Foundstone Shoe On Other Foot

Cimmer writes "One of the premier hack shops (to pun or not to pun) gets busted for unethically ethically hacking. After filing a lawsuit against former employee JD Glaser for supposedly jacking company source code, Foundstone gets nailed for massive internal software piracy. Tonight's entree: Foot in Mouth."

Comments

Unethically ethically hacking?

[jkauzlar]

From the article, it sounds like Kurtz needs a good kick in the butt.

Re:Unethically ethically hacking?

[Rick Zeman]

From the article, it sounds like Kurtz needs a good kick in the butt.

Colnel Kurtz, you mean?

Re:Unethically ethically hacking?

[secolactico]

Colnel Kurtz, you mean?

The horror! You beat me to it! Lets see who else... Scott! Yes! Scott Kurtz needs a good kick in the butt.

Re:Unethically ethically hacking?

[weeboo0104]

From the article, it sounds like Kurtz needs a good kick in the butt.

Don't you mean he needs to be terminated with extreme prejudice?

Uneasy truce: white hats and their employers

[mao che minh]

You have to love it when law and politics gets their claws into the ever-shady business of white hat hacking. These types of cases hit the news every once in a while. I suppose that such risks are part of the game, but what would I know? Up until last month I thought that hacking was a lot like flying through a wire-frame cityscape.

I once worked with a terrific cracker (he ended up doing time for hacking into NASA owned systems at the University of Florida - in fact, I believe that he is still incarcerated). He really knew his shit, especially when it came to invisibly manipulating Cisco equipment and covering his tracks in Unix/Linux/BSD logs. He was also somewhat of a coder. He was kind of scary in a way. It was funny to see how much the entire operation of the IT department changed once we found out how good we really was, and how much the manager started reviewing technology laws. He was on our side, our white hat, and still everyone was immensely wary of him.

Even though he effortlessly secured three large networks and found glaring problems with our state-wide backbone, he was canned out of fear. He was later found guilty of causing damages to the network after his termination, at the same time he was busted for the NASA fiasco (the FBI had been watching his movements for some time). In hindsight, I can say that our cautious approach towards him was warranted, even though it caused him obvious grief when he was employed with us.

Hell, he will be making twice my salary at McAfee or something when he gets out of prison anyways, why am I feeling bad for him?

Re:Uneasy truce: white hats and their employers

[.@.]

(he ended up doing time for hacking into NASA owned systems at the University of Florida - in fact, I believe that he is still incarcerated).

He really knew his shit, especially when it came to invisibly manipulating Cisco equipment and covering his tracks in Unix/Linux/BSD logs.

I fail to see how "he is still incarcerated" supports the claim "really knew his shit." One might almost think that, if he really knew his shit, there would be no incarceration to mention.

Re:Uneasy truce: white hats and their employers

[packeteer]

Most hackers who can cover their tracks get caught in a less technical way. Just becuase your a good cracker doesn't mean your a good criminal. There is much more to commiting a crime then the actual execution. Most criminals plan up to and including their crime but rarely what they will do afterwards.

Re:Uneasy truce: white hats and their employers

[/dev/trash]

First you say this:
He really knew his shit, especially when it came to invisibly manipulating Cisco equipment and covering his tracks in Unix/Linux/BSD logs.

Then you say:
the FBI had been watching his movements for some time

Sounds like a lot of hype to me. I am sure he knew stuff, but no one's so good they never get caught.

Re:Uneasy truce: white hats and their employers

[alakon]

irony perhaps?

Re:Uneasy truce: white hats and their employers

[Anonymous Coward]

I am sure he knew stuff, but no one's so good they never get caught.

That's no true, so far they haven't caught me.

*knock knock*

Aw crap.

Re:Uneasy truce: white hats and their employers

[Anonymous Coward]

> *knock knock*

Hired goons!

Re:Uneasy truce: white hats and their employers

[packeteer]

Police knock three times. Goons knock twice and harder usually, it seems more menacing.

Re:Uneasy truce: white hats and their employers

[cretin999]

Then you say:
the FBI had been watching his movements for some time

Sounds like a lot of hype to me. I am sure he knew stuff, but no one's so good they never get caught.

DB Cooper?

Re:Uneasy truce: white hats and their employers

[Anonymous Coward]

What, you mean like brag about their exploits? That's pretty typical criminal stupidity.

Re:Uneasy truce: white hats and their employers

[droid_rage]

Sorry, man. Anybody cracking into systems without first gaining express permission of the owner, especially with the intent of causing damage is by definition NOT a white hat. In fact, had he been a real white hat, there would have been nothing to fear from him.

Re:Uneasy truce: white hats and their employers

[/dev/trash]

In my world being killed after jumping out of a plane is the same as being caught.

Re:Uneasy truce: white hats and their employers

[pdwalker]

>I once worked with a terrific cracker (he ended up doing time for hacking into NASA owned systems at the University of Florida - in fact, I believe that he is still incarcerated).

He OBVIOUSLY wasn't good enough, or am I missing something?

Re:Uneasy truce: white hats and their employers

[Anonymous Coward]

YOu sig is kinda funny ina juvenile way but when u actually learn about unix youll find its umount, not unmount.

Re:What the fuck

[Anonymous Coward]

It's like "jumbo shrimp" or "military intelligence."

A Credibility Nightmare

[ThomasFlip]

This is like a firefighter getting busted for arsen, it just doesn't look good.

Re:A Credibility Nightmare

[Snoopy77]

I don't know what arsen is, but if it has got anything to do with the goatse dude then yes .... not very pretty indeed.

Re:A Credibility Nightmare

[Anonymous Coward]

I believe that's spelled "arse-ing."

Re:A Credibility Nightmare

[Anonymous Coward]

You're a moren.

Re:A Credibility Nightmare

[Zrealm]

The person who did fire safety inspections for my fraternity up until 2 or 3 years ago is currently serving time for that.

Re:A Credibility Nightmare

[Anonymous Coward]

what? he busted your arsen?

Corporate piracy is evil

[Graspee_Leemoor]

Corporations who use one legal copy of software to install on all their company machines are doing damage to open-source.

Think about it: If it were impossible for them to just rip-off Windows, Outlook, Office, Ultraedit etc. they would use Linux, Evolution, OpenOffice, Scite/emacs/vi/whatever, since they obviously don't want to spend any money on software.

graspee

Re:Corporate piracy is evil

[mako]

Maybe but remember this is a special situation. A security company researching vulnerabilities must have at their disposal a huge quantity of software. Not just the stuff that they personally like to use, but, the stuff everyone else uses. Of course a researcher also often needs multiple versions of the same product. Therefore, it does not surprise me that such a company would commit copyright infringement in order to get some piece of software they will only use for a short time while testing something.

I was wondering when this issue would raise its ugly head. After all how many amateur bug finders have the bucks to properly license all of the software they test. It seems natural to me that large companies seeking retribution against a leaked 0-day might investigate such a thing.

Re:Corporate piracy is evil

[Graspee_Leemoor]

"A security company researching vulnerabilities must have at their disposal a huge quantity of software."

Which they can buy with the huge quantity of money they get from clients.

"...it does not surprise me that such a company would commit copyright infringement in order to get some piece of software they will only use for a short time while testing something."

If they are testing it for a client they can factor the price of the software into the price they charge the client. If they are just researching it to advance the state of knowledge in the company then they can buy it from company funds.

"After all how many amateur bug finders have the bucks to properly license all of the software they test"

These are not amateur bug finders though, they are a "professional" company.

The bottom line is that nearly every business will do everything they can to maximise PROFIT, even if it means limiting the ability of other people to do the same.

Remember the 169th rule of acquisition:

"Competition and fair play are mutually exclusive.".

graspee

Re:Corporate piracy is evil

[swb]

Even the most rigid places are willing to bend the rules for licensing when it comes to testing.

Sometimes its entirely legitimate -- building a new box for some CAD guy; he can't stop working on the application while the box is built and tested, and we can't get the box built and tested without the license. The same has to be true in a zillion different production hardware swapouts. The old box is wiped when the swap is completed, so there's no production use of two copies (although one place I worked had a circular buffer about 90 days long for old hardware, and the old box sat untouched during the days until it got reused, just in case something was missed).

Sometimes its somewhat less legitimate, like the support guy that has a whole suite of applications installed on his every day machine so that he can try to replicate problems from the people that make production use of it. They're not installed/uninstalled/reinstalled to test each problem, since that would take hours, but since they're not used to actually do production work, no one interprets the licensing rules to say that the copies are illegitimate.

I call that one somewhat less legitimate than the first, which is a legitimate chicken-and-egg problem, because the apps are staying resident on the machine, usable. I personally think it's a fair exception to make, since that test suite of applications aren't making anyone money from their use, and the total usage of a couple of hours per month in a 'test' mode would never pass the finance people's justification for the $10k it would take to buy them.

And then there's the "backup server" that doesn't even get turned on but to sync configs with the production box once in a while or as a total drop-in replacement when the production server stops being usable.

I'm sure there's 1001 variations on these kinds of rule-bending, but I've never worked someplace so inflexible that they required new licensing (or at least a 10+ copy slack) to cover legitimate IT maintenance issues. If the SPA nazis aren't going to give us some slack, how can we make their applications usable?

Re:Corporate piracy is evil

[mako]

If they are testing it for a client they can factor the price of the software into the price they charge the client. If they are just researching it to advance the state of knowledge in the company then they can buy it from company funds.

I agree. I wasn't paticularly defending Foundstone just commenting on copyright infringement which is a problem I suspect is endemic in the field of security research.

These are not amateur bug finders though, they are a "professional" company.

Of course, but, I suspect there will be various pots and kettles having a go at Foundstone for this. Although they are a member of OIS so they probably deserve it.

Re:Corporate piracy is evil

[PetoskeyGuy]

OK, so what's your take on DRM?

I picture the ultimate goal of DRM to be computers like Nintendo boxes. Buy software cartridges plug them in and use your limited controls to get stuff done. Hardware to copy and interact is extremely controlled, complex and/or expensive so that most people will just buy the software instead of get the rom readers, burners, etc to copy a cartridge. Sure rich geeks like us may be "free" to do it, but it will be very illegal if it isn't already.

Lets say we do make computers so that it is impossible to rip-off software vendors.

Will Open Source software still exist in such a system, or will we be unable to use even that? Look at how hard it is to hack the X-Box and that's just their first try at such a system.

The US was founded on Seperation of Church and State, maybe the next time around it will be seperation of Business and State.

Re:Corporate piracy is evil

[Graspee_Leemoor]

You make interesting points about the grey edges of piracy, but you have to think about why the "support guy" in your 2nd paragraph needs to try to replicate problems from the people who make "production use" of the software.

If the support guy works for the company that created the software, no problem. If he doesn't, then you have to wonder what he can do about a problem he finds, since he hasn't got the source code.

"Oh, the software XYZ crashes when I click this certain widget."

Hmmm, click, click, press, twiddle.

"It seems you're right, XYZ does indeed crash when you do that. I advise you not to click that widget."

graspee

Re:Corporate piracy is evil

[Graspee_Leemoor]

" OK, so what's your take on DRM?"

I think DRM for software would be fantastic. I'm all for it- bring it on.

Once little Johnny next door and big Johnny business realize it's pay for Windows or use linux/*BSD/cowboynealOS/"I don't use an OS, you insensitive clod" then we will see the collapse of Microsoft mindshare and the wide-scale adoption of open-source.

Unfortunately at the moment the Johnnies of this world probably think that Linux costs money because there is a price tag on that "SuSe Linux Professional" box in the local book[shop|store].

I will be even happier when people stop using software like Ultraedit, the God-fearing author of which seemed genuinally suprised a few years' back when I told him that free software existed that had features he hadn't added to Ultraedit yet (in this case it was regexp searching).

I am of course against DRM for computers if it means that it will be made harder to write your own programs which it would be if we imagine computers being like X boxes. In this scenario it would be also hard to tinker with mods for games and so forth.

So, to answer your question, yes, I am completely for a sort of DRM for computer software which would make it next to impossible to copy the software of vendors who didn't want you to copy it, BUT ONLY if the implementation of this DRM did not intefere with our ability to write open-source software and similar activities.

I am almost sure that the future will bring us DRM for software (amongst other things), and I am afraid that it will probably remove the ability to do other, legal things, but I am unsure that anything I do or say will make a difference.

Geek apathy and geek depression.

Brought to you tonight by copious amounts of geek b33r.

graspee

Re:Corporate piracy is evil

[lonesome phreak]

I've worked in tier 1 support for a large (15,000+ employee) company. The reason you need the software isn't because of things like that. It's because the user usually does something stupid, but usually not to the point of crashing. Just to the point of messing it up beyond their ability to fix, but not yours. That's when they call you.

Re:Corporate piracy is evil

[AEton]

If the SPA nazis aren't going to give us some slack, how can we make their applications usable?

Buy as many copies as the EULA says you have to for the number of computers you install the software on. What? The software costs too much? Well, that's because of piracy. Why do they pirate it? Because it costs too much? They're obviously only driving up prices for the rest of us, the bastards.

Oh, and that 'free software' (or basically that whole '*nix' thing)? Communism.

Re:Corporate piracy is evil

[Blackknight]

You buy however many copies you need for each system, including test systems.

If you don't like their rules, don't use their products.

Re:Corporate piracy is evil

[shepd]

98% of support calls go like this:

User: "I want to print 10,000 mailing labels. What do I do?"
Me: "Use mail merge."
User: "What's that?"
Me: "Click this, then click that, then click, click, etc, etc"

And that's why I re-imaged any machine I found that wasn't company spec (ie: was infected with idiotware, like BonziBuddy or WebShots). I don't have time to sit there and guide you through menus and systems customized to your personal use. If you don't like the corporate standard, don't phone support.

Sorry, I guess I'm just a little grumpy.

Re:Corporate piracy is evil

[Chatterton]

A security company researching vulnerabilities must have at their disposal a huge quantity of software." Which they can buy with the huge quantity of money they get from clients.

Well, try to buy Office 4.3 in a way that Microsoft or the BSA accept it. You can't buy it second hand (the EULA say you can't sell it or transfert your right to use it), and Microsoft don't sell it anymore.

Re:Corporate piracy is evil

[Anonymous Coward]

A security company researching vulnerabilities must have at their disposal a huge quantity of software. Not just the stuff that they personally like to use, but, the stuff everyone else uses. Of course a researcher also often needs multiple versions of the same product. Therefore, it does not surprise me that such a company would commit copyright infringement in order to get some piece of software they will only use for a short time while testing something.

I don't buy the argument that because you need all this software that you should pirate it.

Let's look at Microsoft's software in particular. [Disclaimer, I have absolutely no love for Microsoft at all. In fact, quite the contrary.]

A developer, especially a Microsoft Certified Solution Provider, or through other partner programs, can get boatloads of Microsoft software for internal testing and development. This does not allow you to use the software, just to develop and test with it. Understand the difference?

My workstation runs, say, Win XP Pro. We have to pay for that. But I also perform tests on many other MS OS's, with differing service packs, patches, etc. Those are paid for with a reasonably priced (in the couple thousand dollar range) subscription. This gets you development tools. OSes. Office. Etc. I can't use this office as a "productivity tool", but I can use it to make my products compatible, test integration, test scripting, etc., etc. I can set up an ad hoc Exchange server, and play with it. Etc.

Every month Microsoft sends a whole new pile of CD's in a box. All the latest crap from Microsoft.

Re:Corporate piracy is evil

[poot_rootbeer]

Well, try to buy Office 4.3 in a way that Microsoft or the BSA accept it.

There's about a dozen shrinkwrapped copies on eBay right now. BuyItNow prices under $10. There may or may not be license issues with these, but it's sure a lot closer to legal than leeching an ISO from Kazaa...

Or better yet, I guarantee that Microsoft offers support contracts that give access to all previous versions of all MS software products, EXPRESSLY for the purpose of testing.

Re:Corporate piracy is evil

[Frizzle Fry]

Once little Johnny next door and big Johnny business realize it's pay for Windows or use linux/*BSD/cowboynealOS/"I don't use an OS, you insensitive clod" then we will see the collapse of Microsoft mindshare and the wide-scale adoption of open-source.

Things won't work out this nicely when there are laws (in the US at least) requiring DRM, and making much free software "illegal".

Re:Corporate piracy is evil

[MountainBoiler]

So your personal car in the company lot isn't being used at the moment. I don't have a license to drive your car, but I want to test the roads in the hills. Since it will be returned before you need it, I am not depriving you of your car. Sure, I may wear your tires down some, but I will now sell a service describing the best roads in the area.

Commercial companies that sell a package or service built upon using another company's product should purchase the rights for the product's use. It doesn't matter if it is "rarely used". Maybe you can get a different license for it then (at a discount?). Most support contracts make obscene amounts of money for little cost.

This is much different than people copying stuff for their personal use. Consumers aren't making a buck off of it.

Re:Corporate piracy is evil

[swb]

Physical object analogies don't hold here, so I can't respond to this, plus we're not talking about anyone's personal posessions either.

And the "testing" copies aren't used for doing production work. The scenerio is usually like this:

User: When I'm using X, Y, and Z and I choose the "Make Widgets" command in X, I get an error that says "Can't Make Widgets, PixieWings are in use."

IT: We replicate their scenerio, opening X, Y, and Z applications and hope to get the same error. When we do, we figure out that Z has the PixieWings locked. Quit Z, they unlock, and you can Make Widgets again.

At no point does the IT use of the apps for testing actually do anything productive other than enable the *real* licensed user to actually make the applications work. No work for hire is performed on them whatsoever.

So much for food

[BrynM]

While picking out pieces of fur-embedded squirrel meat from the treads

There I was thinking "I'll sit down, eat dinner and read some slashdot". So much for that appetite now... My dog enjoyed the burger though. I love writers that create imagery.

Re:So much for food

[rusty0101]

at least it's good for the diet.

-Rusty

P.S. I know people who say "I won't eat anything that has a face.", but I watch Farscape and Star Trek, that leaves out both plants and minerals.

Re:So much for food

[PetoskeyGuy]

Yeah, why have a burger when squirrels are plentiful and fresh. Takes 3 of them to fill you up though, and they are kind of greasy.

Re:So much for food

[Chemical]

Maybe my imagination just sucks from too much TV, but verbal imagery never seems to affect my appetite. I was told that after reading Upton Sinclair's The Jungle I would never want to eat meat again, but as the book vividly described the unsanitary factory conditions, the diseased meat being passed by inspectors, the rancid smell of dead flesh, humans being made into lard after falling into the rendering machine, fingers and rats and whatnot being ground into sausages... all I could think is, "Damn! I really want a cheeseburger right about now."

You know, roast squirrel sounds really good right now.

Re:So much for food

[phorm]

I think that years of trying to maintain my frag ratio (with gibs flying everywhere), while simulataneously chomping on a cheeseburger or whatever, has permanently fixed my ability to digest food. Come on, like you've never been chewing on a stick of beef jerky whilst simultaneously mousemoving and pumping the railgun trigger - to watch as enemy kibbles and perhaps a head or two come flying past.

However, those goatse links usually still do fairly poorly for my appetite. It's annoying that the little buggers are finding better ways to disguise them

Re:So much for food

[Anonymous Coward]

Come on, like you've never been chewing on a stick of beef jerky whilst simultaneously mousemoving and pumping the railgun trigger

Um, no, because some of us are not disgusting fatasses who go to LAN parties and enjoy "fragging".

Winzip

[Anonymous Coward]

How many of you run Winzip without a valid license?

Re:Winzip

[exspecto]

Why in the world would you use winzip when you can get powerarchiver (version 6) for free? I never understood people who use such a lame shareware program.

Re:Winzip

[codepunk]

hmmm, I usually just type zip in my bash shell and it is just there? I guess, no I don't have a license for Winzip.

Re:Winzip

[Anonymous Coward]

Not I, I run Filzip instead. Just as good and free.

Re:Winzip

[jmauro]

Please clarify. Do you mean running it in evaluation mode all the time, or actually getting an illegal license somewhere?

Re:Winzip

[SCHecklerX]

When I have to use a windoze box, I use zipcentral. There is good free software out there for windoze (putty, anyone?), if you care to look.

Re:Winzip

[eggstasy]

Why would anyone use that crappy winzip program when there are so much better ones like WinRAR that are able to compress a lot better and are fully compatible with zip and most other compression formats?
I havent had a copy of winzip since the glorious days of windows 3.1, and even then I converted everything to RAR, which I've been using since 1994.
Of course, there are even better programs than RAR in terms of raw compression, but I'm a rabid RAR zealot :^)

Re:Winzip

[exspecto]

What amazes me is that after I show people the completely free (as in beer) alternative to WinZip, most often they would rather click "I agree" or get a serial instead. I just shake my head.

Re:Winzip

[exspecto]

Correction: alternativeS

Re:Winzip

[Jaysyn]

I used to (well WinACE), then I found this.

Jaysyn

Re:Winzip

[Mac Degger]

Apparently, WinACE has better compression, but winrar is faster.

Re:Winzip

[jpetts]

but I'm a rabid RAR zealot :^)

Rar! Rar! Rar!

Re:Winzip

[Oloryn]

How many of you run Winzip without a valid license?

Not here. The Info-Zip Zip, Unzip, and Wiz utilities are perfectly usable, and free, so there's no reason to pirate WinZip.

Re:Winzip

[Anonymous Coward]

Of course, there are even better programs than RAR in terms of raw compression, but I'm a rabid RAR zealot :^)

You're a rapid zealot over a file compression program? I think that's the lamest thing I've ever heard.

Re:Winzip

[Anonymous Coward]

Why would I do that when I can run WinRAR without a valid license instead?

Re:Winzip

[iankerickson]

Why bother? Info-zip and WiZ are just as good, as well as being free software. It's also ported to more platforms (more than most other programs).

Re:Winzip

[Suppafly]

why do that, when you can use jzip for free and it's almost an exact clone of winzip.

Re:Winzip

[Anonymous Coward]

Not me. 100% of the software on my computer is properly licensed and paid for.

That's another thing I like about using Linux.

Re:Winzip

[NewbieProgrammerMan]

Believe it or not I paid for my copy here at home. I guess that makes me a chump in a lot of people's minds; I just thought it was fair since I used it a lot.

Odd that my former employer - one of the biggest companies in the world - didn't have money to spare for a single license for our office. Never mind that it was installed on probably 50 computers, each of which had a properly licensed copy of WinNT or Win2000. It seemed to me that they only worried about proper licensing when it involved companies that stood a chance of giving them grief, and to hell with everyone else.

Re:Winzip

[Anonymous Coward]

If I may inject a little reality...I've led more than one development team where everyone on the team (except me!) used winzip. Yep, lusers, lamers, call 'em what you want.

The reality is that these are not High-Tech Geeks headed down the path of truth and light, these are just "geeks". And they were developers! Their career goals are to survive. They aren't dazzled by trying out software, or (bog forbid) *paying* for it.

Part of the reason was apathy - the company, it seems, provided them with boxen that had the unlicensed version of winzip on it (I won't go there!).

I did manage to introduce VIM to such teams, but if my conversion rate is more than 12.5% in such circumstances I am usually happy (yes, the rest used an unlicensed/eval copy of some slick-, ultra-, cool-, edit program that was pure windows, lots of mousing around. Harrumph.).

30

Re:Winzip

[Repton]

Have a look at the Archive Comparison Test page. WinACE does better than RAR in some areas, but not in all. And neither of them are the absolute best (in terms of compressed file size) at anything.

Re:Winzip

[6hill]

Fortunately Mac OS X comes with gzip pre-installed, but for those moment when I insist on a GUI, I use StuffIt, just for the puerile name it got saddled with. StuffIt (WinZip) where the sun don't shine...

Re:Winzip

[DragonMagic]

http://www.7-zip.org/

Why use WinZip when 7-Zip is a much better program, and valid licenses are always included. [LGPL]

Re:Winzip

[Maserati]

I am so not downloading an .exe from a slashdot posting.

Re:Winzip

[Anonymous Coward]

So if RAR is so fucking superior, why does it take so fuckin long to open an archive with several thousand files in it and zip does it in an instant?

Re:Winzip

[1u3hr]

I mostly use FAR from RARlab, which is a Norton Commander clone for Win32, with archive support built in (virtual file system). Just get the free commandline pkzip.exe and there you go. (Midnight Commander, for *,ix and Windows, is in the same vein, slightly less slick.)

If you just need to expand archives, Aladdin Expander is very nice, and does Mac formats like sit and hqx as well as most PC and Unix ones.

Re:Winzip

[1u3hr]

I am so not downloading an .exe from a slashdot posting.

If you prefer, get it from oldversion.com.

Re:Winzip

[FauxReal]

I switched to running Winrar without a liscense long ago.

Re:Winzip

[Anonymous Coward]

gzip is an entirely different kind of program, it's only useful for single files or to create archives together with tar/pax/cpio etc.

Note that MacOS X also includes zip/unzip, bzip2 and everything else you are likely to need for handling archives in the common formats used in the Mac and Unix worlds.

Re:Winzip

[Lord_Rion]

I finally decided to get a LIC last year. I figure that I make enough money now that I should give something back to the people who wrote the software I've been using for years. Not to mention I couldn't really hide behind the "I'm just a poor student" mantra any more.

Re:Winzip

[Anonymous Coward]

prolly cause ur on a 486

let's try this again

[joe_bruin]

so wait, i'm confused.
we're all happy now that they got busted for piracy(?). they deserve it because they sued some dude who stole their code. but the author says "supposedly" in reference to "jacking company source code". is he implying that no theft occured, and therefore these guys were suing for no reason, and that's why we're on the side of the BSA for today? or are we just taking a stance against software piracy? or does what go around come around?
what does "unethically ethically hacking" mean, anyway? were they white hat hackers using pirated software? and where does the pun on "premier hack shops" come in? they're "hackers" (in the bad sense of the word, even if they did whitehat work) and the story involves "hacking". no wait, it involves software piracy. perhaps they were hacking using a pirated version of adobe premier. i'm not sure how that would work, but then the pun would make sense.
but then, who's foot is in who's mouth? i think it's foundstone. but i haven't seen them say anything that was proven embarrasing as to gain the "foot in mouth" designation. maybe i haven't been following the saga of this company, but the context of the post certainly does not imply any foot-in-mouth action going on.

anyone???

Re:let's try this again

[anagama]

The pun: "premier hack shop"

Think of "hack" as in "poor skills" such as in "doing a hack job". Related to "hack" meaning to cut or chop inartfully, perhaps to "hack" relating to work horses (as opposed to race horses for example). All these senses of "hack" imply characteristics such as: unskilled, common, or base.

So the phrase could mean:
They are excellent at hacking
OR, they are excelently average.

Oh yeah, and let's not forget that autoshops which break down stolen cars to sell as parts, are called "hack shops" .... I think at least. Lot's of puns in this one!

Re:let's try this again

[lonesome phreak]

It's because it's a "hacker company", and it really hurts the rep of many other companies. It's taken alot to gain the trust of corp world for these type of companies, and they just screwed that all up.

I'm glad none of the I work with read this, because it would just confirm their fears. It doesn't matter that my company isn't that way, nor ever mentions anything like that. It's that they still feel anyone doing security must be a theif (to know all that about it).

Re:let's try this again

[LilMikey]

In summary:

Stealing = bad
Sticking it to the Man = good
Sticking it to the Man by stealing = Karma: Neutral

great explanation

[SHEENmaster]

of the "Microsoft profits from piracy." idea. Another facet of this is that many of these companies get caught and are forced to pay up.

A rival computer store in my town has been peddling the same Windows XP key for an entire year. This hurts the business of legitimate sellers who can't compete with the price as well, and it hurts Microsoft's goal of making several hundred dollars from every desktop computer in America. Now I don't know what to believe...

Re:great explanation

[Anonymous Coward]

The same key? Won't someone eventually activate it and make it useless for everyone else?

Re:great explanation

[Anonymous Coward]

Not if it's one of those enterprise/activationless keys

Re:great explanation

[SwissCheese]

Not if it's a corporate key, which doesn't call home to be activated.

seems pretty one-sided..

[Anonymous Coward]

so what did foundstone have to say? the article doesnt even say they tried to get their side. seems like jd was trying to take the heat off his lawsuit buy working the software piracy angle.

like all of us here register winzip? riiiiight.

Re:seems pretty one-sided..

[Anonymous Coward]

I wonder when JD became such a big shot that he could make Fortune write exactly whatever he wants.

Also, there is a diff between a few unlicensed pieces of software and having complete servers (Zeus) setup to house the collection of unlicensed software and the codes for them.

There is a fine line between

[johnstein]

prudence and suicidal lemmings (or according to the article, misguided squirrels)

What's worse, giving away the security tool would actually endanger National Security, McClure insisted. "The public would be armed by the potential for misuses of these technologies by hackers and cyberterrorists."

without reiterating the many articles here on /., I agree that a certain amount of prudence is needed to keep our world "safe and secure from those pesky hackers and virtual terrorists, etc" but come on, there are so many more critical things to worry about.

and besides, the claim by foundstone that "it was 'simply impossible' to create such a toolkit in that timeframe", doesn't necessarily mean that it couldn't be done.

I hate even wasting keystrokes on this, but when I read the article, I couldn't help but imagine some corporate bigwig nearly in tears, throwing a tantrum about not getting his way... and when he (McClure) pulled the ole 'terrorist' card, it sealed my opinion. ( woo hoo, like my opinion is worth anything ;) )

I don't know who is in the clear here, but the whole situation stinks. and I fear it's just going to get worse. oh, and the kicker (IMO),
No actual evidence was presented, but McClure's arguments were enough for the judge in the case to issue a retraining order blocking Glaser and NTO from releasing Fire and Water.

perhaps this was prudent, but these days I wouldn't put any money on it. Anymore, I am inclined to believe that there are tons of lemmings/squirrels out there who are determined to try to screw up any little bit of the world which can possibly be screwed up. Although I sound rather pessimistic, I think we will get through this in relatively decent shape, but the road to get there is sure to be bumpy ride.

-John

Re:There is a fine line between

[BrynM]

Unfortunately, the more people that pull the "Terrorist" card for an excuse, the less is will be listened to when it's real. (pleae note, I'm not right wing or republican) So, when it's real, the media will demand to see the information anyway citing the other jerks who used it as a bluff (including many politicians). Ironically, they are slowly creating a potential threat to national security by watering down the occasional importance of the "terrorist" card.

By the way, are "terrorist" cards a method of divination? (thanks for the inspiration dude!)

I cannot stand it when this happens.

[BoomerSooner]

Nothing worse than a software company that steals software. How the hell can someone who steals the exact thing they are trying to sell look at themselves in the mirror. Oh yea, I forgot we still have Republicans.

Hypocrites are such a waste of space.

Re:I cannot stand it when this happens.

[Anonymous Coward]

The company I work for is a software house that produces a prominent trading package for stockbrokers.

We're out of compliance on at least the following items:
- Windows NT
- Windows 2000
- Office 97
- Office 2000
- Outlook
- Exceed
- Solaris 8

It's more common than you'd think.

Re:I cannot stand it when this happens.

[Anonymous Coward]

It wasn't the Republicans that took the White House furniture.

Re:I cannot stand it when this happens.

[Anonymous Coward]

Ok, how on earth is an obvious flamebait "Insightful"? Who the heck modded that up?

Incidentally, Kurtz is a Democrat.

You probably didn't even read the article. Come on.. admit it!

Re:I cannot stand it when this happens.

[Anonymous Coward]

"Hypocrites are such a waste of space. "

I agree wholeheartedly. Quit posting :P

Re:I cannot stand it when this happens.

[Anonymous Coward]

Hypocrites are such a waste of space.

And here's another waste of space:

d e mo cra ts

--Beme17

Re:I cannot stand it when this happens.

[Anonymous Coward]

Um, what company did you say you worked for? Um...

...they're not publicly traded, are they??????? :-)

Re:I cannot stand it when this happens.

[Andorion]

Funny? Hello, meta-moderation. It's called flamebait.

~Berj

I'm sorry to be the first one to say this, but...

[Gizzmonic]

"Squeeze Me Macaroni", by Mr. Bungle

I wanna lock Betty Crocker in the kitchen
And knock her upper during supper
Clutter up her butter gutter
Hostess Ding Dong wrapped an eggroll around my wong
While Dolly Madison proceded to ping my pong
Your Milky Way is M'n'M in your britches
And I'll tell you Baby Ruth it looks mighty delicious
Keep blowing my gum, cuz here I come
I'm gonna get you all sticky with my Bubble Yum

Knick knack paddywhack and give your dog a bone, baby

I was givin' some head to some french bread
It was a four course orgy on the spread of my bed
French kissin' french fries in my Fruit of the Looms
I get deeper penetration with a fork and a spoon

I got yogurt meat loaf smeared all over my ass
I stick my weiner in two buns and and then give it the gas
Sour cream from my spleen into Levi jeans
Gonna bust the seams with my refried beans

Ronald McDonald just loves to be fondled
With Big Mac he'll fuck it like a Chicken McNugget
Colonel Sanders wants to goose Granny's loose caboose
He's gonna give her a boost with that Kentucky fried juice
Sooper doop poop scoop, loop de loop, chicken coop
Shoot some hoop, top sirloin from the groin
Topped with dick cheese, sneeze, wheeze,
From the skeez disease, wooi!

Take a dump, baby, squirt some gravy
Pour some sugar on me, honey, make it brown & runny
Give a little Flavor Flav, back from the grave
Gonna burn some toast, pump some humpin' rump roast

Knick knack paddywhack, jump in the sack, in fact
Jerk the smack and crack Jack from the back
Bananarama or ramabanana
Fuckin' Barry Manilow on the Copa Cabana

Squeeze me macaroni, slop your face with my bologna

You gotta syphon the spinach, you gotta cream the corn
Sperm scrambles the eggs and a meal is born
Cookin' like a beginner, but I'm goin' up in her
I had Fritos for lunch I'm havin' bush for dinner
Chef Boyardee and the Three Muskateers
Shove Charleston Chews in their rears like queers
"Holy moly, guacamole!" said my Chips Ahoy
I'm gonna pinch a ravioli on the Pillsbury dough boy

Knick knack paddywhack and give your dog a boner, baby

We came to pottie...we came to pottie down your throat

Quick summary

[Anonymous Brave Guy]

Read the damn links. Everything you mention is covered, clearly and pretty unambiguously, in the two fairly short articles cited.

In summary, though, lots of current and ex-employees of Foundstone are backing up claims that the guys at the top had wholesale software piracy going on in-house. This partly came to light as a result of going after another company, started by one former employee and now including several more, that developed a product in the same industry in a time that, according to Foundstone guys, wasn't possible without stealing their vitally important trade secrets. Except that they forgot to say what those secrets were, the other company's product was much smaller scale than the mainstream corporate offering from Foundstone, and most of the info is likely to have been freely available or at least widely known in the business, and not trade secret at all anyway. As a result of this lot, the judge who initially forbade the other company from shipping their product lifted that injunction a month or so later on the basis that there was basically nothing but someone from Foundstone's say-so that anything was wrong.

Now go read the articles, please.

weird a company with that much money

[tuluvas]

It is weird that a company with multi million's of dollars would pirate software. I wonder what they spent all those millions on? they should have spent the money on software, and saved there image, rahter than saving money, and losing chances at future assests, something im sure they have done if they truly pirated software.

Re:weird a company with that much money

[Anonymous Coward]

Look, people like to keep money around. Remember this point.

Re:weird a company with that much money

[tuluvas]

True people like to keep money, but it is just plain stupid to have that much pirated software. I like to keep money but you dont see me doing it. and im no even a corporation. remember that point.

Re: Gator?

[Anonymous Coward]

John, why did your webpage try to install Gator on my system?

Funny quote from the article...

[djupedal]

"In some ways the Foundstone tale is a microcosm of the ugly side of the dot-com craze--arrogance, greed, mismanagement, and stupidity."

The ugly side?

Spare me 'the pretty side'...I don't want to know...ok, ok..someone tell me about the pretty side of the dot-com craze... Jennifer, in accounting, perhaps? A pale yellow BMW M3 parked on the sand at Pismo Beach? A new pair of oversized Berkenstocks? A shiny new blade server with redundant power supplies and terrabytes of fiber laced storage? Corner office with a wet bar?

Re:Funny quote from the article...

[Anonymous Coward]

You really love your adjectives, don't you?

pale yellow, oversize, shiny new, fiber laced, corner

Great imagery

Re:C# Sourcecode for Slashdot Troll Bot!!!

[d3faultus3r]

C# good?!?! Well we won't have to worry about that trollbot.

Arrr I'm a pirate!

[Anonymous Coward]

Arr matey, you be a pirate too?

P.S. I can stand the use of the word "pirate" when it is referring to someone who is infringing on copyright laws. It just sounds stupid.

Re:Arrr I'm a pirate!

[exspecto]

I think Mr. AC meant to say "can't".

Redundant...

[dark-br]

they would use Linux, Evolution, OpenOffice, Scite/emacs/vi/whatever

But doesnÂt VI do all of those things Evolution, OO and above all "whatever" does? If itÂs not build in there *must* be a module somewhere :)

SCO Sues both...

[Anonymous Coward]

SCO is reportedly sueing both companies saying that it was their source to begin with!

J

Re:SCO Sues both...

[given]

hola, This is much better then a two. In fact, I vote all sco jokes get a +2, just for being sco jokes. but the point is valid, when did it become ok to not disclose exactly what you are talking about in a copy right case? I thought you had to specify what was actually stolen - right? put up or shut up is still the law, right? thanks davids

All Foundstone can say is......

[HighOrbit]

Doh!

winzip license

[Anonymous Coward]

this is one thing that is really curious about winzip.

apparently they make so much money that they don't give a rat's ass about piracy.

Unlike other companies that update new versions to crack down key-gen'd code, winzip reg codes from windows 3.0 days STILL works up to the latest and greatest.

for example, load a copy of winzip, and type in:

anonymous
3DAE1000

and you got yourself a "registered," nag-free winzip copy. I thought they'd have patched it up by now, as myself have been using that code for a good 10 years now, but, well, try it and see, i guess.

posting anon for obvious reasons.

Re:winzip license

[IvyMike]

• Anti-piracy method 1: Spend a lot of time and effort trying to keep ahead of the serial# spreaders and/or crackers, yet still fail pretty miserably, as every other program out there does. Only the honest people actually pay.
• Anti-piracy method 2: Sit back, drink a beer, don't give a rat's ass, and the honest people still pay.

Personally, I think WinZip's got the right idea.

Re:winzip license

[Anonymous Coward]

• Anti-piracy method 3: Profit!

No... wait...

Re:winzip license

[eastshores]

Congrats!! It is that line of thought, one based on reality, that indicates someone that will enjoy life. And before more people start foaming at the mouth.. I do mean to say you can enjoy life and not hurt others while doing it.

Re:winzip license

[Anonym0us Cow Herd]

Personally, I think WinZip's got the right idea.

Really? Wouldn't it be better to have a cumbersome intrusive activation scheme? Such a system should take a survey of all the software on your computer, search for any e-mail addresses on your computer, and send the results back home.

Finally, maybe PC's need to start including a biometric reader as standard equipment. It can go into the now-useless floppy drive slot.

It's a good thing....

[El Cubano]

It's a good thing that proprietary software companies don't fall prey to those lurking IP encumbrances that plague the Open Source world.

vi doesn't do modules like that

[SweetAndSourJesus]

You're thinking emacs.

You should be thinking Vim, though.

Re:vi doesn't do modules like that

[Anonymous Coward]

emacs...beautiful connundrum. Is it abloated, beaten and kludged text editor, or is it half-assed operating system?

Re:vi doesn't do modules like that

[EMDischarge]

Any app where you can Zippy the Pinhead to talk to a psychologist crosses the line into OS-hood for me...

Re:vi doesn't do modules like that

[Mysticalfruit]

Ah, you beat me to the punch.

I've got 4 monderation points left... too bad their isn't a "Uninformative" or "Totally ass backwards" moderation ;-)

Not Suprising

[j_kenpo]

Im actually very suprised at the reaction to this. How many of you have worked for small to mid-size IT related companies that havnt used unlicensed software of some sort. Its somewhat contradictory for a company to cry theft when they are thieves themselves, but then again as the old saying goes there is not honor among thieves. Ive worked for a few, and it doesnt suprise me one bit. Im not in shock or awe by this. And for a company that is one of the formost authorities on computer security to take part in cracking software isnt far fetched and is happening right now by other companies. If its for a proof of concept or for cheating the financial responsibilities. And as far as the accusation that they took the concept of the Extreme Hacking courses for their Ultimate Hacking courses, so what. How many smaller companies were founded by formers of other companies that applied their skills to do their own start-ups. This isnt ground breaking, its business as usual, even if it unethical. The only thing is since this article was pressed by Fortune, quite a bit of financial damage will be done to Foundstone, but thats the risk you take when you attack former employees when partaking in unethical practices.

Re:Not Suprising

[Zeriel]

*shrug* I don't know if it's as common as you think -- I work at a small (~20 employees) software company, and we're positively rabid about license compliance. Heck, we even have a WinZip site license.

Re:Not Suprising

[hoop33]

I've worked a few places, and most places have preached and practiced compliance. I've seen a little of the other, but corporations by and large "get it."

Individuals, OTOH, are rabid thieves. I walk in to work with my newly purchased SlickEdit CDs, and they ask to borrow them. I tell them to go back to their stolen copy of TextPad, and then hound them about licensing it or using something free like jEdit.

Assuming the accusations against FoundStone prove true, I say throw the book at 'em.

Re:Not Suprising

[Zeriel]

*grins* I know exactly what you mean.

Heck, even at this place I work, there are two decrees:

1. All company machines get audited internally at least every six months, and license issues are dealt with ASAP (same-day, even) ...however...
2. Anyone titled at "manager" or above is entitled to walk off with company-owned software, no questions asked and no license records kept.

Now, I don't really understand the hypocrisy involved here, but I wonder how common this sort of practice is--I'd imagine it's more common than poor license practices at work.

They're also allowed to bring in personal machines for me to get paid to troubleshoot on company time, but that's hardly relevant. =P

Two completely seperate issues here.

[evil_roy]

From the articles it would appear that Foundstone preach security and educate corporate clients & toughen their clients networks. This is done for all the valid security reasons, but is third party licensing protection part of this? No way - it is a different issue.

This is like saying that they haven't registered their cars - it is an issue,but not one that would affect their business or their abilities.

I would see some of the moronic management practices that are mentioned in the article as grounds for ceasing business with these clowns, but I cannot see why a client cares less if their consultants use legit licensed software or not. If you are buying software from them, or outsourcing work directly to them then the answer is different, but these guys IP theft has no bearing on their output, it only affects their profit margin.

Their risk - their choice - their business.

Re:Two completely seperate issues here.

[stubear]

"Foundstone's troubles began last October when the company brought a trade-secrets case against J.D. Glaser, its former director of engineering, accusing him of stealing proprietary code."

The irony is not what Foundstone does as a company, but what they recently sued an ex-employee for. Basically this is a case of the ol' pot calling the kettle black.

Re:Two completely seperate issues here.

[Jeff DeMaagd]

I think it is a question of ethics. Maybe ethics is a thing of yesteryear to Slashdotters but a known unethical security company isn't exactly a thing to brush off. If unchecked, it will eventually rear its ugly head, much like the accounting ethics from the dot-com era.

Re:Two completely seperate issues here.

[Guardian of Separate]

It is spelled "separate", not "seperate".
It may help if you think "er" as in "error". Make no errors when spelling the word. There is no "er" in separate. This is the grandfather of all Internet spelling mistakes, and I am going to do my best to end it here and now. It will be an uphill battle, but I am ready.

So, evil roy, you are the first victim in my mission to rid Slashdot of this error. Hang your head in shame!

Re:Two completely seperate issues here.

[haystor]

Then you can work on:
loose vs lose
there vs their
rediculous
wierd
its it's
then when it should be than
all right vs alright
a lot vs alot

I don't mind simple typing errors and I don't mind non-English speakers mangling the language. Its just that I'm amazed how people that grew up with the language can consistently use the wrong word. In particular the consistent use of "then" instead of "than". How could you be in a technical field and miss out on "less than", "more than", etc...

Also, loose when it should be lose amazes me. Nobody seems to misspell "lost" or "loser". Where the hell does that extra 'o' come from all of a sudden? Also "loose" doesn't sound like "lose". Try pronouncing "goose" or "moose".

Weird is a wierd spelling. No big deal about this one as there doesn't seem to be any rhyme or reason why its spelled the way it is.

Just out of curiousity, do they still teach spelling in school? Up through what grades? (serious question, its been a while)

Re:Two completely seperate issues here.

[operagost]

Hi, I was browsing the web when I got loost and found myself here. Could you redirect this looser to yahoo.com?

Re:Two completely seperate issues here.

[Battle_Ratt]

Just plain wrong. Legal and ethical issues are key to security, both for the client and the company. More key in many cases than keeping hackers out.
Backups, can solve or mitigate data destroyed by hackers, and simple encryption can prevent compromised information, but lost reputation, and lack of consumer confidence will bury a company supposedly based on ethics almost instantly.

Any full scale security audit needs to cover license compliance, in fact, they mentioned their experience with that type of auditing in their letter. They obviously understood the importance of it, even if they didn't apply it correctly.

Re:Two completely seperate issues here.

[Guardian of Separate]

I would fight these errors too, but there are already worthy champions of the cause. It would simply be too much for one man, however dedicated he may be.

I Don't KNow Why Anyone Would Use Foundstone?

[Anonymous Coward]

Either You setup a secure linux box and nessus to get free scanning, or if you want the corporate/easy/expensive option you get qualys which scans for more vulnerabilities than anyone else and can do this from 1U server appliance, rather than the half rack that Foundstone has been trying to sell to people.
Never mind the whole legal problems that they have and the fact that their talented programmers keep jumping ship.
Foundstone have too many liabilities and not enough of a product for the cost.
I like nessus, but they do have a habit of crashing services and incorrectly identifying services, and it's GPL - although I hear that nessus is somewhat ironicly violating the GPL by blocking off parts of it's update site to known 'competitors' including foundstone, ISS and qualys.

Re:I Don't KNow Why Anyone Would Use Foundstone?

[Anonymous Coward]

If you've got a network with thousands to tens of thousands of nodes and a significant number of access points, then you need Foundstone.

Re:I Don't KNow Why Anyone Would Use Foundstone?

[Anonymous Coward]

Why do you need foundstone in such network ?
Why do you think their competitors can't make the job in this case ?

Re:I Don't KNow Why Anyone Would Use Foundstone?

[Anonymous Coward]

Everyone meet Amer Deeba, the VP of marketing at Qualys. Qualys likes to troll /. and various mailing lists to get some "grass roots" effort behind their product. You can usually tell because it's anonymous or comes from a hotmail address that has never posted to the list before. Qualys will usually also use nessus as the comparison in a "We'll it's ok for something free but you know the GPL/support/complextiy/etc may be too much for you." Btw, it's not a half rack you nitwit, unless they use 2U high racks where you come from. check the picture: http://www.foundstone.com/products/rapiddeployment .htm

Re:I Don't KNow Why Anyone Would Use Foundstone?

[Anonymous Coward]

Everyone meet Amer Deeba, the VP of marketing at Qualys. Qualys likes to troll /. and various mailing lists to get some "grass roots" support behind their product. You can usually tell because it's anonymous or comes from a hotmail address that has never posted to the list before. Qualys will usually also use nessus as the comparison in a "We'll it's ok for something free but you know the GPL/support/complextiy/etc may be too much for you." Btw, the foundstone box is 1U (a little short of "half-rack", and it's cheaper than qualys as well). Doh, and it looks like FoundScan just beat Qualys in a Network Computing review too...

Amazing

[e_pluribus_funk]

"Oh yea, I forgot we still have Republicans"

I guess this is how ideologically rabid the left has gotten. Republicans, apparently, have a monopoly on corruption, and Democrats (and/or Greens) a monopoly on sainthood. By the way, did you know that John Kerry served in Vietnam?

AFAIK, only lefty Democrats think that by cutting taxes, we are "costing the government money". Get it, not collecting taxes is treated as a government expense. As if they have the right to all of your paycheck, but by the graciousness of their (the Republicans, since the last Democrat to push a tax cut was Kennedy) hearts, they'll "spend" some of your money by giving it back to you.

Re:Amazing

[straybullets]

"Republicans, [apparently], have a monopoly on corruption, and Democrats (and/or Greens) a monopoly on sainthood"

sad but true.

Re:Amazing

[Anonymous Coward]

in a republic, all property is considered owned by the state. so yes, technically the government owns everything. and acting like you're entitled to 100% of your paycheck when there are schools, fire departments, and police departments hard-up for money is being a 100% asshole.

Re:Amazing

[Anonymous Coward]

in a republic, all property is considered owned by the state

in the People's Republic maybe.

Re:Amazing

[operagost]

OMFG! What a TOOL you are!

I don't

[Eyston]

This copy of WinXP Pro I found on the net does it automatically, so there!

-Eyston

Interesting

[droyad]

Interesting how they say "unauthorized software" instead or "pirated software"

Who uses Winzip? What's wrong with 7-Zip?

[Anonymous Coward]

Who uses Winzip? What's wrong with 7-Zip?

Over Simplification...

[EverDense]

Employees say they were told to download whatever programs they needed by using license keys registered
only to McClure or Bahadur. (Legally Foundstone should have paid for each user.)

This must be the author's "Grand Unified Theory of Software Licensing". A lot of commercial software is actually
licensed per-machine or per-processor.

Re:"SIIA" - Darn it

[RPI Geek]

If only you could pirate cars, or collegiate athletics...

I'm pretty sure you can pirate cars, but I think it's called "stealing" instead of "pirating."

There are always two sides to every story kids...

[Anonymous Coward]

Found this on Foundstone.com:
FS Responds to Fortune

To our valued customers, partners, vendors and future customers,
The current issue of Fortune Magazine contains a lengthy article about Foundstone that significantly misrepresents the way we do business, and wrongly states that Foundstone does not respect intellectual property rights. I am writing to tell you some key facts surrounding this matter, and to correct some of the irresponsible misrepresentations and factual errors in the Fortune story.

Foundstone rigorously defends its commitment to protect intellectual property rights, and the intellectual property rights of other software makers. To demonstrate Foundstone's commitment to protecting the commercial use of other software, an independent, 3rd party audit was completed on May 2 (more than a month prior to this article). According to Harvey Liss, President of VLSystems, which conducted the independent audit, "The vast majority of the software applications running on the 510 active Foundstone systems were properly licensed. Including operating systems and applications, several hundred software programs are in current use by Foundstone and over 95% were identified as properly licensed. In our experience, having performed numerous software licensing audits, this is among the higher rates for pre-audit compliance." We recognize that for a company whose very foundations are built on protecting intellectual property, anything less than complete compliance is not acceptable. Our aggressive growth is not an excuse for non-compliance. We've taken the necessary steps to identify non-compliance and have immediately applied corrective action through new policies, procedures and education.

The sources and recent timing of these defamatory statements about Foundstone to Fortune Magazine is not a coincidence. Unfortunately, Foundstone was forced to file a lawsuit against NT Objectives, Inc. because of the misappropriation of trade secrets and our unsuccessful attempts in obtaining key information and a reasonable level of cooperation from NTO. Foundstone recently received some favorable rulings in arbitration that would allow Foundstone full discovery rights to review NTO's code. From the very beginning, NTO has vehemently objected to full discovery, even though they proclaim innocence. This Fortune article is a deliberate attempt to shift focus away from the facts of the case and divert attention to rumor, innuendo, and misinformation.

Our loyal customers and market standing speak for themselves. While macro economic factors are negatively impacting other high-tech firms, Foundstone continues to buck the trend with impressive revenue growth, employee growth (Foundstoneâ(TM)s attrition rate is below the industry average), expanded product offerings, and solid financial stability. Foundstone respects the interests of our partners, vendors and associates, and will continue to deliver the highest quality products and services to meet the needs of current and new customers.

If you have any questions about this article, I invite you to call me or Stuart McClure and weâ(TM)d be happy to give you the facts.

Mm...

[Anonymous Coward]

I guess you can say they have a case of foot in mouth disease. I make teh funnay1

Not me

[Anonymous Coward]

I run WinRar without a valid license.

Newton's Third Law?

[malia8888]

I scanned the article in Fortune specifically to see what was the first action that made Foundstone's employees turn on him like a wolverine in heat. I was satisfied with this paragraph in answering my question.

Foundstone's troubles began last October when the company brought a trade-secrets case against J.D. Glaser, its former director of engineering, accusing him of stealing proprietary code.

This was, in my view, the pivotal point in the downfall of the company. It was Newton's Third Law of Motion in action. Foundstone poked Glaser in the eye, and Glaser poked back. The benches of the opposing teams emptied out on the field for an old-fashioned brawl. This human element in business and history in general has always served as a fascination to me.

If Foundstone would have let Glaser go off and start his company without the eye gouging would there have been this expose'? I think not. Perhaps the company's small regard for employees would have brought to a head problems brewing within the firm. Lots of companies are not nice to their employees; but, I don't think it would be such potent fodder for Fortune magazine.

Re:Newton's Third Law?

[ProfKyne]

This was, in my view, the pivotal point in the downfall of the company. It was Newton's Third Law of Motion in action. Foundstone poked Glaser in the eye, and Glaser poked back. The benches of the opposing teams emptied out on the field for an old-fashioned brawl. This human element in business and history in general has always served as a fascination to me.

Let me guess -- you're supposed to be either Q, the Architect, or Satan. The cosplay and fanfic convention is down the hall.

Re:Newton's Third Law?

[Anonymous Coward]

Mmmmmm.... Satan Fan-fic. Will the hilarity never cease?

On fear.

[mindstrm]

Partly, it's the way people act that causes fear.

I guarantee if someone that good acts very professionaly, doens't brag about what they do, and keeps a low profile with regard to their skills, they won't have problems. If you present yourself as a rogue living on the edge, people will not trust you.

An employer will not fire you JUST because you know how to pick a lock, but the fact that you constantly talk about what locks you picked might scare him a little.

Re:On fear.

[Anonymous Coward]

Keep a low profile with regard to skills? As in not making use of them, even for legal and ethical purposes?

If people are feared just because of their skills, especially if they are fired, that if anything is going to make them feel justified in using their skills for less legal/ethical purposes.

Re:On fear.

[AKnightCowboy]

Keep a low profile with regard to skills? As in not making use of them, even for legal and ethical purposes?

No, as in don't act like an asshat. The typical person I've met like that is an overconfident pompous blowhard who needs a kick in the ass and a dose of reality. They think their shit doesn't stink until they find themselves face to face with a 10 year prison sentence. Being on the inside of an organization doesn't excuse you from breaking the laws or the corporate policies unless you have an explicitly documented paper asshole cover. i.e. don't do ANYTHING without written authorization from your CIO or IT security manager or you will eventually be considered a rogue element no matter how "good" you are.

Moral of the story

[ramzak2k]

Dont trust your employees. Most of them are good, but all it takes are a few nasty ones to come back and bite your ass.

Not to sound like i condone their act, but lets face it every company must be using a few unlicensed software unless ofcourse they are running entirely on open source software. Say you were running a medium sized company and you have a 210 licenses & recently hired 10 new employees , are you going to immediately purchase the license for the 10 others - NO maybe when you get the next budget approval but not immediately.

There are ways to go about this without flagrantly handing over licenses to the employees.

1. Imaging for any upgrades : Ask your employees to backup their personal files on the network & take their disk for imaging. With lot of stuff coming preinstalled on the pc, the employee would hardly take the time to look at what is licensed where.
2. Have a highly trustworthy IT department that does the installations for the staff. This way employees see only the installed APP and not what went into the installation.

I have respect for this guy Jason Glassberg, Foundstone's former software-consulting guru. From the article, this is what he had to say about the litigation:

"This is bullshit,We will regret the day we became a litigious company. You realize you have zero support from the rest of the company on this action, don't you?"


Wonder why he got fired for saying that. Why sue when you know that you are not entirely perfect !?

Re:Moral of the story

[geekoid]

Every company Ive worked for buys extra liscenses beause they know they will be hiring. You know, the whole budget thing. You will at least know you will need a liscense when you begin the hiring process.

These guys aren’t so bad

[Anonymous Coward]

They have two licenses more than me.

Crackers are not perfect, no matter how good

[Anonymous Coward]

Crackers are not super human. Crackers are not perfect beings that do no wrong and never make mistakes. If you ever took the time to study forensics, you would know that it only takes a slueth one tiny bit of information to build a case and find his man. The same equation relates to network security.

Look at some of the greatest cracks in recent time that led to an arrest. The penetration itself was amazingly complex and difficult, yet the cracker accidentally forgot to clean every last fingerprint on a router in China, and the FBI found him a year later. A dumb, "amatuer" mistake led to a cracker's downfall after years of acting with impunity.

Thanks for the serialZ!

[Anonymous Coward]

You should package this up as a lovely weee Delphi app.

Nice situational ethics

[Anonymous Coward]

So it's ok to kinda steal a little?

If you run a 210 person company, you should probably get site licensing for those apps that are essential to every worker. Otherwise, yes, as soon as you hire 10 workers you had better buy 10 more licenses for every software package they will be using.

Don't like it? Tough. Find an open source solution, find a cheaper product with better licensing, or go without.

unda cuva ajant of da SIIA

[Anonymous Coward]

The trade association known as "Software & Information Industry Association" scored this one. Good work boys!
Agent1: Is it...?
Agent2: I'm afraid so, piracy...again. Another good kid gone bad, anther life life thrown away.
Agent1: Damn it! When will they learn to use open source software like respectable citizens? Why must people steal something that is readily available to all?
Agent2: Pathetic, isn't it?

Brain Surgery 101 - By Dr. FrankenSTONE

[Psarchasm]

The insanity of 'white-hat' security companies will surely come to an end
sooner rather than later. Securing the corporate or home network simply
isn't that difficult anymore.

Thats not to say that in some way these prepubescent, security Scooby Doos
don't have their place. But today, they are simply usurped by competent
system and network administrators and the forethought of coders to write
code with security in mind.

Think back to the burgeoning days of online commerce and the cavalier
"Internet for everyone!" in the workplace roll outs. Book wise MCSEs,
trench hardened Oracle/Solaris admins, and street savvy (but cowboyish)
Linux/BSD admins were all the pointy haireds had to turn to. It was a
friggin free-for-all against many up and coming businesses as well as some
borderline brave industry Goliaths seeking a swim in the paranah infested
Internet soup. Networks and software were regularly blasted through by
kids with code they hadn't written themselves. Sometimes it happened due
to the poor design of deployed code. Sometimes it happened because the
attacks themselves were mini-masterpieces. But whatever the reason, in a
space where people could be anonymous supervillans, the will of the
Internet (of the people) to communicate persevered. The Internet
infrastructure, and the networks attached to it, and the people running
them all got a little bit smarter and a lot wiser.

Tell the guy in the suit you want to sell him a network security auditing
tool (or service), because he doesn't have the man power to do it in
house. He may be willing to pay. Tell the manager of a group of coders
you want to sell her your competence and third party viewpoint of the
security of their code. She may be willing to pay. Tell me you want to
sell me a 250,000 dollar piece of network auditing code, or scan my
network from the outside to tell me where my vulnerabilities lie without
knowing my network already, or bebop around my 30,000+ user network
analyzing a bunch of known signatures and I'll tell you to go back to the
drawing board and tell me why your first answer wasn't to invest in a
competent enough staff to make you obsolete.

The wake up call has already been dialed by the customers at large. The
VC money won't last forever. And almost none of you are as cool as you
made yourselves out to be. I suppose in the end it will be just as
amusing to watch you tear at each other in a corporate environment with
lawyers and press releases as it was to watch you tear at each other r00ts
and mailing-list posts.

Re:Brain Surgery 101 - By Dr. FrankenSTONE

[bloxnet]

You know, I am really torn as to whether or not this is a troll or if you genuinely believe the points listed in your rant.

Aside from all the "dot com days arrogance sucked" redundant grand standing, do you truly believe that information security is limited to port scanning a publicly accessible machine or running an IDS? If so you are so sorely mistaken it is almost funny.

Many people who criticize the need for security professionals or companies tend to fall back on that argument. It's as if the whole of data storage and accessibility revolves around web services and related public utilities. Here's a news flash for you...most security compromises come from within the organization compromised. *Real* security professionals realize that security policies for a corporate environment are just as important to implement and enforce as a general HR policy for employee behavior or procedures.

Sadly, we still have not gotten fully to the point on either side where information security is treated as anything more than an burdensome expense or luxury. As companies rely on technology more and more, you will see the typical disgruntled employee behavior evolve from standard stealing the stapler or damage equipment to demagnetizing backup or live data media, purposefully introducing virii into the work place, and every manner of IP theft imaginable (I am lumping customer data and related info in with standard technical IP).

You are correct in that in many ways security companies today seem to be welling up like MCSE's and web design firms in the 90s, and yes....many will implode or otherwise fail. But do not make any mistake...information security is going to only increase it's importance as technology increases in it's commonality or operational dependence for day to day businesses.

Wow, now I am ranting like you....let me leave you with some extrmely simple thoughts on areas that a professional security consultant/company/officer would deal with:

1) User access management and permission levels. Do you know how many companies, almost up to large corporations have lax passwords with presidents using passwords like "money" or rotation schemes where the password for this same resident is "money1", "money2", etc, etc? And do you also know how many employees in small to mid size companies have secretaries with well nigh Administrator/Root level access because their boss keeps forgetting his password and the quick fix is to let the sec. reset? Even better, do you know how often passwords are still written down on paper and taped to a monitor? (I have personally seen this in BANKS, HOSPITALS, and MILITARY BASES).

2) If you have a datacenter of any kind, even if a small room just housing the 4-5 servers your small company uses...is the door locked? Does anything prevent anyone, including an absolute stranger from walking into this room and directly accessing machines?

3) how much data is stored on local machines that is sensitive? how easy is it for someone to walk away with copies (again, countless institutions have CD burners on workstations as part of a standard deal). Are any policies maintained to prevent persons with access to secure data from making copies and transporting in an out of the facility?

4) does the company have any in house apps? Especially with web based intranet apps, I have seen time and time again code that allows me to pass a flag like "UID=400" and suddently I'm a payroll admin! That goes back to the sabotage from within issue, but there are many other concerns which makes code auditing important.

5) in keeping with some of the other points, logging of physical and data access...is it being done? Who is accountable for something done at 2am on Saturday night. Who came in the building...can the login used be confirmed to have been used by the login id in question...etc, etc.

There is so very much more to the security field than what you seem to think and far more than the few examples I just provided. You are totally right, a

Re:Brain Surgery 101 - By Dr. FrankenSTONE

[Psarchasm]

You know, I am really torn as to whether or not this is a troll or if you genuinely believe the points listed in your rant.

Neither, but given space, time, and "slashdot post interest" limitations I simply could not expound any further than I did. Though I challenge you to find something wrong with what I said.

Aside from all the "dot com days arrogance sucked" redundant grand standing, do you truly believe that information security is limited to port scanning a publicly accessible machine or running an IDS? If so you are so sorely mistaken it is almost funny.

I absolutely do not believe these are the limits, foundations, or anything else other than tools. However, I challenge you to find me a security company that approaches a prospective client with "Well then, lets start with your data classification list. Whats that? You don't have one..."

Many people who criticize the need for security professionals or companies tend to fall back on that argument. It's as if the whole of data storage and accessibility revolves around web services and related public utilities. Here's a news flash for you...most security compromises come from within the organization compromised.

I don't recall criticizing the need for all security professionals. I'm sorry if it read that way. This was a very directed rant at particular companies and the way they do, or attempt to do, business.

[skipping some of the lighter stuff]

Sorry, I'm not going to quote these but just answer them outright... I know it makes the thread less readable to some, but this html formating is making me tire and I have work to do...

1) Yes. Having worked in three organizations over the past 8 years in which administration of user accounts was both centralized and distributed -- as well as doing much research on the subject of authentication and in particular password management schemes -- I can assure you that there is no easy solution to this problem. What I've found works best, and most cheaply is a strongly worded policy, backed up by an implemented authentication policy that is actually enforced. And to the best of your ability centralize the backend for this authentication. Sadly in mainframe environments which are surrounded by Unix/NT servers this is no cheaply or easily implemented solution.

2) I'm starting to wonder where these questions are going... If you are an IT professional at a corporation who's CEO can't think of minor physical security, let alone data security, and you as an administrator or developer can't convince him otherwise, it may be time to move on.

3) Incredibly easy. Perhaps you should have read some of my earlier posts before asking some of these questions. You seem to be bent on bringing up issues which any competent in-house security group should have asked years ago.

4) Code auditing is probably one of the most important futures of the security industry as a whole.

5) yawn... and whats your "security company" going to do. Some will sell you monitoring services, at an INCREDIBLY jacked price. What are those monitoring services doing? Issuing email alerts that could just as easily been implemented by a competent admin.

There is so very much more to the security field than what you seem to think

Given the amount I posted I'm not sure how you could expect to know what I know about IS. Given that I've been a "security professional" for the past 5 years of my life and hold a couple of industry respected (but in my view completely worthless (CISSP/GIAC)) certifications I suppose I could attempt to dazzle you with my brilliant insights on IPV6, my opinions on anomalous packet identification, or why I think moving forward that client authentication and secure code reviews will be the backbone of the IS field future. But thats pointless.

If most management types realized security is truly a form of insurance they might treat it differently (insurance and

Re:Brain Surgery 101 - By Dr. FrankenSTONE

[Anonymous Coward]

this is such a troll...

Re:Brain Surgery 101 - By Dr. FrankenSTONE

[Anonymous Coward]

Uh, what the hell are you talking about? That whole post reads like one of those BS trade publication articles written by someone who knows a little about writing and a little about technology, but not much about either. Just because you make a statement in a really bold and confident tone doesn't mean that you're right and won't get your bluff called.

Enough trolling, here are but a couple of the problems with the post.

The current state of security is absolutely appalling. An intelligent, knowledgable, determined hacker (and there are many of them) can find their way into most companies or organizations with a sizable infastructure. (Remember sizable means difficult to manage and thoroughly secure). If you know any good hackers, you know that it's true. They are leagues ahead of most security professionals, and light years beyond the companies that they break in to. Pick a Fortune 500 company or a government or a large bank. Garauntee it's owned. If you don't want to believe it, that's fine. It's true though. And as long as that's the case, there will be security companies.

The vast majority of developers, administrators and architects do not think about security concepts. The rest kind of know what encryption, authorization and authentication are, but still don't come near to actually being able to completely secure a system. People with real, practical knowledge of how to build securely are too few in number to secure the worlds existing IT systems, let alone the ones that are being rolled out in the future.

Also, many security companies make tons of money helping build secure software. RSA, ISS, FoundStone, @stake, etc. all do security architecture/policy/secure coding services and make good money off of it. Not only that, but the larger players are starting to pay attention. Cisco bought and IDS company, Microsoft is shopping around, SecurityFocus got bought by McAffee. I'm sure all of the security companies are just miserable!

But hey, you know what a whitehat is and that ISS Scanner isn't worth the money!!! Want a cookie?!

Those who live in glass houses...

[BroncoInCalifornia]

Foundstone sues Glaser in one of these "arbitration" kangaroo courts. They get to select the kangaroo count. This all starts out stacked in their favor.

But Founstone has been breaking the law big time. And a lot of people knew it.

So this whole thing blows up in their face. And now this has so much attention the "arbitration" court has to deal off the top of the deck.

In related news...

[mabu]

A reliable source claims that SCO is looking into legal action against Foundstone for infringement of their patent on Irony.

Re:There are always two sides to every story kids.

[whatthef*ck]

I wonder if that PDF was made with a legit copy of Acrobat.

Re: Gator?

[johnstein]

that's a good question. Quick answer, I have no clue. There is nothing on the page that should even remotely be related to Gator. The only thing I can figure is that it might be due to the V3 redirect. I think I will change the url posted for now. Thanks for pointing it out. (although, when I went to the site, nothing tried to install)

-John

I'm keeping score.

[saden1]

One down, SCO to go.

You are right.

[RevSmiley]

Better to pay. Your employees have every right to rat you out for stealing. I actually believe they should in fact. We use 99% open and free software and apps. But if a license is due for something we need you bet you ass we will spring for the fees for as many seats as needed.

Re: Gator?

[Anonymous Coward]

I tried to reproduce the gator pop-up but I couldn't. However, I am unambigously getting pop-ups.

The gator prompt only occurred when I went to the gallery link.

Bad for the industry, not just slashdot

[akad0nric0]

This does not bode well for the industry as a whole. Think about how many companies share Foundstone's silhouette - young company, killer app, grows fast from nothing - like netForensics, ISS, et. al.

In my experience as a security analyst, the industry is chock full 'o great products that large companies hesitate to invest in because they're not IBM, Symantec, or the like. Giving 6 digits of cash to a company that could concievably go under in a year is a hard sell on my boss's boss (who signs the contracts) - and with good reason. As a result, we're left with awesome support for products that aren't always the best (IBM), or worse yet, crappy products with no support from a big company (CA).

By doing this, Foundstone has hurt a good chunk of the industry holding some great products, and by association (albeit to a lesser extent) hurt end-users of security apps like me.

Slightly off topic...

[dubious9]

Ultraedit etc

I used to think that Ultraedit was the best thing in the world, but that was before I knew *nix editors and java based editors. I mean come on, whatever your need for an editor you can have it for free better than Ultraedit. If you want clean simple and fast use vim or if your more into macros use emacs.

If you want fully featured (some call it bloatware) jedit performs good and has more plugins and functionality than ultraedit ever will. Why people still use ultraEdit, crisp, slickedit (though slickedit wins out there) is beyond me. This is one area where open source and freely avaiable programs beat commerical options just about every time.

Plus it makes you free like more of a hacker and you don't have to worry about those pesky licenses.

Yea and guess what?

[Anonymous Coward]

"The vast majority of the software applications"
were found to be legit I am so happy.. 95% you go on to note. 5% warzed apps is too much.
Who do I trust? A company who is suit happy or Fortune mag? Well lets see. I'll go with the press and it's fact checking not an audit by one company.

so...

[MrBlack]

what's you're IP address exactly?

Re:so...

[Anonymous Coward]

66.161.12.81

Re:so...

[aaza]

what's you're IP address exactly?

127.0.0.1

Hack that and take it down. I dare you.

Re: Gator?

[johnstein]

try this link and see if you still get pop-ups. When I checked the surf.to/ link I *did* get a popup or two from the V3 redirect. I am certain that has to be it. And if it isn't, there isn't much I can do atm since I don't have the password to update the site (since I graduated)

-John

Another Useless line

[Anonymous Coward]

Another Useless throw away line.

"Oh yea, I forgot we still have Republicans."

Oh I know we still have Democrats but I bet they all license every bit of software they use don't they?

WTF has someones political party got to do with it. I want to bet you these bastages at Foundstone are big and regular funders of the Democrat party and leftist causes.

That holds as much water as your statement does and has an equal amouht of proof attached to it which is Zero.

Mod me down but I am going to keep pointing this crap out and I ain't even a Republican.

They tried to violate the GPL too

[nicholasharbour]

This company had tried to market a ext2fs undelete tool to the computer forensics market. I looked through the binary and found several references to lib ext2 (they left all debugging symbols in so I could see exactly what files they had compiled and linked). the ext2 library is GPL and not LGPL so therefore their program should have been GPL. When we told them about it, they just wrote back and basically said "we arent violating anything". a short while later the tool disappeared from the market. Food for thought.

Re:They tried to violate the GPL too

[bloxnet]

Do you have a link for this tool?

I only ask because I cannot imagine anyone in computer forensics not being aware of or using debugfs to undelete files deleted in an ext2 environment (ext3 is a whole other store and nothing short of a disk editor program has seemed viable so far).

So actually two things. One if the original poster has a link for the Foundstone tool, I'd like to see it. If anyone has a link for some good deletion recovery for ext3 systems or XFS for that matter, I'd really like to see that.

Re:They tried to violate the GPL too

[Anonymous Coward]

Foundstone has never attempted to 'market' computer forensics tools. If any forensic tools are posted, they are posted with complete source. I believe that you are referring to a different company, Nick. I know you personally and would have addressed it.
- A FS Forensics Guy

Thanks for fueling the fire, though. ha!

Re:They tried to violate the GPL too

[Anonymous Coward]

That synchronous journal in ext3 must relly mess you up, troll.

Re:They tried to violate the GPL too

[nicholasharbour]

Ya, my memory is a little fuzzy, I could have sworn there name was foundstone though.. The funny part about the situation was that when I asked there rep they sent to us "what can this do that debugfs cannot?" and he gave a blank stare. They were clearly out of there element. who is it that knows me? Kieth? email me. nicholasharbour at yahoo dot com Nick

Re:They tried to violate the GPL too

[nicholasharbour]

I've been out of the buisness for a while, but as far as I know the only real solutioon for XFS and ext3 would be standard inode recovery (via something like open-inode) or just breaking down and using lazarus. I don't have a link to the tool, as I am not especially sure that this is indeed the same company. Don't worry though, it wasn't worth you time.

Re:They tried to violate the GPL too

[LuckyJ]

Nickharbour hax to da max!

Re:They tried to violate the GPL too

[Anonymous Coward]

Nick's Cheesecakes hax.

- The Forensics Guy from Before.

Re:They tried to violate the GPL too

[Anonymous Coward]

Did I really just spend 5 minutes on slashdot, reading posts and responding?

I want those 5 minutes back.

Do the right thing.

[Anonymous Coward]

Turn them in and quit.
That is the most any good D E M O C R A T could do.
If you don't you are a weasle who never again can claim to be "good"

Have a nice day.

it was republicans

[Anonymous Coward]

It was Republicans who lied about that furniture.

Typical lying Republican urban legend..

Re:There are always two sides to every story kids.

[Anonymous Coward]

Nope this document was created using a HP digital sender
File -> document propertys is your friend..

you got it right.

[RevSmiley]

Same here Linux on my desktop.
No fees paid except to the company that put out my distro. I paid because it's worth the money not because I was forced to. What a concept.

Covered By Pud last September

[rubenmiranda]

The reply to Kurtz was covered in an internal memo over at FC.

Wacky.

RE: Foundstone Shoe On Other Foot

[s-orbital]

If you found a stone shoe on your foot, I think you are in trouble. Stay away from rivers, and men in suits, especially if they have violin cases with them.

Re:There are always two sides to every story kids.

[seek3r]

"Our loyal customers and market standing speak for themselves."

So because your market standing is good, means that of course you couldnt be guilty of any of this?

"employee growth (Foundstoneâ(TM)s attrition rate is below the industry average)"

Foundstone has about 120 employees. Last year about 25 or so left. That seems rather high, so I guess the industry average is higher than I thought.

"From the very beginning, NTO has vehemently objected to full discovery, even though they proclaim innocence."

So NTO should have opened all their door to your inspection because you said so?

"To demonstrate Foundstone's commitment to protecting the commercial use of other software, an independent, 3rd party audit was completed on May 2"

According to the article:
"The trade group, the Software & Information Industry Association, informed Kurtz by letter in May that it intended to pursue copyright-infringement charges against Foundstone."

So after they had been informed of a complaint, and then got word from the SIIA they very quickly jumped to clean things up.

"In our experience, having performed numerous software licensing audits"

LOL! Yeah right, numerous? HAHAHAHAHA

THE RULE IS:

[clambake]

Don't piss people off. No matter how much you think you are right, and how much you think they deserve it. Just don't do it. Would Foundstone have lost it's reputation and been charged with so much piracy if they had just let this guy go, shurgged it off and gotten on with thier lives?

No, nothing would have happened.

The worst thing would have been that, even if this guy really did steal code, they would have a tiny new competitor with no name recognition and no clients. Just another dot-com waiting to fall flat on it's face...

If you go out of your way to not be an asshole, even to people who richly deserve it, you'll find that your life is signifigantly mor etrouble free. Maybe you don't get that two-second moment of childlike glee when you "stick it to them", but then again, is that worth possibly losing the entire company for? Foundstone thinks it is, but I disagree.

Re:THE RULE IS:

[abirdman]

>> Don't piss people off.

This is a very good point! Aside from the points you made in your post, here's another one. The source of "inside information" on piracy for BSA is almost always disgruntled current or former employees. I've even seen advertising by the BSA about this, targeting job-seekers to rat out their former employers for bad/inept/dishonest software licensing policies. And I'm personally acquainted with a local newspaper (since closed down) who fired a fairly large group of employees over a management dispute, and were soon afterward audited by BSA and had to cough up thousands in licensing fees and penalties. The company folded, the fired employees stayed fired, and no one won.

It's a bad situation where people are free to use the courts (and the good offices and legal resources) of an industry group to exact revenge, but how is that different from a former employer filing an injunction to stifle competition?

Overall, this is great advice. Don't piss people off. In our litigious society, we all live in glass houses.

WHAAAAAT?

[Anonymous Coward]

Think about it this way: if all the companies pirate windows, then microsoft will backrupt and EVERYBODY will use Linux, Evolution, OpenOffice, TeXmacs, etc.

Piracy _is_ good. Non-free software suffers from piracy.

Re:Corporate piracy is evil-Hipocrites

[Anonymous Coward]

It's bad when companies do it to other companies to benifit themselves, but it's OK when individuals do it to companies to benifit themselves.[1]

[1] [Insert /. excuse here, used everytime the "pirate" issue comes up.] I'm certain you all are already familiar with them.

Obligatory Microsoft Post

[SuckyDucky]

Looks like Microsoft is trying to do something similar to a couple of its former employees (ala Foundstone to Glaser):

Microsoft to Take Spinoff to Court?

Of course, we all know Microsoft is no saint.

3D Studio Max

[Anonymous Coward]

From Japan.

A lot of game companies use that without more than 11 license.

Odd.

95% effective in deleting thieved software?

[Anonymous Coward]

From my reading of the article (and other sources on the web with similar info), the thieved software was deleted in April. So an audit conducted on May 2nd, what does that prove? That they were 95% effective in deleting thieved software?

DoS Attack

[Anonymous Coward]

don't know where to put this, so i'll put it here:

DoS attack on "send error report" function of iexplore.exe WinMe (5.50.4807.2300)

1) open a bogus hotmail adress. the shorter the better.
2) open a bogus yahoo adress. the shorter the better.
3) write some nonsense in notepad.exe -> save as tiolpxe.txt
4) open winzip. compress the file(s) (maximum, slowest)
5) apply password to compression (IMPORTANT!)
6) log in yahoo. send email with attached compressed-encrypted tiolpxe.txt to hotmail.
7)close yahoo.

8)log in hotmail. open email sent from yahoo. try downloading attachment (save to disk).

iexplore.exe crashes -> pop-up "send error report" -> click send!
and restart iexplore.exe :goto 8)
repeat ...

to bad i can't script :(
-
"DAD?"
"He won't recognize you.
His mind has been subjected to an infinite
indexed database."

Kurtz

[noah_fense]

Does is disturb anyone else that the CEO's name is Kurtz ? Heart of darkness, apocolypse now, anyone else get the feeling this man is a genius who has become evil from spending too much time in the jungle ?
from the ironic names in the news dept.

Why the hell is this Slashdot "worthy"?

[Jerk City Troll]

It took almost no effort to find the counterpoints on Foundstone's website. Funny the editors didn't stumble upon it as easily as I did. Why not try and get the facts straight? From the PDF for those to lazy to read:

According to Harvy Liss, President of VLSystems, which conducted the independent audit, "The vast majority of the software applications running on the 510 active Foundstone systems were properly licensed. Including operating systems and applications, several hundred software programs are currently in use by Foundstone and over 95% were identified as properly licensed. In our experience, having performed numerous software licensing audits, this is among the higher rates for pre-audit compliance."

For being such a small shop, Foundstone appears to do pretty well in this department.

Now, a pressing question is what about this is even news worthy? Slashdot is now helping rake a shop through the mud even though software piracy runs rampant in most businesses (especially those in the tech industry)? Are we now going to be subjected to stories like "company X accused of software piracy" where "company X" is any random org? Yes, "company X" probably has some pirated software floating around, but that doesn't mean they should get a slot on the front page. Besides, since when does the /. rally to accuse people of "intellectual property" violations when the political beat here is that IP is bullshit (which it is, but that's another argument)?

Re:Why the hell is this Slashdot "worthy"?

[Anonymous Coward]

The fortune article stated a piece of software worth $15,000 a seat was found unlicensed. That's not doing "pretty well".

Re:Why the hell is this Slashdot "worthy"?

[Anonymous Coward]

and waht package is that? where's the evidence to support that claim?

Re:Why the hell is this Slashdot "worthy"?

[Anonymous Coward]

The Fortune article misrepresented many statements as fact. They (Fortune) are pandering to the childish games that ego-driven individuals play. It's damn annoying to those caught in the middle.

Re:Why the hell is this Slashdot "worthy"?

[seek3r]

What statements in the article are misrepresented?
None of real impact are from what I saw.

Re:Why the hell is this Slashdot "worthy"?

[Anonymous Coward]

HI DAN!

bullshit

[Jerk City Troll]

The insanity of 'white-hat' security companies will surely come to an end sooner rather than later. Securing the corporate or home network simply isn't that difficult anymore.

So that's why networks are so secure today, right? It's quite an assumption to say that random IT people know how to do security auditing and hardening.

But today, they are simply usurped by competent system and network administrators and the forethought of coders to write code with security in mind.

Well, that's the problem. There are very few competent system and network admins and coders who keep security in mind. Also, even if they are competent, what about peer review? No matter how good you are, you should always have someone else check out your setup and/or work. There's always vulnerabilities.

By the way, you keep working on this assumption that no security problem exists in the computer industry. You insist upon it, but provide no facts or backup when the contrary is obvious from anyone with their finger on the tech industry pulse.

Tell the guy in the suit you want to sell him a network security auditing tool (or service), because he doesn't have the man power to do it in house. He may be willing to pay. Tell the manager of a group of coders you want to sell her your competence and third party viewpoint of the security of their code. She may be willing to pay. Tell me you want to sell me a 250,000 dollar piece of network auditing code, or scan my network from the outside to tell me where my vulnerabilities lie without knowing my network already, or bebop around my 30,000+ user network analyzing a bunch of known signatures and I'll tell you to go back to the drawing board and tell me why your first answer wasn't to invest in a competent enough staff to make you obsolete.

That auditing fee is chicken feed to huge corporations who have massive networks that require auditing. Foundstone isn't the kind of company that's going to provide a service for a Joe's Software Company with 10 employees. By the way, Foundstone does thorough audits, not just scanning your "network from outside to tell me where my vulnerabilkities lie without knowing my network already". Get a clue.

For every company to have an "in-house Foundstone" would be prohibitively expensive. Foundstone sells massive amounts of security experience to be applied to the job. You cannot just get that "in-house" for cheaper than what Foundstone offers. Also, Foundstone provides education services to help in-house people do a better job of analysis. Once again, you are clueless about Foundstone's business.

You, sir, are an idiot. Who moderated this rubbish up to 5?

Re: Gator?

[jafiwam]

Gator has a little timer so the pop up comes up several seconds after it is initiated.

That can sometimes appear to make Gator pop up on web sites that are not actually hosting it.

Foundstone busted? Good...

[jeremycec]

Now, maybe I can get a discount on their Ultimate hacking class at the Black Hat Briefings. Heheh..

RTFA

[emilng]

Foundstone is not in trouble for having outdated software on their server. They are in trouble for having software that can be purchased, but they decided to distribute either unlicensed copies or copies that only had one license.

Re:Corporate piracy is evil-Hipocrites

[Graspee_Leemoor]

You say that companies to it to other companies to benefit themselves and individuals do it to companies to benefit themselves, but you fail to point out that although both the rogue company and the rogue individual benefit from not having to pay the purchase price of the software, the company then further benefits financially by using the software, while the individual just uses the software for personal use.

graspee

Re:"SIIA" - Darn it

[Zog The Undeniable]

This is actually an interesting comment. For a strict analogy, "pirating" a car would involve creating an exact copy of it without removing, damaging or otherwise affecting the original car. OK, you've cheated BMW out of a sale, but you haven't damaged their reputation because your copy is exactly as good as the original. The only difference between this scenario and running off a bent copy of Office XP is that the latter is technically possible and cheap, whereas the other will have to wait until nanobots come along ;-)

The other mind-bending analogy I like is that any executable binary program can be represented as a single number. Can you copyright 6786237544599987897343387989721333?

Re:Qualys

[Anonymous Coward]

As a former Qualys employee, I am amazed that Fortune magazine fell victim to Philippe Courtotâ(TM)s web of deception. It was a well known fact inside Qualys that they had been funding NTO in an effort to get as much Foundstone information out of NTO as possible. Philippe would go off on these long tirades on how they needed to kill Foundstone. I guess using JD and NTO was a good move on their part.

Everyone in the industry knows Philippe forces people out faster than he can hire them. Maybe the next reporter will dig a little deeper and shed some light on Qualys and their management practices.

Interesting

[bogie]

A funny thing I've found about Winrar. I've found that for the most part for regular legit downloads rar is a no show, ie no one uses it. In fact I'm not really sure I've ever downloaded anything legal that is compressed with rar by default.

Ironically the only place rar files are really widely used is for cracking groups and warez on places like usenet. Rar is really useful to them because of its ability to join and recover multiple compressed files in a set.

I'm sure there are rar users like yourself who think the closed format is great or just happen to like the tool, but like I said for the most part its a tool used in the warez trade. Not that I care, but that's just the ONLY place where rar files show up in any quanity.

The audit took place AFTER they were caught

[Anonymous Coward]

The audit took place AFTER they recieved a complaint and the SIIA put them on notice. It took place AFTER the CEO told all the employees about it being a problem that they would "address".

Funny how during my year at Foundstone I was not ever once given a valid license for ANY software I used. Neither was anyone I worked with.

Re:The audit took place AFTER they were caught

[Anonymous Coward]

That is probably because you are a Windows guy who cannot handle the use of good, reliable command line tools.

You are a fool.

[BoomerSooner]

Cutting taxes does cost the government money (it is income right?).

I guess you would chip in for your public derived benefit of national defense if we had no taxes.

Not all Republicans are corrupt and not all Democrats are worth a damn either. I'd say 99% of Republicans are worthless and about 50% of Democrats.

I guess the $500 Billion dollar deficit isn't an expense? How about bankrupting Social Security, Medicare and the Government in a short 3 years? Fucking pathetic. Oh BTW George Bush has spent more than the last 16 presidents by more than 50%, he just did it through deficit spending instead of real income (taxes).

Go read a fucking econ book and pull your head out of your ass, maybe then you'll do some good for the country.

OT... sue me.

[Mr.Mustard]

While I agree with you in general, I would like to point out that "alright" is actually quite old and, while nonstandard, is not totally out of the ordinary. The Merriam-Webster entry dates it back to 1887 and says that it came into use around 75 years after "all right" had returned from a 400 year hiatus.

I am a poor speller, but I do try to avoid most of the obvious mistakes.

To your list I would like to add:
your you're
congratulations

My personal favorite is when people say, "Your an idiot."

anti-disclosure and microsoft

[Anonymous Coward]

According to this Foundstone is in bed with microsoft for anti-disclosure plan. (reported on /. ) It is funny that they are accused of pirating windows - gives new meaning to microsoft's trustworthiness.

Very common practice in such environments

[Anonymous Coward]

Some information security companies tend to hire people with "questionable backgrounds" to be "professional hackers". So of course that type of personnel is going to introduce all sorts of "warez" into the corporate environment. No surprise there, except that Foundstone got ratted out on it.

I worked for one of Foundstone's competitors for a while (based in Waltham...you figure it out), before eventually quitting of my own accord. The first week on the job I got a company-wide e-mail about the network drive used to upload and download MP3's. Several weeks later we all got
word on where to upload and download "software tools". You can imagine what types of "tools" were available (some open source and some not).

There's simply not much ethics or integrity in a cottage industry that is supposed to be grounded in them. And this "piracy" issue is just the "tip of the iceberg". But of course my past association brings my integrity and ethics into question, which is just my tough luck.

Re:There are always two sides to every story kids.

[.@.]

I can't tell.

However, I can tell you that it was created at 1:03pm on Monday, June 9, 2003, by Robin Whaling, who seems to be a functionary at Foundstone, responsible for such things as the maintenance of security class enrollment and such. Probably and executive assistant.

I can tell you that the document was probably created on a non-current version of Distiller.

I can say with some certainty that it wasn't produced with a Macintosh version, and almost certainly was produced on a Windows, rather than Unix, version of the software.

I can also say that on April 4, they switched from using NES 4.1 on OpenBSD to a Mac OS X-centric enterprise suite as their primary webserver. Given the coincidence in dates, one wonders whether that copy of NES was licensed properly.

And you are a bigger fool

[e_pluribus_funk]

But what can you expect from a Sooner.

I'm glad you brought up a "fucking econ book", because you should take your own advice. Actually, you should just learn to fucking read.

I never said I was in favor of deficit spending. In fact, we should be cutting entitlement programs left and right.

But deficit spending during a recession is a normal and accepted fiscal policy to respond to recessionary conditions. If you'd read a fucking econ book you might know that. But like most Demonazis, I guess your eyes glaze over when anything with hard numbers and actually having to calculate stuff comes up.

I'm curious as to why people think tax cuts should go to people who don't pay taxes in the first place? As a reward for being indigent? And, what exactly do you consider fair taxation? Do you think your taxes are too low? Where would you be happy? Not until the "rich" are thrown out of their houses and the workers of the world stomp them underfoot, eh comrade?

rubbish...

[RMH101]

alternately, "it seems you're right. XYZ does indeed crash our production server. it didn't used to, when we went through the user acceptance testing when it was first built. what has changed? is it something on, say, our network that now behaves differently? or an untested update that someone's put on the client? does it do it on a test rig? (as i'd better not fvck about with a production server that's validated and so would require a complete rebuild according to the mountain of paperwork required for, say, FDA compliance if I changed anything)"

NTO Response

[seek3r]

NTO Response to the Fortune article and Foundstone response.