Hacker News Reader

During the talk they told us why they called it meat pistol.. it's an anagram for metasploit. Meat Pistol made sense because it shoots out malware implants.

Also why pull out in the last 30 mins? And why fire them? No warnings ? Mistakes happen, you don't fire a director for something like that. The PR process is to make sure the company's image looks good, who better knows the Defcon audience? Hackers or PR people who don't understand the framework?

There is really no other way to see it than Salesforce fucked up.

>During the talk they told us why they called it meat pistol.. it's an anagram for metasploit. Meat Pistol made sense because it shoots out malware implants.

OK, try getting a PR department to sign off on that.

The whole point is that they already knew about it before hand(It being called meatpistol, hence the previous meeting) so firing them 30 mins prior is bullshit, hence the drama.

And they presented it at Hushcon before with approval so what's the problem with that?

And this is what I'm saying is unlikely, because, try getting a PR department to sign off on that.

> And they presented it at Hushcon before with approval so what's the problem with that?

Why do you think they got approval at Hushcon?

Because Salesforce did nothing after hushcon? Which means it would have been approved.. say if it wasn't approved, isn't that a failure on SF's part because the employees would think it's fine.

I don't see why you keep defending Salesforce, they did mess up even if say the employees did not go through the approval process. You don't fire People over that, especially if previous talks are public on the same subject. Especially not at Defcon. That's why SF is in the wrong.

There's a lot of assumptions in this interpretation of events. It's entirely possible that warnings were issued after hushcon and that's why action was so severe this time around. It's also possible that no warnings were ever issued and there is blame for overreacting due to the management. Either way, it seems like there's plenty of information available for interpretation but not conclusion in this scenario.

Not all companies are like that. I developed an internal admin tool and called it RETARD (it's an acronym).

I'm glad I don't work at a company where that's an acceptable project name.

One dictionary I have at hand details five definitions of the word retard.

Why do we have to feel obliged to take offense at the whole word due to one slang definition.

Why should MEATPISTOL be a problem?

retard

1. to make slow; delay the development or progress of (an action, process, etc.); hinder or impede. verb (used without object)

2. to be delayed.

noun

3. a slowing down, diminution, or hindrance, as in a machine.

4. Slang: Disparaging and Offensive. a contemptuous term used to refer to a person who is cognitively impaired.

a person who is stupid, obtuse, or ineffective in some way: a hopeless social retard.

5. Automotive, Machinery. an adjustment made in the setting of the distributor of an internal-combustion engine so that the spark for ignition in each cylinder is generated later in the cycle.

I'm not offended and don't take issues with the use of retard in a non-slang context, but for the naming of a project I think it's inappropriate to use a word that could bring back hurtful memories of harassment that people have potentially endured.

Would you name a project the same as your username?

That's a historical accident. My name in RuneScape when I played as a kid had football in it and I shortened it to foota.

Then can we at least postpone the renaming until someone actually complains about it first-hand, rather than "just in case" and on someone else's behalf?

Don't get anywhere near fire retardants...

Seriously, there is a balance to be had. People who went through traumatic events are often offered therapy precisely because you can't reasonably expect the entire world to guess and remove every single thing that can trigger someone's hurtful memories.

Am I the only one who immediately thinks of the verb form of "retard" when it's presented with absolutely no context?

I'm so used to hearing without any conceit that antibacterial mouthwashes can retard bacterial growth.

I'm glad we haven't been forced to stop using ritardando in music settings yet.

You think like Airbus.

https://www.youtube.com/watch?v=sikGj2flLB8

To me the word "retard" immediately brings to mind fire retardants. Offense is in the eye of the person who takes offense...

I'm glad I don't work at a company where the thought police will come down on you if you don't take yourself too seriously.

Still okay if there were any co-workers who found it offensive? Perhaps because it hits home for them?

"Thought Police" is alt-right for "Nazi"

Didn't you get the memo? Anyone who doesn't immediately and fully agree with your position is a "nazi", regardless of what that position is.

> During the talk they told us why they called it meat pistol.. it's an anagram for metasploit. Meat Pistol made sense because it shoots out malware implants.

I wonder why they didn't pick Metapistol.

There's a lot of things you can wonder, but they're not all worth mentioning.

What are you more likely to remember a week from now: Meatpistol or Metapistol? Reminds me of the resistor color code mnemonic, something I memorized for life the first time I heard it.

Ahh! Violet! I miss her.

Leave her alone, she's just 7.

"Also why pull out in the last 30 mins?"

Actively developing and planning to release a malware creation tool? That sounds like developing and releasing cyber weaponry. We've got export laws regarding that IIRC.

Yea. EAR and ITA explicitly cover this, in fact.

Which part, specifically? The only restriction on the EAR I see that applies is that on encryption, and Part 742.15(b) provides an explicit exception for software where the source is publicly available. That's why, for example, non-US citizens must request a special license to download the paid Metasploit version but can download the open source version freely[1].

[1] https://community.rapid7.com/community/infosec/blog/2015/06/...

Journal of National Security Law and Policy, Vol. 8, No. 2, 2015. Quite the argument made there that EAR and ITA do indeed deal with the making and distribution of cyber weaponry.

Thanks for the reference!

I think that article only emphasises that it is not subject to those regulations. Quote:

We conclude that, at a technical level, the distinction between weaponry and non-weapon malicious software lies in the payload component of the tool, which must be capable of creating destructive digital or physical effects

Meatpistol is only a framework, therefore there's no payload component.

Apparently the fired employees have enough of a case that the EFF agreed to represent them.

Given that SF employees have presented at many conferences in the past I don't see that getting official approval for the presentation is that strange.

I agree that we need more details, but can you really say that this situation has not played out many times before?

>Given that SF employees have presented at many conferences in the past I don't see that getting official approval for the presentation is that strange.

It's not strange at all. So dig up some of those slide decks of past SF talks and compare them to what was presented in the meatpistol talk. Then you can decide for yourself whether you think this talk was approved or not -- it would be the same PR department approving all the talks, right?. In any case, the facts may come out in the representation, as you suggest.

I have no idea about SF's processes specifically but it's certainly not universal practice to have conference presentations signed off by PR or anyone else within an organization. Doesn't mean there can't be repercussions if you say something inappropriate or disclose information you shouldn't, but not all companies require signoff from presentations.

Any comparatively large corporation very likely has a release process for these sorts of things where a bunch of groups (like PR, maybe Legal etc) would take a look. Releasing company IP as open source outside of such a process would be a gross violation of any number of non-disclosure agreements between employer and employee.

I'm a little confused what their case is, can't the company fire them at any time with no reason? I don't really know much about employment law, but that was my understanding.

Like if they went on stage and flopped, they could get fired. Similarly maybe they were too good. Or the boss was having a bad day.

Not any reason, wrongful termination lawsuits happen, and companies usually have processes for firing people, reviews to document performance etc..

> Not any reason, wrongful termination lawsuits happen, and companies usually have processes for firing people, reviews to document performance etc..

Actually, they can (with a few exceptions). California is at-will employment:

"At-will employment is a term used in U.S. labor law for contractual relationships in which an employee can be dismissed by an employer for any reason (that is, without having to establish "just cause" for termination), and without warning."

Or, as the Supreme Court of California explains:

"[A]n employer may terminate its employees at will, for any or no reason ... the employer may act peremptorily, arbitrarily, or inconsistently, without providing specific protections such as prior warning, fair procedures, objective evaluation, or preferential reassignment ... The mere existence of an employment relationship affords no expectation, protectable by law, that employment will continue, or will end only on certain conditions, unless the parties have actually adopted such terms."

Yes, but an employee can still file a wrongful termination lawsuit if they believe that the "no reason" termination was bullshit and that they were actually fired for an illegal reason.

Like, if someone decides to come out of the closet on social media and their co-workers find out and their boss hears about it and fires themthe next day but claims that it's a "no reason" termination, it would certainly raise suspicion that they were actually being fired for being gay and they might win a wrongful termination lawsuit, even in an at-will employment state.

Sexual orientation is a protected class in California[0].

[0] http://www.nolo.com/legal-encyclopedia/california-employment...

Any reason that isn't prevented by labor protection laws, examples: sexism, racism, ageism, whistleblowing retaliation.

> can't the company fire them at any time with no reason?

One of the employees is based out of Sydney, so No, California at-will employment law doesn't apply.

It would be interesting to see what grounds they are using to fire him.

Based on previous experiences with other companies, I found that it's not unusual for executives in one country to think that the employment law in their jurisdiction is universal and just assume they can apply it to employees in other countries.

California labor code section 201 (a): "If an employer discharges an employee, the wages earned and unpaid at the time of discharge are due and payable immediately."

Firing someone in California requires that they be paid in full right then and there. This includes payment for accrued vacation time, comp time, etc. Were these employees paid off properly?

Err, no. Payable immediately doesn't mean somebody has to hand you a wad of cash.

In California, it does.[1] California has the strictest law in the US on this.

[1] http://www.turleylawfirm.com/blog/final-paycheck-laws-for-te...

Fair enough. Salesforce has enough money that they can afford to pay the minor penalty for violating this.

You're right. They can also hand you a check.

For the California employee, they have to PAY YOU IMMEDIATELY, THEN AND THERE. That means either a pre-loaded card, check, or cash in hand, or other acceptable instrument of legal tender, such as a money order.

The penalty is the employee's wages, day-for-day, up to 30 days. So yes, it will probably be payable, but it's just money (rather than somehow invalidating the termination, for example), and it's unlikely either side will care much about the amount.

They are probably still getting full salary and benefits until the next scheduled payday. That's how companies in CA get around the rule that employees must be paid in full on their last day.

You can be fired as an Australian employee at any time but they will still need to pay out the notice period in their contract and whatever accrued annual leave they had.

Most notice periods in AU are 4 weeks so you either are fired with 4 weeks notice or fired immediately and paid for those 4 weeks.

(The notice period also applies if you decide to leave the organisation)

The rule specifically is:

Can notice be paid out instead of worked?

Yes. An employer can either:

Let the employee work through their notice period, or

pay it out to them (also known as pay in lieu of notice).

If the employer pays out the notice, the amount paid to the employee must equal the full amount the employee would have been paid if they worked until the end of the notice period. This includes:

incentive-based payments and bonuses loadings monetary allowances overtime penalty rates any other separately identifiable amounts.

If the employer pays out the notice, the employee does not accrue any annual leave for the notice period they were paid out for.

https://www.fairwork.gov.au/ending-employment/notice-and-fin...

But employment in Australia is not at-will, so regardless of their obligations to pay out the notice period they also need to have a valid reason for the dismissal.

https://www.lawsociety.com.au/community/publicationsandfaqs/...

They might have one here, but I doubt it.

Specifically John Cramb (the Australian) was presenting alongside Josh Schwartz the director of offensive security. It seems that one could reasonably establish that John was acting under the directions of his superior, and that would mean that the default position would be to assume that his actions were sanctioned by the company unless they can prove that he knew otherwise.

And even then, they would be expected to provide a written warning, or justify why the violation was so extreme to justify immediate termination (which would be very difficult given he was active under the instructions of a superior).

Base on the limited evidence we have, it seems that Salesforce has unfairly dismissed John, and that the Californian executive ought to have consulted with an Australian HR lawyer before he acted.

I'm ignorant as far as Australian law. Is this true if the company is based in America and the worker is laboring either in America or remotely? It seems like at that point Australian law wouldn't directly apply to termination decisions.

It depends.

Generally speaking, multinational companies will offer employment contracts through a local subsidiary. In that case the employment will fall under the laws of that country. And if they send you on an overseas business trip that doesn't change anything - even if the parent company is domiciled in that country.

If they don't have a local presence, and you're working remotely, then you're more likely to be a contractor and dismissal laws are pretty loose.

The interesting thing would be if they had a local subsidiary but chose to employ you on contract to the parent company. I suspect (but IANAL) that the Australian Fair Work Commission would determine that (if the contract was long term and indefinite) that you were actually an employee of the local subsidiary.

> You can be fired as an Australian employee at any time

That's not true, we have unfair dismissal laws: https://www.fwc.gov.au/termination-of-employment/unfair-dism... . From the page:

Your dismissal may be considered unfair if:

* you were dismissed, and

* your dismissal was harsh, unjust or unreasonable, and

* your dismissal was not a case of genuine redundancy, and

* if you were employed by a small business, your dismissal was not consistent with the Small Business Fair Dismissal Code.

Personally I would consider this harsh, unjust and unreasonable, especially if this is the first time and the person doesn't have a lot of publicity experience.

I am an Australian in Sydney with a Californian contract. Both parties can walk at any time.

Are you an employee or a contractor? From among my circle of friends working for foreign companies the possible arrangements I've seen are: (a) employee of Australian subsidiary of foreign company (my situation) (b) employee, under a contract governed by Australian law, of a foreign company directly or (c) independent contractor of foreign company.

(a) and (b) give you Australian employment protections. (c) obviously only gives you whatever protections are in the contract.

I've never seen anyone under a contract of employment (rather than a contract for services) of a foreign company that purports to not be governed by Australian employment law.

Even if they have a corporate structure that seems to make the Fair Work Act not apply (say, making you a contractor of a foreign company), I'm pretty sure that the commission will still generally rule against the employer if you're effectively working as an employee and you take it to the ombudsman. So if, say, they provide office space and a computer, you work regular full-time hours and it's more than a temporary contract then it will usually be considered a sham contracting arrangement and you'll be eligible for all the standard full-time employment protections.

Help me out here. What is EFF's involvement in this?

Generally I can kinda see how the EFF would be interested in the topic of their presentation, but effectively this is an employee and employer legal issue now.

Which is more likely? That someone wanted this cancelled in the last 30 minutes. As you said, this was a company funded trip. There is no way this wasn't known. Multiple people were on the trip that knew of the talk well before it started. And if you knew something was going to be released that shouldn't be released, why wouldn't you go to the place where the talk was being held and stop it? Especially without confirmation.

Let's say this talk was never approved by PR and the employees went rogue. Firing someone in public right after they give a talk is still terrible optics. Even if salesforce is in the right, this executive looks totally incompetent, which in turn reflects poorly on the company. Unless it was an extended salesforce trash talk, that is.

So your. Intention is that they have this talk without the exec knowing it was going to happen?

The exec that fired them was an attendee at the conference. How can he not have known about their talk? That makes no sense.

puppet is not mentioned once in the article. It's called MEATPISTOL, which is a obviously a codename. Also this is Defcon.

You're right, fixed. Of course it was defcon -- where did I say it was something else?

>> The last few days have really highlighted how quick people are to pile on with outrage and self-righteous indignation before getting all the facts.

Amen.

The facts are the exec that hired them was an attendee at the conference. He must have known perfectly well what they were going to present well in advance. So the facts are that prior authorisation doesn't look like it could possibly be the issue.

I think you're exactly right here. The article leaves off too many details and speculates entirely too much for me to feel comfortable making any kind of assessment and I think that this is exactly what they want. We haven't heard any official statements from EFF, Salesforce, or anyone besides anonymous sources. That kind of deliberate omission usually means that there's more to the story than we're led to believe and they need to get their side out there immediately to drudge up quick support and a clickbait headline to put in people's heads. There's still a chance that it's exactly what they said, but I find that hard to believe at this stage.