Security Basics mailing list archives

Re: Foundstone - keeping free tools from the public


From: "Roy Pait" <roy.pait () marlboroughschool org>
Date: Fri, 11 Oct 2002 08:52:20 -0700

I think you read it wrong - As I read through the briefs 
( http://www.ntobjectives.com/images/TRO.pdf 
http://www.ntobjectives.com/images/StuartMcClure_Declaration.pdf 
http://www.ntobjectives.com/images/Plaintiffs_Memorandum_Pages1-10.pdf)
what I saw was a company suing for trade secret violation. While NTO's
page runs on about a Foundstone about face, I didn't find it in the
briefs. It may well be true, but the documents posted on NTO's site
state that:
1. 4 employees worked for Foundstone.
2. They signed NDA's for proprietary work.
3. They left and founded their own company.
4. They made a product that was not dissimilar to Fondstone's
commercial products.
5. Foundstone is suing to stop them (Breach of contract).

While I haven't a clue that any of this is true, NTO's own site never
really repudiates Foundstone's complaints. Rather they hide behind a
worn statement that tools should be open and available. I agree they
should be, but I would not presume to force a company to make a product
that they have spent time and money to develop into a free product. 

If a group of guys got together and on their own developed a program
that could rip open any encryption I would support their right to
publish. However if they had used knowledge taken from a commercial
product, viewed under an NDA???? No way - that's theft.

Conversely, if a company utilizes a product/program developed under a
GPL, they should be held to the release requirements of that GPL (Most
stated that any derivative works must be also released as GPL). 

Roy Pait

<bettyford5555 () yahoo com> 10/10/02 08:44AM >>>


What does the community think of this news -
http://www.ntobjectives.com/pressrelease_lawsuit.html?  Seems big 
Foundstone is trying to keep others from releasing free tools to the 
community.  Maybe I'm misinterpreting, but didn't they used to talk
about 
the benefits of providing these types of tools to combat hacking?
Perhaps I'm wrong and just misunderstanding their position.


Current thread: