@Stake

Dan Geer, chief technology officer of computer security firm AtStake said in a report:

=+=+=+=+=+=+=+=+=+=+=
“…that the dominance of Microsoft software on PCs has made computer networks susceptible to "massive, cascading failures." It also said the complexity of the software has made it particularly vulnerable to virus and other attacks”
=+=+=+=+=+=+=+=+=+=+=

He was fired from @Steak that evening and @steak was quick to respond.

=+=+=+=+=+=+=+=+=+=+=
AtStake contacted Microsoft Tuesday night to express disappointment in the report and to say it did not reflect AtStake's position.

"Microsoft had absolutely nothing to do with AtStake's internal personnel decision," Sundwall said.

Bruce Schneier, chief technology officer of network security services firm Counterpane Internet Security and a co-author of the report, said the situation illustrates the power Microsoft has to silence critics.
=+=+=+=+=+=+=+=+=+=+=

http://www.forbes.com/technology/new...tr1092228.html

http://www.businessweek.com/technolo...es/5082649.htm

I'm not really impressed by @stake or it's employees however, admitting thaqt M$hit had nothing to do with this guys firing is like looking up and whistling nonchalantly standing next to an empty cookie jar.

M$ and bill Gates are the antichrist. Fire me for saying that....just try.

I will have to agree with you KorpDeath 100%. Where has freedom of speech gone? Am very disappointed at AtStake for doing such a thing.

Dan had all the right to speak his mind and I don't see how that should have affected his job. Just my thought on things.

I will not run test on windows based systems cause the stability needed is not present and hence I would not be able to produce a chip to run windows. The irony of things. Facts are just facts.

Guidance...

Quote:

---

Originally posted here by cutty
I will have to agree with you KorpDeath 100%. Where has freedom of speech gone? Am very disappointed at AtStake for doing such a thing.

Dan had all the right to speak his mind and I don't see how that should have affected his job. Just my thought on things.

I will not run test on windows based systems cause the stability needed is not present and hence I would not be able to produce a chip to run windows. The irony of things. Facts are just facts.

Guidance...

---

Freedom of speech? What the hell are you talking about? Since when does that have anything to do with corporate relations or the professional environment?

@Stake is smart in shutting up that rouge idiot. Regardless of your feelings on Microsoft, when is it ever a good idea for a small company to public ally attack another company, unprovoked at that? As an officer for the company, Mr. Geer has the legal ability to speak for the company and it is apparent that he over stepped his bounds in this case. I can't think of any company that wouldn't have done the same thing in the same situation.

Also, your failure to produce a product for the industry leading operating system I think says more about you than about it. No one else seems to have any trouble. Facts are just facts.

The thing I love, is that I'll be branded as an MS lover for this post, which is amusing how people tend to find anything less than: "M$ and bill Gates are the antichrist." as loving Microsoft, and god forbid you actually bring facts and objectivity into the conversation.

If @Stake was so egregious, let Mr. Geer sue, and watch him lose.

catch

Thats bizzare, since when @stake start to kiss microsoft booty. If it was really important to kiss then why not linus torwald. I think linus did a very great job for all the computer users and what microsoft did, invented a operating system which is full of crap and vulnerablity. Hell their so claimed DOS is not even their own invention. What a bunch of ideots are jumping in one microsoft way. @stake is no longer that impressive anymore, they are just too old compare to new generation security experts.

"new generation security experts"

hahaahah yeah... people that think monolithic kernels, third generation firewalls, and single level systems with multi-actioned security commands are the apex of security.

This "new generation" is gonna keep CERT real busy.

catch

:rofl: CERT. Sound like you've been there. Another place for bunch of wannabees gathers everyday and waste their money and time.

Im gonna have to agree with rift, If I were n the position that @stake was i would have fired him to, it is in no way appropriate to publicly attack an ally, espiciall if unprevoced. Even if he did not mean for it to come out as him speaking for the company, thats how it is. Im sure it wasnt microsoft that said fire him or your toast. Its called tact and professionalism, both of which this man seemed to have lacked.

Has anyone read the report yet that Greer got "fired" over?? Is it worth reading?

Im gonna go find it and read it, just to see what he said,a nd how bad it really was.

Quote:

---

Originally posted here by \/IP3R
:rofl: CERT. Sound like you've been there. Another place for bunch of wannabees gathers everyday and waste their money and time.

---

I was using CERT as a euphemism for *ahem* those admins' emregency response teams. As people that hold belief in what i stated will continually have issues.

To be fair however, it is not this new generation's fault, it is the old generations fault for not making the fruits of their labor more availible which has lead to the new generation starting over from scratch and seeing nothing wrong with what should be obsolete systems.

catch

Ps. nice attempt at an insult though. :)

Could it be his part in this paper that did it ???

got the refference from:

this article, this article and this article

Hi,

Now here is a nice target for you to "neg" :)

An employee of a company, and even moreso an "officer" is legally a representative of that organisation? If you make a public statement in that capacity, you commit them. [ Any DAs out there?............I am filing an insanity plea]

I guess that the guy was at fault for not making the disclaimer that this was his "personal opinion"? On the other hand, the "Media" should have had the common sense to put that bit in for him?...............they claim to "protect their sources" don't they?

The Micro$of issue is really irrelevant, it is there, it cannot be "uninvented"..........everyone has 20/20 superior hindsight....I know that I do :D But as the great Bard said "That which is done is done"....................did he make any POSITIVE suggestions as to the rectification of the problems that he identified?

If he did not, might I suggest that his actions were similar to playing Russian Roulette with a Colt .45 Auto :eek:

I believe in freedom of speech, but what happens when your freedom impinges on other people's?

If the Guy had only PMd me, I would have drafted a proper and polite letter of resignation for him?........there might even be a good conspiracy theory here?


A few thoughts


Cheers

Catch you made a lot of good points and I must admit you are right but there are just some things some companies should consider when they take such drastic measures.

For one when you say:

Quote:

---

If @Stake was so egregious, let Mr. Geer sue, and watch him lose.

---

If Mr. Geer was to get a good lawyer and sue @Stake do you really think he would loose? I don't think so. The exposure the company would get from a lawsuit would be something a company like @Stake would not want to go through. So you know what they will settle at the first chance they get. IMO Geer has just landed himself a wonderful retirement plan.

There are too many issues involve with the media for @Stake to just fire Geer for reporting the facts that may have been twisted by the media. True he represent the company but still there are checks and balances and if he pursue a lawsuit I think he stands a great chance of winning.

Just my $0.02

Guidance...

Hey Cutty,

I guess you just identified my "conspiracy theory" :D

cheers

nihil we just never know what the media will put from their bag of tricks. They can be a tricky group of individuals.

I would really like to see what turns up after this but @Stake may keep it hush hush. We will just have to wait and see.

Guidance...

Quote:

---

Originally posted here by cutty

If Mr. Geer was to get a good lawyer and sue @Stake do you really think he would loose? I don't think so. The exposure the company would get from a lawsuit would be something a company like @Stake would not want to go through. So you know what they will settle at the first chance they get. IMO Geer has just landed himself a wonderful retirement plan.

---

Maybe... but if their goal is to suck up to Microsoft as everyone says, then a full court case would be ideal for them to do that.

I personally agree with much of the document in question, and much of it is objective, however some of the article is quite subjective and would be downright inappropraite to say about a partnering company.

As for the article itself, the authors make some interesting points, but failed to consider a few things.

First things first, perfect software does exist, KSOS is a notable example. Flight assist systems in the F-16 are another fine example. (these make thousands of course corrections per second or the plane will crash, a bsod or kernel panic are not acceptable)

Next, yes MS does make up the vast majority of systems and yes this makes the environment more suseptibale to common attacks be they sefl propigating or not. However, this is a requirement of efficient communication. Just like all americans speak english, if we were all speaking different languages the cost of business goes up. It is one thing for companies that choose to deal with international clients, but imagine if you needed to speak different languages for each, buying gas, food, paying your bills, etc. That would be very inefficient, and in this capitolist market, if an organization came along that you could communicate more easily with, they would get your business. So homogenization is a natural occurance. The real issue at hand is the way security works. Why is it that it wasn't until 2002 that the first research projects really took off on the automatic, dynamic discovery and isolation of malware took place? Signature based defense? What moron came up with this? This is just an approcah at keeping malware defense companies in business.

The next question is, people might start using a Windows alternative if one existed! There is no comparably priced system, that will function comparably, and meets the same level of standards as Windows. So what? the average business is just supposed to take one for the team? Pay more money, lose functionality, hit lower standard just to help out the computer community overall? Yeah... sign me up for that. Unlikely at best.

Software complexity? This is true the Windows system and all MS software is exceptionally complicated, but I don't think needlessly so. Features sell, watch as every release of the major Linux players gets more and more bloated. The more a computer does, the more useful it is and the easier it is to sell. If you tell customers that you've removed over 100,000 lines of code from the last rev, they will want to know why they should upgrade. Does it have new features? Did it lose features? If it didn't lose features, why were those extra 100k lines of code in there? And now a huge shadow of doubt has been cast on the vendor.

Despite what the open source people seem to think, software is a business (and without software companies the open source movement would colapse since they'd all lose their day jobs) and being such, qustions like "how does this effect the rest of the world?" are not a concern. If your concern is your own failure... not global cascade.

In short, the paper is interesting, but I don't see what value it adds.

catch

Cutty, nihil, etc:

Keep in mind that this was a CTO. He should have had the experience and maturity to have known better than to make public statements without clearance from the corporate authorities. CTO's are contract employees of their company and their contracts, if the company is practicing due dilligence, include statements describing whether that contracted employee can represent to the public or not. Usually, all public statements, reports and other communication must go through the corporate flack first (PIO or CIO). Sidetracking that process is generally described in contracts as grounds for immediate dismissal. I know of very few instances where this kind of behavior has happened that the offending employee hasn't been handed his or her hat before the day was out.

Whether you agree with his statements or not has no bearing on the fact that, yes, the company was well within their rights to fire him--assuming that the events are as represented. This has nothing to do with freedom of speech. Freedom of speech, as applied in the United States, is an individual freedom and applies so long as the speaker only represents himself. As soon as the speaker walks through the corporate doorway and becomes a member of the corporate body, he or she no longer represents himself. As a representative of the corporation or institution, the speaker must adhere to the rules of the corporation.

This is why, we, members of AO, can bandy words and ideas around, speak out artfully and such. We have a certain level of anonymity which separates us from our corporate or institutional identities, and we can speak freely without fear of recrimination, prosecution or persecution. So, here, we only represent ourselves and this is one of the great venues where we have true freedom of speech.

"Its very sad that @stake fired him for this," said Bruce Schneier, a report co-author and founder of Cupertino, Calif., security consultancy Counterpane Internet Security Inc. "We as security researchers regularly speak, write and do reports that express our professional opinions. We assume that companies hire us for our integrity and honesty."

Altthough I agree with catch in some respects about his responsibility to his clients and employers, this was an independent study and I think @Stake acted a bit hastily and are going to garner nothing but bad PR from this, but that again is part of the corporate game, you win some, you loose some, that goes for everyone involved.

-Maestr0


http://www.computerworld.com/softwar...,85441,00.html

Quote:

---

Whether you agree with his statements or not has no bearing on the fact that, yes, the company was well within their rights to fire him--assuming that the events are as represented. This has nothing to do with freedom of speech. Freedom of speech, as applied in the United States, is an individual freedom and applies so long as the speaker only represents himself. As soon as the speaker walks through the corporate doorway and becomes a member of the corporate body, he or she no longer represents himself. As a representative of the corporation or institution, the speaker must adhere to the rules of the corporation.

---

rapier57 am not saying that Mr. Geer was within his rights for saying what was printed by the media. What am saying is that there may be more to the story. As you said Mr. Geer was a CTO and he should have know better and that kind of struck me. It's not entirely impossible that the media misrepresented Mr. Geer and @Steak didn't take that into consideration or maybe they did but we don't know that or at least I don't know that. So if Mr. Geer was misrepresented then there is a chance for a full blown lawsuit for negligence on the part of @Stake, since they should have found out exactly what Mr. Geer meant and said before firing him, assuming they didn't do that of course.

That's the direction I was looking at the issue from since it occurs mostly every time something like this comes up. Companies fire individuals on the spot without looking into the issue first. Lets hope @Stake didn't fall into that trap.

Guidance...

Like I said: assuming that events are as represented.

You never know about these things. Yes, I've been on the journalist side of the fence, too. As a one-time ME, I know how messed up an aggresive, not-too-careful reporter can get with a story.

I think the point that most of you are missing here is that this paper was written as INDEPENDENT RESEARCH. He was not promoting this paper as if it were @Stake's opinion, just writing a paper about the security field and one of the problems he saw in it. In fact, @Stake is only mentioned in two places - the authors list and the biographies.

If I ever write a paper on security vulnerabilities or write some test code in my spare time, it's my own business and no one would give me any grief. My employers have no control over what I do with my spare time, nor do they have any influence over the opinions I express when I'm not at work. Why is it suddenly different if a CTO does the same thing? Did @Stake own Mr. Geer's free time? I think not. So what possible grounds could they have for firing him for research he performed during his free time?

Quote:

---

I think the point that most of you are missing here is that this paper was written as INDEPENDENT RESEARCH. He was not promoting this paper as if it were @Stake's opinion, just writing a paper about the security field and one of the problems he saw in it. In fact, @Stake is only mentioned in two places - the authors list and the biographies.

If I ever write a paper on security vulnerabilities or write some test code in my spare time, it's my own business and no one would give me any grief. My employers have no control over what I do with my spare time, nor do they have any influence over the opinions I express when I'm not at work. Why is it suddenly different if a CTO does the same thing? Did @Stake own Mr. Geer's free time? I think not. So what possible grounds could they have for firing him for research he performed during his free time?

---

I think you are missing the point that:

He is an officer of the company, he is never off duty. His every action reflects back on the company, that is why he makes the big bucks. The difference between normal employees and officers is that officers have the ability to legally speak for the company as a whole.

If you worked for a security product company and went off abd did your own security related development work in your spare time, watch how quickly your owrk sues you and wins if you take that product to market.

Mr.Geer wrote a paper that deals with the same material that he is paid for and he did so as an officer of @Steak, therefore his actions fall under the jurisdiction of @Steak.

catch

PS. If I released a trusted operating system or a paper bashing trusted operating systems in my spare time, it'd make my head spin at how fast I was fired and or sued.

Hi Folks,

This is a very interesting thread :) I have to go along with catch, that the guy was an "officer" of the company; so if he said anything that identified himself and/or his connection to that company (which he did) he probably violated his terms and conditions of employment.

OK here is my new contribution: suppose the guy wanted to leave/retire or whatever, and his company were prepared to let him go and pay him a bonus?

He would have to pay tax?...................if they fire him then pay "compensation" he does NOT have to pay tax?, but the payment is fully tax deductible for the company.

I suspect that this goes deeper than a "gray lady" and is rigged for silent running?

Any IRS types out there who would like to comment?

Cheers

There’s a number of possibilities here.

First: Mr Geer and associates wanted to make their findings known to the public to protect the world from harm

Second: Mr Geer was dupped by @stakes rival in order for @stake to be seen for their true nature…an MS suck-ass and of course loose respect and business.

Third: Mr Geer conspired with the rival corporation. That is telling the truth for financial gain to discredit @Stake. Lets face it this does shine a dim light on @Stake at least in my book. I mean who would want to hire someone that’s going to help MS cover up it’s insecurity. Their rival, Counterpane Internet Security doesn’t!

The list can be as long as our imaginations. I was just surprised in thinking @Stake really cared about security. (silly me) Looks like there’s some truth in phrack62’s statements

Nice one ! Tedob1,

"I think that there's something fishy going on"?

I am sure this is deeper than it looks

Cheers