to do exactly what they love to do (finding exploits) in code that is supposedly riddled with problems and get paid tons of money to do it. In addition, they help the world by helping MS identify and fix these bugs.

    I can't argue with those points. You're absolutely right. It's just a shame to me that someone who knows a lot about something that affects the security of millions of Americans can't speak out about that threat without being fired by their employer.

    It's rare to see a group of people take a stand about something they feel is of more importance than just dollars and cents. These folks are essentially blowing the whistle on something a lot of people have known about for a long time but have been too frightened to say for fear of the wrath of Microsoft.

    While I absolutely agree with you that @Stake is just protecting their own interest, their action is proof of how far Microsoft has permeated the fabric of the IT business. Virtually every company in the industry has to be careful about criticizing (or even allowing an employee to criticize) Microsoft, for fear of retribution.

  • by Waffle Iron ( 339739 ) on Friday September 26, 2003 @12:21AM (#7061090)
    It looks like he was just in 'a panel of experts', which would suggest he was on his own.

    However, right at the top of the report the author list includes "Daniel Geer, Sc.D - Chief Technical Officer, @Stake". When I read the report, I was under the impression that the company was involved with it or had at least approved it prior to publication.

    Even though I agreed with just about every point in the report, I could see that if the report does not reflect the (public) views of the company, then they would have a legitimate reason to fire him. The paper makes strongly worded criticisms of Microsoft, its monopoly status, its business practices, its lock-in tactics and its technical abilities, and a company with a lot of Microsoft-using clients would be nervous being too closely associated with it. If he put his name (along with the name of his company) on this particular paper without clearing it with them up front, that just wasn't very smart. (Or maybe it was smart; it could be a bid for fame and notoriety. I certainly didn't know who this guy was until yesterday.)

  • by jpetts ( 208163 ) on Friday September 26, 2003 @12:31AM (#7061139)
    Or the researchers for pharmacuticals... where if you find that drug X doesn't help cure Y, then you shouldn't expect any grant money next year. Yeah, not fired, but certainly the same net result.

    Can't let this go. I'm afraid this is utter crap. I've been in the pharma industry for nearly two decades, and I can assure you it doesn't work this way in the slightest. There are many, many cases of promising potential drugs getting canned each year in just about all but the smallest pharma company. I have never seen or heard about anybody's career being harmed by serendipitous failure. Hell, the company I work for was doing work around PDE V inhibitors about 15 years ago, and we got really close to sildenafil (Viagra), but stopped work in the area. Nobody got canned or carpeted or anything. It just happens. This year already we've had two major compounds drop out of development. Sure, people get pissed off, but so what? That's the way pharma works.

    Pharma research just doesn't work in the way you describe. Sorry, but your comment is -1, Bullshit
  • by BeNice ( 711047 ) on Friday September 26, 2003 @12:45AM (#7061222)
    You guys all need a real life. Spending life cycles debating this stuff is just a total waste of time. When you're all 80 and imoblized, you'll want the precious time back that you spent talking about this stupid, meaningless, stuff -- as if your contribution to the forum will make any difference at all. It won't. But that garabage along the street that you could have been picking up will still be there. There's better ways to spend your life than being a pissed-off evanglest for some stupid peice of technology.
  • Assumptions (Score:2, Insightful)

    by The Kow ( 184414 ) <putnamp AT gmail DOT com> on Friday September 26, 2003 @12:59AM (#7061308)
    Why assume that MS had ANYTHING to do with his getting fired - it could've just as easily been some nervous CEO who perceived, rightly or not, that firing this guy would be a better move than keeping him on board.

    Think about whatever company you may work at, if not now then some day. If you wrote something critical of one of your company's main sponsors, or a frequent collaborative partner, it wouldn't be likely to go over well with the President, would it?

    If you're at all worried that there's competition for your position in a collaborative partnership with, in this case MS, you're going to take pre-emptive steps to ensure that your partner knows how devoted you are, and if it gets to the point that they're pressuring you to do these things, then it probably means you're behind, which is a bad sign.

    It's very possible that Microsoft didn't give a whit about this guy, or at least didn't care enough to tell the company to "do something about him!". Let's be honest, we do have a tendency to overhype the anti-MS sentiment in this community sometimes.
  • by CatGrep ( 707480 ) on Friday September 26, 2003 @01:03AM (#7061326)
    ...who bears bad news. Looks like this is @Stake's loss more than Mr. Greer's. Someone with his knowledge of secuity won't have a problem finding a job even in this economy (security being kind of a hot topic these days).
  • by Corgha ( 60478 ) on Friday September 26, 2003 @01:06AM (#7061338)
    @Stake has expanded a lot with VC

    I remember going to one of the MIT Fleas [mit.edu], back when l0pht became @stake, and they had a big van pulled up and were selling off their old junky equipment. Presumably they were buying more modern gear with all that VC. I bought a big brick of a hard drive from them. It had some nice mp3s on it (among other junk), and served me well until I sold it again at the flea, l0pht sticker and all.

    Anyway, hung on the side of the van was a big sign reading:
    L0PHT SELLS OUT

    Until today, I had no idea just how much they had.
  • Re:last message (Score:4, Insightful)

    by bigman2003 ( 671309 ) on Friday September 26, 2003 @01:08AM (#7061347) Homepage
    Are you nuts? Or do you just have a very small understanding of business?

    If this person was a writer/researcher/whatever for a company, and he made comments that were not only attributed to him, as an individual, but to the company he worked for- yes, they can get rid of him. And, if these comments made by him, under the guise of 'official' statements were contrary to the companies position, then yes, he *should* be fired.

    If he wants to say these things on his own time, and not associate them with his company, then fine. Unless of course he has a contract that states he CANNOT do this. This is fairly common for people who are a 'spokesperson' for their company. Or, who are strongly identified with the company.

    But, this person wanted to use their company's good name to push his own agenda- that is not a good thing. I work for a major university- I cannot publish papers filled with my opinions, and my own platform, and associate it with my university. In fact, anything that IS published, and associated with the university, needs to get peer-reviewed by at least 3 other people who are experts in the field. This is to ensure that individuals cannot use the university's good name as their own pulpit.
  • by ericman31 ( 596268 ) on Friday September 26, 2003 @01:23AM (#7061398) Journal

    OTOH, MS software and national security is probably not a life-or-death issue. At least, I hope it's not.

    So, when a U.S. Navy missile cruiser has to be towed back to port because it's computers running MS Windows have crashed it's not life and death? What about the Dept. of Homeland Security using Microsoft products for their servers and workstations? How about the network operations centers and shore bases of the Navy using Microsoft for the servers and workstations?

    Come on, Microsoft is wide spread and pervasive throughout the U.S. government. The State Department couldn't issue visa's because Welchia, which could be prevented by patching or anti-virus software, infected their network. An offline nuclear reactor had safety systems fail that were running Windows. Just what OS do you suppose the Army and Marine Corps battle computers are running? What would happen in a war if our enemy penetrated those battle networks with a worm of some sort? How much more do you need to be convinced that depending on seriously flawed software in the government is not only dangerous to national security but also a "matter of life and death".

  • by MickLinux ( 579158 ) on Friday September 26, 2003 @01:26AM (#7061411) Journal
    Simple point here: whether or not @stake is involved in a conspiracy, @stake clearly considers themselves to be a advertising/publicity agent of Microsoft.

    @Stake clearly does not consider themselves to be a news organization, or a news clearing house.

    That said, they should, in the future, be held to the standards of advertising agents, with all the benefits of such -- not news agents with their benefits.

    Therefore, if they want to come in to cover a software convention, by all means let them [but at full price: no media pass]. If they want to claim first Amendment right to speech, they can, within the bounds and with the protections set by our government for advertisers. Not within the bounds and with the protections set by our government for news media.

    I don't see a reason to apply conspiracy here; just treat them as what they consider themselves to be.
  • by mpaque ( 655244 ) on Friday September 26, 2003 @01:29AM (#7061421)
    My favorite bit:
    > Microsoft spokesman Sean Sundwall said AtStake
    > contacted Microsoft Tuesday night to express
    > disappointment in the report and to say it did not
    > reflect AtStake's position.

    So, if AtStake has all this integrity and independence, why do they contact someone at Microsoft to do the old "No! No, Master, it wasn't us! It was the tricksy CTO. But we fires him, yes! Is Master pleased with us?" routine?

    > "Microsoft had absolutely nothing to do with
    > AtStake's internal personnel decision," Sundwall said. ... pleased that he had maintained plausible deniability.

    Just another day at the weasel ranch...
  • by Zhe Mappel ( 607548 ) on Friday September 26, 2003 @01:31AM (#7061432)
    I find it rather disturbing that a company can fire you for something you do of your own accord. What's next, are companies who like to suck up to MS gonna fire you for developing a linux program?

    Am I just being naiive, or does this bother other people too?

    Oh, it had better bother other people. Tomorrow, it might be them.

    Whistle-blowing is never a popular job, but it's even riskier during bad economic times. Most of the backlash against this employee is due to the spineless quivering, in management, about losing vital business. Once again, we see why monopolies are unhealthy for society.

    What are you gonna do, though, if you're canned? The employment-at-will doctrine has essentially always allowed bosses to hire and dump whomever they wish for any reason; dear old kooky Walt Disney used to go nuts with this easily abused freedom, and the 1990s left a trail of shattered lives and communities behind the rapacious "downsizing" of workers. Except where protected by civil rights or state employment law (and good luck bringing a case!), this is where you stand as an employee in America - at the mercy of the Man's whims. Learn to kiss ass; learn to run your own business; learn to work for decent people; these are among the few options for workers, and guess which one is most popular.

    But this is also a hysterical time politically. Under the New McCarthyism the pasture of sacred cows has been enlarged: now not only our Glorious Leader is supposed to be beyond reproach, but so are certain corporate entities. And by burrowing like a common bacterial spirochete into the guts of American national security, Microsoft has begun to undergo the transformation - symbolically - from mere lawless and sloppy monopolist to vital U.S. institution. Yesterday, MS merely brought you BSODs, viral weakness and data loss. Today, it defends America against her enemies with its arsenal of...er...BSODs, viral weakness and data loss.

    If this transformation continues, it will be more and more costly to criticize Microsoft as it mutates into an adjunct of the security state. HomeSec is already MS's taxpayer-subsidized tech support service, busily issuing warnings about the latest viruses and worms. This relationship should be promptly terminated by the next administration when the adults get to run things again.

  • Re:Hey! (Score:3, Insightful)

    by DrPascal ( 185005 ) on Friday September 26, 2003 @02:00AM (#7061519) Homepage
    Perhaps the reason you couldn't connect to the SMTP port of your problematic mail server was not telnet's fault, but the problematic mail server's?

    postfix stop; postfix start

    kthxbi
  • Daniel E. Geer Jr must have really hit a sensitive area of Microsoft. Its really sad to see them so unwilling to realize that the report isnt a hit on MS but more about monoculture in the internet. Monoculture is bad, ask any biologist and hell tell you why. Diversity is much better but it demands open standards and interopability, something Microsoft have been successfully avoiding since day one.
  • by plover ( 150551 ) on Friday September 26, 2003 @02:17AM (#7061573) Homepage Journal
    Are we going to be corporate slaves soon?

    We already are.

    Flip comments aside, many people's employment contracts stipulate "no negative comments about the company, and don't say negative things about anyone while publicly under the corporate banner. Violation is grounds for termination." And typically the higher you go in the company, the more restrictive the clauses become. You should check yours. I had to sign such a contract the last time I received a promotion.

    Mr. Geer sat on that dais with a nametag reading "Dan Geer, CTO @Stake" and it certainly appears that he was speaking with the authority given a CTO of a company; it is quite obvious he was not invited just because he used to be a l33t h4x0R.

    Remember, companies can not VIOLATE your right to free speech. You have the right to get on TV and shout "Company X sucks! Don't do business with Company X!" if you want. You can not be jailed for it. But they also have the right to fire you. You simply have to be willing to trade your voluntary employment contract with them to continue speaking.

    [ Perhaps the most interesting part of this is the chilling side effect: might I get fired if I present this committee's article to my director? She's very pro-Microsoft... ]

  • by Anonymous Coward on Friday September 26, 2003 @02:30AM (#7061612)
    How does it go again?

    If you think, don't write.

    If you think and write, don't sign.

    If you think and write and sign, don't be surprised?

  • by rbook ( 409739 ) on Friday September 26, 2003 @02:44AM (#7061647)
    How is this "admirable from a capitalist viewpoint"?

    Protecting the image of one client by blowing your credibility with all other actual and potential clients is not "capitalist," it's stupid. It's the sort of thing that put Arthur Andersen out of business for covering for Enron.

    Heck, even Microsoft should think twice before trusting @Stake now; they should assume everything @Stake tells them is just brown-nosing...
  • by plover ( 150551 ) on Friday September 26, 2003 @03:06AM (#7061712) Homepage Journal
    Oh, I agree that this is absolutely the worst action they could have taken. The life cycle of their business flows pretty much like this: At any random corporation, members of the board hear "we need a computer security audit" from the stockholders (many of whome have recently been infected by Welchia.) Managers write "perform a security audit" on their checklists. They then ask their Senior Technical People With Clues (STPWC) to recommend firms who audit security. Technical people turn to places like comp.risks, slashdot, etc., which all figure into their mental balance sheet of companies to recommend. They then suggest the names they recognize as having good reputations.

    @Stake just sold their reputation to Microsoft, lock, stock and barrel. If you need a "clean bill of health" security audit to hand to the shareholders and you're a 100% Microsoft shop, you now know where to find a friend: @Stake. If you're actively interested in security, rather than simply checking a box off on your manager's list, @Stake doesn't have any whuffie left.

    My prediction is whatever is left of @stake after this fiasco will be purchased by Microsoft by assumption of debt, probably in the next two years or so.

    @Stake has always looked good in the past. They sure looked brilliant this week when this paper came out. And now, it appears that all this time their talent was locked up inside their CTO. So they threw the baby out and kept the bathwater. They're not looking so good anymore.

  • by Strudelkugel ( 594414 ) * on Friday September 26, 2003 @03:32AM (#7061780)

    I had a look at the report, and so interpret the situation a bit differently than most here. In my view, it reads more like an amicus brief (statement by a friend of the court) than a technical doc. Look at it, they rant and rave about the "M$ monopoly" throughout.

    There are plenty of technical/security aspects of the dominance of M$ platforms, but this report doesn't address them effectively. This can be expected since it looks much more to me like a hack job funded by competitors:

    Ed Black, the CEO and president of CCIA, whose members include Microsoft competitors such as Sun and Oracle, was even more blunt.

    "Microsoft's monopoly threatens consumers in a number of ways, it it's clear it is now also a threat to our security, our safety, and even our national security."

    Yeah, yeah, baseball and apple pie, too.

    I have no idea as to why Geer was fired from @Stake, but having his name associated with a position paper parading as a tech document probably wasn't helpful.

  • I'm unemployed and the way things are, I don't think I'll get a job in the tech field anymore so this doesn't really impact me that much but...

    I am not saying that we are not a corporate slave. I personally said that before. I was simply mad at the fact that so many people support the present state of affairs...

    Remember, companies can not VIOLATE your right to free speech...But they also have the right to fire you. You simply have to be willing to trade your voluntary employment contract with them to continue speaking.

    That's commercial censorship. It is widely accepted and all capitalists are in favour of it. But that's not freedom of speech.

    I always thought that capitalism will collapse due to a class war due to discrepancies in wealth (as Marx claimed).... but now it looks like there is another reason. Its collapse might actually be due to its erosion of democracy. At the rate things are going, there will be no difference between a police state and a corporate state!!!

    [ Perhaps the most interesting part of this is the chilling side effect: might I get fired if I present this committee's article to my director? She's very pro-Microsoft... ]

    I think people DO get fired for things like that... You might not get fired for giving the report to her. But if you gave it to her competitor (say another manager or something) or a more senior person, you may very well get fired. You'll be in a situation where you put forth reports claiming MS isn't so good, while she claims MS is good. A clear conflict. Unless the guy you give the report to (i.e. other manager or higher up) comes to your aid, I can see you being fired easily.

    I don't think things were as bad--in some sense--a few decades ago. Now, I think it's a lot worse for workers. I can't recall reading or hearing about anyone signing contracts 20 years ago where the employers own almost everything the person does, etc. I think part of the reason is that information is more widespread and has far more power now. To illustrate my point, did you know that messages being posted on stock market message boards actually cause millions of dolalrs of wealth increase or decrease? You can actually pump or dump a stock by spreading rumours on message boards. It isn't legal but it was shown to work during the stock market boom a few years ago. This just goes to show the strength of information...

    My theory was that you can overthrow governments via the internet in the future (bloodless democratic overthrow). I never considered that scenario for corporations. Well, I guess the same sort of impact can be directed at corporations (a mass boycott campaign can easily destroy a product line or even a corporation). So the more I think about it, the more it makes sense. What is happening now is nothing more than reactionary policies of corporations. If the workers didn't have as much power none of this would matter. For example, if Greer's words don't mean much, he wouldn't get fired. Unfortunately for the corporation, the employees are more influential than ever. I suspect this is going to get worse and worse. I wouldn't be surprised if you got fired in the future for walking into your company wearing a pro-Linux jacket when your company is closely aligned with non-Linux forces (say Microsoft, although I am not implying MS is bad). I suspect this phenomenon will pervade all businesses in the future...



    Sivaram Velauthapillai
  • by Felinoid ( 16872 ) on Friday September 26, 2003 @04:09AM (#7061879) Homepage Journal
    I've mentioned this before when technology publications that focuse primaraly on Microsoft products CLAME the are impartal and have no ties to Microsoft that when you rely on someone for information your not impartal to that source.

    Info 64 a publication for Commodore 64 users created on the Commodore 64 etc etc. The whole philosophy is the magazine should live and die by the products they support. Obveously they are no longer in publication.

    Anywho when Commodore published the specs for the 4+ and C16 every Commodore mag published the specs exactly from the press kit. Info 64 did not.

    A reporter at Info64 wrote an artical ripping on other Commodore based publications for doing that.
    The point he made was that ANY publication that focuses on Commodore is answerable to Commodore. When Commodore hands out press kits there is an implied threat "report this and be glad we give you anything".
    I rember that. I was a subscriber to Computs Gazzet Commoodre and Info 64. Compute was a publication powerhouse and got ALL the latest news and information but they were never critical of Commodore or the software titles. When they did report weak points they'd glaze them over like it didn't really matter.
    All the platform publications were like that.
    Except for Info64. Thats what I liked about them.
    Info 64 starts off with a bunch of reviews and I always read them over. They are very critical and careful to review the software properly.
    In other publications I skip the reviews becouse they were just free ads pretending to be lagit reviews.
    The greatest database program ever... on the Vic 20? See where I'm going with this? Some of thies reviews were just downright garbage becouse the publications were fearful of being cut off.

    Info64 didn't care. If they can't do it right they can't do it at all.

    No Commodore never cut them off.

    But now jump forward... Commodore is dead Microsoft rains suppream and Microsoft is making noises about it's latest and greatest Windows 95. Bug free and an Os itself not an envronment running on top of Dos. It now uses protected mode processing like OS/2 so a bug in a driver or application won't crash the whole operating system.

    Microsoft handed out Windows 95 beta CDs.
    Nearly every industry reporter got one. One reporter had the balls to point out every single problem in the Windows 95 beta.
    Microsoft was angry and pulled that reporter from the beta program.

    Commodore was bluffing Microsoft wasn't.

    Now everyone is being very careful.

    Unless they are Mac or Linux publications.

    If you work for a publication that works with Microsoft ANY time your critical of Microsoft you put your job at risk.
  • by jotaeleemeese ( 303437 ) on Friday September 26, 2003 @04:11AM (#7061884) Homepage Journal
    If you talk as an individual in a matter in which your employer may have a stake (think a financial analyst working for a bank) you better make sure your employer does not have a problem with what you are going to say, no matter how many disclaimers you put around your words.

    The reason is very simple: a given company needs to keep a reputation, in the case of a security company they need to appear to be open and impartial when assesing different products. By having an employee that clearly has reached his own conclussions and made them public the employer is left in the difficult position to explain how they may be choosing MS stuff or recommending it given that one prominent employee has lambasted those products in a public forum.

    Sorry, but I have no pity for this person in spite of broadly agreeing with his conclussions.
  • by lxs ( 131946 ) on Friday September 26, 2003 @04:51AM (#7061987)
    Since when is slashdot a press agency? If you want fair, unbiased news, go read a newspaper.
  • by hackus ( 159037 ) on Friday September 26, 2003 @04:54AM (#7062001) Homepage
    I hate to be a rant...but I can't help myself. :-)

    Ethics is going down the tubes. An example, I think was the investment community in the U.S.

    If you watch the media, you have this over all impression, well, Enron was just a fluke, they had poor accounting.

    But if you read the papers, this fluke, is being practiced by 100's of companies, all screwing over their investors like cheap whores on a Dutch street corner.

    I hate to point this out, but these Ivy league trained people were taught and are taught that this is just ducky. How can it not be with so many companies screwing you on a daily basis.

    It can't be a fluke when everyone is doing it.

    Fluke? I think not, but you decide.

    It has become ethical to do business unethically and it is proudly taught that way in our so called finest Universities.

    If anyone has any money in US retirement investment funds, when they retire 30-40 years from now, I will be really amazed.

    If you are an investor, and you are investing in US companies for retirement, you my friend are a sucker.

    Same thing is happening here. Microsoft is not an innovative company, it buys companies.

    They do not write good software and if you are stupid enough to buy Microsoft Press books written by PhD's who claim they even have a clue about good Software Engineering principles, you are just another duped "investor".

    I would like to point out that Microsoft is one of the largest employers of Computer Science PhD's in the country.

    As an example, one must ask this question after looking at these Software Engineering practices books that Microsoft Press publishes as oxymoronic.

    My reasoning is as follows:

    Exhibit A: Microsoft hires more PhD computer scientists than even IBM has to work on the secure initiative for 2000 and XP. Building and rebuilding the entire OS 2000, and then again with XP, from scratch, at a estimated cost of 2.8 billion dollars.

    Exhibit B: A 18 year old in Minnesota, a 16 year old in Malaysia, and a 21 year old in Russia. All with WAY too much time on their hands, with NO source code, find more security holes in 2000, XP than you can possibly say "Code 'in'-Complete" in that past 14 months.

    Exhibit C: A University student, in Finland builds a new operating system kernel called Linux, and in just 8 years it is being worked on by almost no PhD's and many testors and code contributors are in their early 20's or teens, and is far more capable than windows, 1.8 billion dollars later.

    Is Linux just another Enron? Fluke?

    My point is that the way we are being taught code in this country is not the way code should be written. Even if you have a PhD, its business as usual dogma, just like our MBA friends.

    Is it a fluke that the best code being written is not through institutionalized learning in this country?

    What do these exhibits tell us about our country in general, with regards to ethics?

    It doesn't take a rocket scientist to figure out what is going on here.

    Fluke?

    I think not, but you decide.

    -Hack
  • by HidingMyName ( 669183 ) on Friday September 26, 2003 @08:20AM (#7062587)
    The paper was written by six different authors, all of whom are very well respected in the security community. I think that covers your concerns about "peer review.
    In peer reviewed forums the forum appoints people to read and review the papers, they don't just take the author's word for it. Even smart people get stuff wrong, which is why external review is needed.
  • He's the Chief (Score:2, Insightful)

    by borroff ( 267566 ) on Friday September 26, 2003 @08:28AM (#7062630) Journal
    He's not just some shlub in a lab. The guy's the CTO, and as such, he is assumed to set the technical tone for the company (that's why he's the chief). If the board believes his personal vision is not in line with the company's goals (i.e., taking Microsoft's money and getting rich), then they would be failing in their duties if they did not replace him.

  • by mormop ( 415983 ) on Friday September 26, 2003 @09:04AM (#7062833)
    All this does is shoots down @stake's credibility.

    Anyone with half brain will realise that running an entire network on a single OS is asking for it. This is why buildings don't tend to have the same key for every lock and the burglar alarm and keep skeleton keys well guarded. If this were the case, someone drops the key in the car park and whoever finds it has free reign and oh boy, the joy of the discovering that it opens every desk, filing cabinet and safe as well.

    The headline was that a singular reliance on Windows is a bad thing and I can't see that this argument is flawed. For @stake to sack someone for daring to state the obvious is laughable and makes them look stupid in the same way that Microsoft always looked stupid when they'd claim that there were no reliability issues in Windows despite the fact that even the non-techiest people in an office could tell you what BSOD stands for.

    If anyone at MS is thinking that this is a good thing then they should consider that many people watching have already, based on their previous record of dubious behaviour, put this down to their intervention. Whether it's true of not is irrelevant, it just seems most likely.
  • by EinarH ( 583836 ) on Friday September 26, 2003 @09:07AM (#7062859) Journal
    The irony is that this company's research division originally consisted of people that came in by a merger. L0pht Heavy Industries an old hacker group from Boston merged with @stake.

    L0pht has allways belived in full disclosure of security vulnerabilities; like they stated in this interwiev. [pbs.org].

    There was also a /. story [slashdot.org]. about L0pht, "hypocrisy of hackers" and (possible)connections to FBI and NIPC a year ago.

    So it turns out that the hacker philosophy went out the backdoor and the corporate standards from @stake prevail.

    Of course their relations towards Microsoft is important since they are their largest customer but firing the messenger because his wievs don't reflect the party line, and NOT because he is wrong, will hurt their reputation as consultants more than his wievs do.
    Maybe it's naive to think that one buys some independent judgment from consultants and security groups but atleast one should expect that they give the CTO some slack in publishing a paper/report about the consequences of reliance on one company.

    I would think that it would have been better for Microsoft to indirectly say "we are working about the security with @stake even if one of them criticized us" rather than "we are working with @stake, and yes they fired the messenger".

    Anyway; just my $0.02

  • by CrazyDuke ( 529195 ) on Friday September 26, 2003 @09:24AM (#7062972)
    "How much more do you need to be convinced that depending on seriously flawed software in the government is not only dangerous to national security but also a 'matter of life and death'."

    Apparently, when lots of people die and lots of evidence shows it was because of the software.
  • by clary ( 141424 ) on Friday September 26, 2003 @10:03AM (#7063310)
    So, you honestly accept that as a litmus test for determining whether or not you have the freedom granted by the first amendment?
    Geer obviously has his first amendment freedom of speech. He freely published the paper, didn't he? He is not in jail, is he?

    Please do not confuse Americans' right under the Constitution to speak freely with an obligation on the part of private parties (like Geer's employer) not to react negatively to our speech. You might be able to convince me that @stake's action was unreasonable, obnoxious, unethical, or even stupid, but never that it has anything to do with Geer's constitutional rights.

    Every time some public figure says something that someone disapproves of, we see the First Amendment get trotted out. Stop it!

We are each entitled to our own opinion, but no one is entitled to his own facts. -- Patrick Moynihan

Working...