Discussion on:

Corporate ethics versus security ethics

Filled with straw, to make use of your favored device.

Corporate responsibility can -- is -- cast also as triumvirate, even quadrumvirate, no part "secondary at best" to another, except in your world.

All that follows from what you establish at the outset, your proprietary premise, dies.

So how are the groups of three men and groups of four men connected to this?
Are they beating up the straw man too?

I must say that the corporate responsibility is very much a "pirate's code" and very little else.
It even means that corporations are required to spend money greasing politicians to tweak legislation... it's not just an option, it's the only (corporately) responsible thing to do!

An indefinite article where there is none.

Tertiary and quaternary I could understand.
Ternary too.
But for something to be cast as triumvirate ... talk about giving pause. And rewind, play, pause again.

I might have to use my workaround for this one.

good sir Santee is simply stating that the different aspects of the corporate model act as table legs supporting the business. Were one leg to fall shorter than the others the table would fail in its purpose.

And personally, I dont think 'security ethics' is really what is at question here, rather I'd place it more with quality of product. And in the case where the quality of product is suspect, let the buyer beware.

He actually explained some of what he meant (a minor miracle) in response to me elsewhere in this discussion.

I'm going to try a "new" approach to responding to your poppycock, santeewelding. I'm going to treat it as though it's someone's attempt at reasoned discourse, even though it bears almost no relation to reasoned discourse.

Colossal Scarecrow, Chad

Filled with straw, to make use of your favored device.

I'm going to assume you're claiming that I'm employing a straw man fallacy (though I don't know why you couldn't just come out and say it like a normal human being). That being the case, please identify for me whose position I'm misrepresenting to produce a straw man fallacy, since the misrepresentation of some party's position is a necessary component of a straw man fallacy.

Corporate responsibility can -- is -- cast also as triumvirate, even quadrumvirate, no part "secondary at best" to another, except in your world.

You seem to be claiming that corporate responsibility is in some way a trinity as gestalt, or something to that effect, though you appear notably unwilling to explain that in any way. Okay, whatever. Explain or not -- if you choose to not explain, I guess you'll never make a point. I'm not sure how that turns into refuting the idea that anything that stands in the way of the standard "corporate responsibility" being "secondary at best". Perhaps you could support your apparent non-sequitur with some kind of actual argument for a change.

All that follows from what you establish at the outset, your proprietary premise, dies.

1. How is it "proprietary"? I've never claimed any exclusive right to the premise of this article, nor even any originality in it. I just spelled it out for the benefit of those who may not have seen things from that particular perspective before. Please explain how that is "proprietary" in any way.

2. How does everything following from that "die"? You make these proclamations as though you've built valid arguments supporting given conclusions, except that you've said nothing that actually relates to that conclusion. Provide some support for your assertion, please.

Straw-man fallacy: (mis)representation of position, you being responsible for the (mis), unless you are dealing with necessary truth, which is an affront to God, your readers, and maybe to Baptists.

"To respond" is both transitive and an intransitive verb. The transitive version requires -- necessarily -- two or more functional components for the ability to respond (responsibility).

You name three components: officers ("decision makers"), shareholders, and customers ("users"). Like the three-leg stool, remove one and there is no corporation -- that "legal fiction" I had in mind when I mentioned "quadrumvirate". That fourth part would be law. Remove law, which refers to the rest of us in relation to the corporation, and there is no corporation. Your non sequitur is my sine qua non.

I said, "part". I did not say, "gestalt", which is you off doing your thing, again, as with, "poppycock".

Rather than these parts and their respective imperatives functioning co-equivalently, you put just the one at the top: success of shareholder investment, then proceed linearly and hierarchically down to the death of your proposition.

That proposition, proprietary, by the way, on account of your having needed two whole first paragraphs to set it up (tch-tch). How else could it exist.

I take back, "scarecrow". It was an abortion.

Straw-man fallacy: (mis)representation of position, you being responsible for the (mis), unless you are dealing with necessary truth, which is an affront to God, your readers, and maybe to Baptists.

Whose position, and which position in particular, do you think I'm misrepresenting here?

"To respond" is both transitive and an intransitive verb. The transitive version requires -- necessarily -- two or more functional components for the ability to respond (responsibility).

In this case, the two parties would be the officers/agents of the corporation and its shareholders, for most purposes.

You name three components: officers ("decision makers"), shareholders, and customers ("users").

Okay, now that makes more sense. Was that so hard?

Like the three-leg stool, remove one and there is no corporation -- that "legal fiction" I had in mind when I mentioned "quadrumvirate". That fourth part would be law. Remove law, which refers to the rest of us in relation to the corporation, and there is no corporation.

That makes perfect sense, and I agree. It's easy to agree when you say something well-reasoned, rather than keeping the reasoning to yourself and making vague pronouncements that, without any kind of contextual clarity, mean nothing to anyone who isn't basically living inside your head.

Your non sequitur is my sine qua non.

Well . . . it certainly seems sometimes like spouting non-sequiturs is your sine qua non. I don't think that's what you meant, in this case.

Of course, looking through all this, I still don't see anything that refutes my statement that anything standing in the way of shareholder value is "secondary at best" amongst the corporate officers'/agents' priorities. All you've said up to this point by way of explanation is a bunch of stuff I might have said if the conversation had gone in a slightly different direction, though in different words.

I said, "part". I did not say, "gestalt", which is you off doing your thing, again, as with, "poppycock".

Cluestick:

When you say something that doesn't make much sense as-is, and I try to present an explanation so I can ask if that's what you meant, I have to offer what I think is a paraphrase of what you said. As you should be aware, a paraphrase will, by definition , involve using some words you did not. In this case, one of them is "gestalt". If what you said was not effectively paraphrased by what I said, the correct response would be to say something like "No, I didn't mean that exactly. What I meant was this." That's where you start offering an explanation of what you said. I don't see how saying you never used the word "gestalt" in any way helps improve communication between us.

I'm frankly shocked and dismayed that you require an explanation of how conversation works, but given the last several years of you acting like you don't know how to communicate effectively (or don't want to), I guess I shouldn't be surprised.

Rather than these parts and their respective imperatives functioning co-equivalently, you put just the one at the top: success of shareholder investment, then proceed linearly and hierarchically down to the death of your proposition.

I'm losing you again. Did you say there was some other priority than shareholder investment? I remember you talking about parts of the corporate whole, and insulting me snidely and circumspectly, but I don't recall any other specific priorities being mentioned. Please elaborate on what you've implied here, if I read it right.

That proposition, proprietary, by the way, on account of your having needed two whole first paragraphs to set it up (tch-tch). How else could it exist.

Are you sure you don't mean some other P-word -- maybe "pedantic"? I wouldn't dispute that. In fact, give the word's roots, I might take a little pride in it.

People seem to like my tendency to get into some depth when I'm explaining some strictly technical matter, but for some reason it's not always appreciated quite as much when I'm discoursing about some less clearly defined subject. Go figure.

I take back, "scarecrow". It was an abortion.

Err . . . okay.

In a natural, free market place, customer satisfaction (user security) is subject to the law of diminishing returns. Maximizing security AND profits means you're going to have to provide customers with at least better than average security; otherwise, your customers are going to bail and take your profits away.

In example 1, you're giving law enforcement carte blanche to go on a never ending search for irregularities. That's a surefire way to kill corporate profits via lawsuits, because anyone can find irregularities that are of questionable justification in court. And where there is a question, there's blood in the water for legal sharks. Your ethical obligation to the shareholders is to minimize legal entanglements. Your ethical obligation to customers is to minimize exposure. The ideal is to subject law enforcement agencies to run the gauntlet of option 1, and have option 2 available if they succeed.

Example 2 is a false dilemma. I remember software built in the 70s and 80s that was developed under option 1, that worked wonderfully, but the company died anyway, ostensibly due to overhead costs; which would support your arguement. However, I've also seen major products take a massive hit because customers were so pissed off over option 2 that they bailed to a competitor's product. The ethical stance to satisfy both parties is to work a compromise between the two, and keep both groups fully informed as to what and why you are doing that.

Finally, example 3. Why does Microsoft immediately jump to mind? Probably because they exclusively adhere to the second option. The problem with that is that every time the truth gets out, and it always will, it engenders more dissatisfaction with the company for having the vulnerability in the first place, and for lies of ommission to their customer base in the second place. The end result is an over all net loss; hardly ethical to either the shareholders or to the customers.

You're acting like massive, government-entangled and -regulated corporations are part of a "free" market. They aren't. They're legal fictions created as a way to manipulate market forces, thus adding a strong element of (mis)management to the economy.

Maximizing security AND profits means you're going to have to provide customers with at least better than average security; otherwise, your customers are going to bail and take your profits away.

That'd be the case in a free market. A free market is not what we have in the US, so that's not necessarily the case.

In example 1, you're giving law enforcement carte blanche to go on a never ending search for irregularities. That's a surefire way to kill corporate profits via lawsuits, because anyone can find irregularities that are of questionable justification in court.

Are you saying that, in question A, my answer 1 is the wrong answer and answer 2 is the right answer? I'm confused. What do you mean exactly?

Example 2 is a false dilemma.

It's not a dilemma at all. It's 1. an ideal and 2. a very real example with which we are probably all familiar.

I remember software built in the 70s and 80s that was developed under option 1, that worked wonderfully, but the company died anyway, ostensibly due to overhead costs; which would support your arguement.

It only supports my argument in that the public corporate model has created a market in which good software as a commercial enterprise is difficult to sustain. Eliminate the business realities of the public corporation and you'd eliminate the obstacles to paying ethical attention to security that keep quality software from being as profitable as crap software.

However, I've also seen major products take a massive hit because customers were so pissed off over option 2 that they bailed to a competitor's product.

That's what happens in a market correction, which -- while rare in the current system -- is still possible, and (in large part because of its artificial rarity) can be quite devastating. It's the same kind of effect we're seeing in the wake of the housing bubble's burst: a massive, painful market correction that could have been avoided or at least minimized by simply not screwing with natural market equilibrium in the first place.

The ethical stance to satisfy both parties is to work a compromise between the two, and keep both groups fully informed as to what and why you are doing that.

When you compromise with evil, evil wins.

Choose software produced under a development model whose motivating forces are roughly aligned with your own needs, and you're far more likely to get good software. Choose software that is produced by a public corporation, though, and you play with fire. It's Russian Roulette, and if you play Russian Roulette long enough you will eventually lose.

Finally, example 3. Why does Microsoft immediately jump to mind? Probably because they exclusively adhere to the second option.

I'm surprised you didn't say the same thing about question B, actually.

The problem with that is that every time the truth gets out, and it always will, it engenders more dissatisfaction with the company for having the vulnerability in the first place, and for lies of ommission to their customer base in the second place. The end result is an over all net loss; hardly ethical to either the shareholders or to the customers.

Corporate responsibility, as essentially defined by law, is focused on the short-term -- because the shareholders are focused on the short-term. It's kind of inevitable that the shareholders will be focused on the short-term, too, thanks to the way stock markets work. When your organization becomes a publicly traded corporation, many facets of long-term business strategy are screwed.

The struggle that most executives are pinned in to is the marriage of how to assuage the security folks? concerns (who are necessary like toilet cleaner, of which I am one, security folk that is?) and the appeasement of the C level. With the C?s watching the bottom line and listening to the board who are concerned about cost, viability, protection of assets, meeting minimum legal requirements etc? The executives are caught with people hanging on both ears and most, IMHO, are not mentally or technically prepared to make the decisions they are forced to in this arena.

I find your writing to be thought provoking and very clear. I always find articles by reading the abstracts in my Tech Republic newsletters. It is an interesting co-incidence that I seem to read a lot of your articles.

Keep up the good work!