All trademarks are the property of their respective owners. Although this work is based on actual events, some characters, situations, and dialog have been dramatized, and some names have been changed.

Cover design by Mark Pedersen (http://www.lancebubo.com)

Edited by Joanne Starer

Please note: Editing occurred on this text prior to formatting and any resulting errors are the author's and the author's alone.

First Printing — November 2010

Copyright 2010 Stephen “Stepto” Toulouse

978-0-557-87127-8

This is dedicated to Momto, Kim Toulouse.

Her Maiden name was Pope, and she chose to keep “Toulouse” post-divorce because that was the name of her sons. Nothing could speak more to her dedication and love and sheer awesomeness than that.*

Thank you, Mom.

____________________

* Except that my mom also has a tattoo she got recently. That's even more awesome. Don't worry, Mom. This type is tiny and Grandma probably can't read it.**

** Grandma, Mom has a tattoo. That makes her cool. It's just how it works. You should get one.

Contents

Intro

Genesis: Beyond the Biblical Reference, Of Course

Genesis Part 2: Genesis Harder

The Great “MS-DOS 7” Caper

A Maze of Twisty Passages, All Alike

Oddly, Bird Was Never the Word

Chicago Will Always Have a Place in My Heart

Sometimes Your OS Is Like Diogenes, Looking for an Honest Hardware Report

That One Time, During the Windows 98 Launch, When the Pigs Got Sick

The Art of Interviewing at Microsoft

Sydney, Where the Bare Ass Spankings Lie

Microsoft Career: 2.0

The Longest Call

Hennessey

A Typical Work Day, 2005

The Redmond Reality Distortion Field

Perspective

SecTor Keynote, 2008

Drinking from the E-mail Fire Hose

On Bill Gates

How to Be an Effective Spokesperson

Playlist Shame

Bloggin' in Millennium

Looking at Microsoft

Blogging at Microsoft (2006)

Don't Be a Dick

Come a Long Way

E3 2009: E, Cubed

I've got the PAX

A Career in Infinite Repose

Outtro

Intro

I'm not totally sure how it happened or where the time went, but January 30, 2010 (the year we make contact*), marked fifteen years of my working at the Microsoft Corporation. In those fifteen years, I've gone from entry-level product support person to company spokesperson to working for the Xbox LIVE team (my current assignment as of this writing). Looking back on fifteen years, my career trajectory isn't what surprises me. What surprises me is that I worked with Microsoft at all.

I was born on August 6, 1972. Star Trek: The Motion Picture was the first film I ever saw in a movie theater. My second film? Star Wars. I grew up using an Odyssey 2000 game console and then an Atari 2600. I read comics and wrote programs in BASIC—later, (badly) assembly code. I had almost every Star Wars action figure, and at least several of the die cast and plastic Star Wars toys. I knew GoBots were trash and Transformers were king. Pac-Man was better than Donkey Kong, although Donkey Kong was awesome. Red Baron without the gigantic fake red biplane enclosure for the Arcade screen was ghetto Red Baron. Vector graphics based Star Wars is still one of the best Star Wars games ever made; Red five will always be standing by.

I soldered add-on boards to make my Atari 1050 disk drive read higher density floppy disks (known as making the drive “happy”). I learned how to use a mouse on Apple computers. I knew a mainframe from a micro-computer from a mini computer.

I was terrible at girls, terrible at sports. I got beat up a lot in elementary school, junior high, and high school. College was my first experience in not ever having to worry about a popular idiot wanting to pummel me for alpha male status during my education. I started using the Internet in 1990 on VMS/VAX* based systems, and I used Gopher and Veronica as much as I used FTP†. My prized Dungeons and Dragons character was a wizard named Haydentwink Rebuzbicvak.

I had clear geek credentials. I was at very minimum low-tier Geekerati, for fuck's sake.

How in the world could a pedigreed geek like me end up working for the most evil place in geekdom for fifteen years?

The answer? Microsoft isn't, and never has been, evil. No one could be more surprised than me at this turn of events.

Break it down like this: it's early 1994; I'm twenty-one. I'm vaguely aware of Microsoft, but certainly the company had yet to attain its universal “evil” reputation. At that time, only rabid partisans thought the company was undeserving (and perhaps evil in acquiring) its status among technology corporations. In fact, Microsoft was in the middle of one of the more exciting development cycles for computer operating systems in geek history: the Chicago Project. This Chicago Project … “thing” was supposed to turn into Windows 4.0. It was going to be the world's first widely used 32-bit computer operating system. Microsoft was on the cusp of breaking through from being the staid provider of computer operating system wannabes to launching what might be the single most successful consumer product of the decade.

Well, okay. Sign me up.

I'm thirty-seven as of this writing. The entirety of my adult life has been spent working at Microsoft. I've never known any other type of corporate existence or job, and I can only dimly remember what it was like to not have a fly-by-night, day-to-day type of job like the ones I had before. My very identity is tied up in a name I was given at Microsoft: Stepto, the combination of my first name and last name that the computer spit out when creating my e-mail address. When I began at the company, I never dreamed I would be here this long. In fairness, however, that was more because I felt so grateful to have the job that I was scared they would figure out I wasn't worthy and would let me go.

It occurs to me that fifteen years is a long time to be affiliated with anything that isn't blood related or that you don't sleep with. At this pace, in six or so more years I will have spent half my life at Microsoft! Yet it has been fifteen years I wouldn't trade for anything.

So, why are you holding (or maybe e-holding, or maybe listening to) this tome?

To celebrate this most unlikely of geek lives, I've taken the time to collect and polish a lot of the Microsoft lore I have put on my blog at Stepto.com. This book represents a collection of those stories, rewritten and expanded.

Some of the stories are very specific to Microsoft; one or two of them are tangential, made up of an observation or comment in which Microsoft serves a small part. Hopefully all of them are interesting to you, wonderful person who just exchanged money for my goods and services. The impetus for compiling all of this into a book was mostly that many of the stories I tell here aren't especially technical. Instead they focus on the everyday life of being a Microsoft employee away from a lot of the crazy, emotional, and competitive arguments that tend to accompany discussions of the place. Having said that, from time to time I will “go all technical” on you when relating a story; I'll try and explain acronyms and provide footnotes where I can.

One thing I do want to be clear about: you're not going to get detailed accounts of executive meetings or high-level decisions where I explosively detail the exact moment when the cloak shrouded Knights Gateslar decided to kill some poor company or technology while cackling and twirling their moustaches. Nor will you get some type of apologia about Microsoft or its history. What you will get are a lot of observations about the evolution of the company, details about the things I have been witness to, and some stories about Microsoft you might not have heard. Occasionally I might exaggerate a situation and will strive to overdo it to point out where that occurs. But everything in this text that might make you stop and go “No. Way.” actually happened. When I'm describing events as I saw them, relating to something specific to Microsoft, I'm not making it up. Along the journey, if I manage to elicit a chuckle or two, I will consider the time well spent indeed.

As a final thought, writing this intro, I'm thinking about that young kid waking up at 7:00 a.m. (!) for his first experience in the corporate world of America. I had given up a fairly decent job with a trio of restaurants in Dallas that my family had worked in for years, for a contract position at Microsoft—a position that had no guarantee of being a career.

I'm wondering what I would say to that kid if I could meet him now. I'm guessing he'd say “Holy shit, I got fat! And bald! But it looks like I can afford good beer, finally.”

Fifteen years.

I'm not the kind of person who would say, “And here's to another fifteen,” because you never know. I will say I am enormously lucky to have seen the things I've seen at the company and am incredibly fortunate to do what I do there now and work in the video game industry, my first love.

Plus, I really can afford the good beer now, so it would be a real disappointment to my twenty-one-year-old self to let that go.

Speaking of beer, I'm going to go have one now. Grab one yourself, or your beverage of choice, and we'll pick up again here in just a second.

____________________

* I swore an oath that every time I write 2010 during the actual year, I will refer to it as “The year we make contact,” after Peter Hyam's sequel to 2001: A Space Odyssey.

* VAX stands for Virtual Address eXtension. Isn't that annoying? VMS stands for Virtual Memory System, although why they didn't go super edgy and use “sYstem” I don't know. Point being, they were big mainframes you had to access with computer terminals.

† File Transfer Protocol, a way to move files over the Internet.

Genesis: Beyond the Biblical Reference, Of Course

How I came to work at Microsoft in the first place is simple, and in compiling all these stories I am reminded that Steve Jobs once told a graduating college class that dropping out of college was good for him.

I couldn't agree more: dropping out of college was the best thing that ever happened to me. Of course, I don't mean dropping out in the “1950s high school drama white T-shirt and black leather jacket and then grow up to be the muttering guy behind the 7-11 counter” sense. I think everyone should give college a chance. In the end however, college isn't for everyone. My college experience was soured by a school trying to raise its academic reputation by forcing all freshmen and sophomores to adhere to strict degree plans in their first two years, which had to be approved by special degree counselors. I went to Southwest Texas State University, since renamed to something else. No really, my school became so self-conscious about its party reputation that not long after I left, it completely changed its name. I think now it's Texas State University: Genius Dome!

It didn't take me long, just a single semester, to figure out being forced to take high school algebra all over again (this time paying a lot of money for it) wasn't for me.

I am by my nature a hacker and a tinkerer. I believed subverting the rules was my first, best destiny. When confronted with a horrible semester of college spent taking classes I had already stumbled my way through two years previous in my junior high school year, I sought ways to make the following semesters more palatable.

Pretend it's 1990, and to the extent something like academia has incorporated computers outside computer labs, it's done in a very clunky way. You fill out a bunch of paperwork, and then data entry people log it into the computer. The paperwork in this case is considered authoritative. As long as it bears the proper signatures, the data will be entered unquestioned. At my college, you had to first fill out a schedule and then have a counselor stamp it for entry into the computer to become your actual schedule.

So I learned to fill out my course schedule in erasable ink. (Thanks, Paper Mate!) I would then take the filled-out schedule to the degree planner to have them sign it and stamp it. Thus approved, I then went back and erased everything and signed up for the classes I really wanted to take. Ah, you have to love the pre-automated days of 1990.

By the time I was out of money two years later, I was completely soured on the college experience from an education standpoint. Degree planners would constantly tell me I was unhappy because I was screwing with my schedule and taking classes above my level, but I was learning more on my own than in class. I initially focused on computer science as a major, but the state of computer science was awful in universities at that time. CS101 started off with “This is a keyboard” using ancient IBM PCs sans hard drives, and CS102 consisted of Apple Macs and word processing. Nothing at all against the Mac, but learning word processing and how to use a mouse were skills I picked up on Apple computers long before college in 1990. I ended up switching to English and philosophy as a major, but even then we never read the books I wanted to read or covered the philosophy topics I was interested in. There was only one class I really felt I enjoyed and learned a lot from, and that was the senior-level epistemology class I took thanks to erasable ink. It was the only class on theory of knowledge offered. I struggled mightily in it, and loved every minute of the struggle. It was the one time where I really felt that I was being challenged by the college learning process.

I'm by no means saying I was too smart for college. Through many classes and more than a few challenging teachers, I was taught the limits of my abilities. My problem with college was with the learning culture and the learning process. It didn't engage me, and with rare exception, it didn't make me feel like the effort yielded any form of reward.

Dropping out was a choice, and it forced me to figure out what I wanted to do. I still wanted to learn, but I also knew that the window to be successful in life after dropping out of college was extremely tiny, mostly measured in months. I quickly got my own place and a good job. Up until that point in my life, I had computers as a hobby. I had five years of restaurant experience cooking and waiting tables, and I had half the credits to a degree in something I would most likely never make any money in. So I ended up figuring out that I needed to learn the deep computer science skills on my own through tinkering with computers and studying the top computer periodicals at the time. That self-taught regimen, because it was a hobby I found fun, later resulted in my passing my interview with Microsoft.

It's been a long ride from there, but I don't regret not getting a degree. I have worked hard at what I do and have a ton of real-world experience now that college could never have given me at that time.

So if you're reading this and you are just about to graduate high school, my advice is roughly the same as Steve Jobs': live your own life. Don't be afraid to chuck away something that isn't working for you, because life is too short for that. If we're also taking Steve Jobs' advice, let's be sure to remember not to get forced out from the company you founded, but if you do, be sure to come back later and save its bacon.

Make your choices informed ones. Go to college if you have the means, even if it is just to understand that the college experience isn't for you. My five semesters of college might not have yielded a degree, but without them I wouldn't know a whole hell of a lot about myself that is critical to who I am today.

So. I left college and got a place and a job. How did I land at Microsoft? I got lucky. In the spring of 1994, the local Microsoft campus in Las Colinas (a suburb of Dallas known for its high-tech work force) was hiring for technical support positions. I applied, interviewed, and was hired.

And thus was I introduced to a very, very weird world: the corporate world.

Genesis Part 2: Genesis Harder

The job I originally started on at Microsoft was a contract position. People who took these positions were known as variables or gray badges, for the color of their building access card. You and I know them by a much simpler term: temps.

This is the first example of Microspeak that you are going to find in the stories to come. Microspeak is not a term I have come up with. Our internal newsletter (previously known as Micronews) used to define unique language constructs and word use-ifications that exist within Microsoft like some type of linguistic cancer under the column head “Microspeak.” Many other prestigious authors have referenced the term. Thus I have used it here. So be warned, from time to time I will drop some Microspeak on you like jive talk in an Airplane! movie. I'll take on the ask to effort footnotes so that net-net you understand the jargon without using too much bandwidth.*

In the early nineties, temps at Microsoft worked for several different staffing agencies. Mine was known as Volt Technical. Under this arrangement, I worked for Volt, not Microsoft. Once I found out the major differences between Volt employees and Microsoft employees, I formed an almost bizarre loyalty to the agency. You had to, or you were forced to confront the absurdity of the situation at face value.

As a temp, you were issued a gray badge instead of a blue one, and your e-mail address began with an A- or a V-. Your building access was restricted to your work shift, and you were not allowed to remotely access the Microsoft corporate network, known as RASing in in Microspeak, after the Remote Access Service feature of Windows NT. This, like onions tied to our belts, was the style at the time.

____________________

* Seriously, some of us really talk like that. Translated, it means “I will try to add footnotes so that at the end you understand what I mean without having to work too hard at it.”

All of these restrictions sat upon one fact: most states where Microsoft used temps were known as “employment at will” states. This meant that at any time, for any reason, you could basically walk out of the job with no penalty. It also meant that Microsoft, at its sole discretion, could terminate your contract. Horror stories abounded of gray badges being let go for trivial reasons. I imagined the conversation sounded much like this:

Microsoft: “Hello, Volt? Yeah Stephen Toulouse came in today with one less hair on his head than normal. We'll be ending his contract.”

Volt: “We'll have a replacement ready immediately!”

Microsoft security would supposedly show up at the person's desk, turn off the computer, collect the access badge, and the individual would be walked out of the building with any personal effects. The stories were so terrifying that walked out became the Microspeak term used for any time a gray badge got let go.

“What happened to Lee?”

“He got walked out.”

That last bit was usually whispered, lest naming the beast made it manifest.

But for all the terror and legends, I never heard of someone being walked out who didn't deserve it for performance reasons or some other violation of policy. The whole “employment at will” situation was never abused in my experience. People got let go for the same reasons a full-time employee would have been terminated: poor performance, violation of the rules, or both. It's hard to argue with that system.

That didn't make us any less timid, though. There was a lot of policy to adhere to. Gray badges could not join non-business e-mail discussion groups. We had no access to the Microsoft company store and were not allowed to install or use any software not directly related to our jobs. (That included any Microsoft software.) If Microsoft had a company event, that was an unpaid holiday for us.

Of course, this type of bifurcation of the work force wasn't unique to Microsoft. Yet it's no surprise that gray badges formed a tight clique, watching the Olympian blue badges pass us in the hall or the smoking area, resplendent in their shining innate superiority and glowing robes made of awesome.

Periodically, Microsoft would go on a hiring round and convert gray badges to blue badges. This usually involved a set of interviews followed by an offer letter if you passed. Once the offer letter arrived, your affinity to the gray badge commoners (and loyalty to Volt) was shed like a leprous skin as you ascended into a new plane of existence as a blue badge. Your first day with that badge, you would emerge gleaming and pure from the elevator, carrying an armload of new purchases from the Microsoft company store, and proudly install Microsoft Space Simulator in front of your gray badge friends just because you could.

So that's the corporate world I entered at the tender age of twenty-one. I worked my time as a gray badge and was hired by Microsoft for a full-time position on January 30, 1995.

In the introduction, I noted that in a way my identity today was derived from Microsoft. Growing up, I always had a problem with names. As a child, I was called Jamie, derived from my middle name, James. This resulted in no end of beatings in elementary school. When I moved to new locations and went to college, I endeavored to change it to Stephen. It was worth people not understanding the biblical reference and pronouncing it Stephane to move from Jamie.

When I came to Microsoft as a contractor, the algorithm that generates e-mail names collapsed my first and last names to give me the e-mail name A-Stepto. As mentioned earlier, the prefix A- was because I was a contractor.

At Microsoft, when you are given a pronounceable e-mail name, it's highly likely people will use it to refer to you. It wasn't long before I was tagged Stepto (pronounced “Step-toe”). Why not pronounce it “Step-too”? I have no idea. I actually didn't come up with it. It became the default way everyone referred to me.

“Stepto's taking the swing shift.”

“Have Stepto handle that one.”

“What are Stepto's current call stats?”

It stuck. In fact it stuck so much that when I got hired by Microsoft they regenerated my e-mail name to be SToulouse and my manager Kent had it changed back to simply Stepto. He was worried no one would know who I was. To this day, I still introduce myself sometimes as Stephen Toulouse, and when I get a blank look, I say, “Stepto,” and they suddenly understand. When I moved from Dallas to Seattle, it required all new network credentials for our corporate network. The person who filled it out evidently knew me and put in the central employee database that my name was Stepto Toulouse. He assumed Stepto was my first name.

After a while being referred to as Stepto became second nature to me. I was Jamie to my family, Stephen to my non-Microsoft friends, and Stepto at work. I ended up knowing more and more people who called me Stepto in my public or Internet work, because that was how everyone at Microsoft referred to me. Over time, I took on Stepto more and more as…well, me. I ended up registering my personal website in the late nineties as Stepto.com.

As a geek, identity was always a problem to work through. One could argue that it's weird, perhaps more than a bit fan boyish, to take my identity from a Microsoft e-mail name. I'm sure more than a book could be written on someone writing a book called A Microsoft Life, referring to themselves by a name derived from Microsoft. But I never once looked at it as a Microsoft thing, or anything I chose for myself. The people I liked and respected called me by that name, and it became more and more familiar for me to identify with it. At this point in my life, and actually for a while now, I'm Stepto not because of Microsoft, but just because that's what I ended up being called by so many people who I look up to and respect.

And it all started that day I held my gray badge in my hands and the printout that had my log-in information. I was going to sit at a desk. Start each morning with coffee. Work business hours. Not be allowed to make dirty jokes.

What would be a good way to break some of the rules?

The Great “MS-DOS 7” Caper

The Chicago Project, which later became Windows 95, was a fascinating bit of technology. Up until that point, most mainstream operating systems were 16-bit. This is because most processors in IBM-compatible PCs were 16-bit at the time. In the early nineties, 32-bit processors became cheaper and more people wanted to take advantage of their capabilities. Some operating systems were installed on top of a 16-bit operating system to unlock 32-bit capability, but it was limited. The most common 16-bit operating system at the time was Microsoft Disk Operating System (MS-DOS). Some operating systems, like OS2 2.0 and Windows NT, were entirely 32-bit and replaced MS-DOS completely.

If you're now lost in the world of bits and these old-fangled technical terms, don't worry. This is all just background, like the opening scrawl in the Star Wars prequels. Except mine is a lot more interesting than learning about trade disputes and envoys.

The Chicago Project sought to create a mainstream operating system that was compatible with existing 16-bit MS-DOS and Windows software, while creating an entirely new market for full 32-bit software to use the PCs new capabilities. This is a lot like trying to make everyone fans of both The Eagles and Creedence Clearwater Revival. It worked in the end because the engineers figured out a way to simply use the 16-bit portion to fully transition to the 32-bit portion. This occurred during the pretty pixilated Windows flag you used to see when the computer started up. Again, if you're lost in “bitness,” relax your eyes on the preceding words and they form a magic eye style picture of a unicorn!

The last version of MS-DOS sold was MS-DOS 6.22. But the version of MS-DOS that loaded up Chicago during its development phase was tagged as “MS-DOS 7.”* That was all removed prior to the product being completed and renamed Windows 95, but for a while there during the beta of Chicago, you could boot format a floppy with a development version of “MS-DOS 7” and then take that over to a computer running vanilla MS-DOS 6.22 and upgrade it such that the computer was now running a version of MS-DOS that didn't technically exist.

Thus was born the great “MS-DOS 7” caper.

The development of the Chicago Project took place during the time span where I was a gray badge through to after I was hired full-time. But for the purposes of this story, I was still a temp. As contract employees, we were not allowed to take any Microsoft software outside the building. In addition, once we were added to the Chicago Project beta for installation on our testing machines at work, we were strictly forbidden from taking that technology home or allowing it in any way to leave the building. Random bag searches from security guards were pretty rare but could still occur if someone saw you stuffing a backpack with the fourteen floppy disks it took to sneak a copy of Chicago out of the building.

However “MS-DOS 7” fit on a single floppy. And for some reason, more than a few of us believed it would be really cool to run the current 16-bit released versions of Windows on our home machines using this underlying development version “MS-DOS 7” kernel.

Keep in mind that some of us contractors weren't the brightest of bulbs when it came to professionalism and adhering to our contract agreements and just being smart in general about risk-taking. This is why it's the “MS-DOS 7” caper and not the “MSDOS 7” heist or a name that is less reminiscent of something the Muppets might do.

____________________

* I want to be clear: There never was a “MS-DOS 7” as a standalone product made by Microsoft. I am reproducing here the string that was provided by the Chicago beta operating system. The trademark MS-DOS is used here solely for accuracy of the story, and is not intended to imply or document the existence of any such standalone product. This is reflected throughout the text by the use of quote marks for the name. I'd like to wave at my Microsoft lawyers here and say hi and thank you very much for reviewing this text.

Oceans 11 it wasn't. The plan was as simple as it was stupid. One of the contractors would simply sneak out a “MS-DOS 7”-formatted diskette. Once out of the building, he would duplicate it and hand it out to the others. Once you had the disk in hand, you could go to your home machine, boot from the disk, run a quick command from the diskette, and it would automatically insert the new software.

Once done, you could use most of the new Chicago command prompt commands, including support for long file names on the hard drive. Windows, of course, would not see the long file names, nor would anything other than Chicago, but it was still kind of neat to see. Remember that up until that point, all file names for files in the PC world had to be eight characters with a three-character extension. Whereas today, you can have “This File is Not Porn I Promise.mpg,” back then you had to have “NOTPORN.MPG.” And any file called that must certainly be porn. Sadly, that was pretty much the sole benefit to trying to run the Chicago version of DOS without Chicago itself.

So that was the plan. Sneak the disk out, dupe it, use it, then… profit? But who would do the sneaking? Meetings were held on this, whispered in corners or empty conference rooms. There was a hierarchy to the cabal: those who thought up the plan were at the top, and those who would simply benefit from the plan were the bottom of the group. But who would be Alpha? Which one would risk his job and the chance at a permanent position with Microsoft, in addition to possible legal ramifications, so that all of us could have non-usable long file names on our home machines? It's probably no surprise that there was a shortage of volunteers.

That is until Hank got a full-time job as assistant manager at a local CompUSA. The job didn't start for a week, so he figured he'd be the hero. The plan was carefully setup and all ready to be executed on his last day, a Friday. He would format his testing machine and update the floppy during a reinstall of Chicago, just in case anyone happened to be looking around. Updating a floppy in that process was routine business.

The contractors gathered in small clusters and passed news in hushed whispers like escape conspirators in a prisoner of war camp.

“Hank's begun the install.”

“He brought the backpack with a million pockets; the guard probably won't even bother to search it.”

“Johnson says he heard of this guy one time who snuck out OS2 one disk at a time for forty-five days.”

“What are you going to name your first file?”

“Why do you keep whistling the theme to Bridge Over The River Kwai?”

The day passed with mounting tension. Doubts arose amongst the dim: “Wait, is this worth it? What if someone finds out I have it? What am I doing?”

Then, at roughly 3:00 p.m., the unthinkable happened. Something not even the smartest among us could have foreseen: Something that truly cast the entire endeavor in the harsh light of stupidity that it deserved.

An e-mail arrived in all our in-boxes stating that we contractors were now allowed to take the full builds of Chicago home for testing.“Floppies are in the break room. Have a fun weekend, everyone!”

Hank never got that e-mail. His intention was that he was going to format all his machines, install the Chicago build to get the floppy, and then walk out the door and tell the contract agency over the weekend he quit. Around five o'clock, he calmly walked out and headed to the rendezvous point at the smoking area to notify the couple of people designated as messengers that he made it out okay.

Imagine his surprise when there was no one there. Knowing the time spent in planning, and that there was supposed to be at least two people to report back to the larger group that he made it out, he concluded the whole thing had been compromised and he just got out of the building by sheer luck. He panicked and bolted, not knowing that we were all at our cubicles copying (with the unbridled glow of relief and actual permission) all fourteen floppies and dreaming of playing with the new OS all weekend, glad that our hare-brained scheme was now dead.

The new build for us to take home, ironically, changed the version string of the underlying real mode kernel to Chicago and the build number, “MSDOS 7,” which of course never officially existed, was gone.

Looking back, it's not difficult to understand how colossally irresponsible and stupid the whole thing was. Most of the contractors at the time were young, almost all under twenty-five, and caught up both in the magic of even being at Microsoft and the unbelievable hype that was surrounding the new technologies in this nascent version of Windows 95. I wasn't exaggerating the risk vs. reward here: breaking the employment contract, all for functionality that we wanted for altruistic reasons (none of us were going to go sell this or pirate it or give it away). But in the end it offered no practical benefit. And to top it all off, Microsoft was planning all along to expand its pool of testers to include us.

Thankfully, the great “MS-DOS 7” caper was as short lived as it was stupid.

A Maze of Twisty Passages, All Alike…

This is the part where I get to rant for a second, so please bear with me.

Deep Breath.

Know this, for after my fifteen years at the company I can say it's a fact: Microsoft's developers/software/executives/employees/actions are not, and never have been, intentionally evil.

Microsoft's building designers, however, are.

Actually, that's not fair. The designers are just doing what they are told: maximizing available space for working environments, all within a budget.

But the people who design all the directional signs inside all Microsoft buildings? Spawn of … someone really, really evil. Like Hitler. Or Stalin. Who's worse, Hitler or Stalin? Or Satan? Is Satan as bad as Hitler, or worse? Okay, the sign people are spawn of Hitler, Lizzie Borden, Satan, and Billy Bob Rubik, designer of the Rubik's Cube. Thanks Wikipedia.

It's bad enough that in the from-the-top-down X-ray view every Microsoft building resembles a maze from one of those “1001 Mazes!” books you see at the checkout at the grocery store. It's bad enough that even inside some Microsoft buildings, the first floor is designed completely differently from the second floor, and the third floor bends space and time such that I swear I once saw David Bowie walking on the ceiling.

Those two things alone would be villainy. No, what is worse, far worse, is the fact that all the interior signs helpfully lead you right like a lamb to the slaughterhouse. But the signs end up leaving you just short of it, wondering if you missed a sign—and by the way, what's with all the lambs screaming?

Here's an example. To be mindful of Microsoft's security protocols, which restrict our taking photos of our buildings with the level of detail I am about to describe, I am going to instead provide you an approximation of the hell we have to go through trying to find our way around.

Setting the mood: you're in an unfamiliar building for a meeting. You've arrived with more than five minutes to spare. Plenty of time! You exit the elevator and are greeted with this initial sign:

← 2000–2200

← Restroom

→ Kitchen

→ 2300–2400

→ Conf Rms 2202, 2205, 2206, 2576, 2999

You know that your meeting is in conference room 2576, so you exit the elevator to the right, intending to go to the kitchen to grab a drink because it's on your way. You walk down the hall to the next sign, which says:

↑ 2300–2400

→ Kitchen

→ Conf Rms 2202, 2205, 2999

That's odd, you think, where did 2576 go? Oh I'm sure there's another sign near the kitchen, you decide. So you enter the kitchen and grab a coffee. The Microsoft Starbucks coffee machines brew your coffee per cup from a custom grind. It takes about 90 seconds, but you figure you have plenty of time. Coffee accomplished, you exit the far side of the kitchen and find this:

← 2300–2400

↓ Restroom

↑ Conf Rms 2576, 2999

Oh, you think, see? There it is. You continue down the hall. You now only have a minute or two before your meeting, so you scan for the next sign and see:

↑ 2350–2491

↑ Restroom

↓ Kitchen

↓ 2300–2349

→ Office Supply

You're momentarily surprised that the restroom has now folded space to move in front of you, but then you realize that certainly there would be more than one restroom on the floor. But then you pause to realize the conference rooms have disappeared from the sign to be replaced by the office supply room.

Now you're completely confused, because the last sign had a room range of 2300–2400 but this new one expands that to 2491 and sends you in a different direction for the other rooms. Neither room range matches the conference room. Figuring that surely a conference room like 2576 would be in the general direction of the increasingly larger-numbered offices, you proceed gamely in the direction of the 2350–2491 range. Your meeting is now officially started when you reach 2491 down some long, deserted hallway and stumble across conference room 2999, filled with people you do not know. On the door is a sticker that says “meeting moved to Conf Rm 2202 (by the stairs).”

Now people in the offices around room 2999 are kind of looking at you because you probably just uttered out loud, “You gotta be fucking kidding me.”

Your smartphone/watch/internal timing mechanism informs you that you are now three minutes late. You hustle back down the hallway to the sign you last passed, only to see that totally different signs are posted facing the other way:

↑ 2491–2500

↓ Conf Rm 2999

← 2000–2050

← Kitchen

All right, now you are six minutes late and you still have no idea where you are in the building. You get a text message on your phone from your boss or other helpful co-worker trying to protect your reputation as not being one of those people who is always late:

“VP is here. We're all waiting on you to start.”

The VP? The vice president of the division is there? “Oh my God!” you may or may not exclaim out loud. You run back to the elevator.

On the way you pass conference room 2202. In your haste and panic, you think you recognize a friend of yours in 2202 who is supposed to be at your meeting, but that can't be because yours is in 2576. Maybe they just had a more important meeting in 2202 and could not make it to yours. Regardless, you're seven minutes late and you need to find 2576. Heading in the opposite direction from the elevator's initial sign, you find, five feet away with no signage pointing you there, conference room 2576. It is filled with people you do not know and has a sticker on it saying “[Your meeting] moved to 2999,” which you realize had the sticker on it saying it was moved to room 2202, which you just passed and now realized is filled with your friend, the people, and the vice president for your meeting.

You may or may not at this point scream out loud, “Motherfucker!” and run back to 2202, forsaking signs altogether. You try as nonchalantly as possible to open the door and enter, saying carefully and slightly breathlessly, “My apologies for being late. I couldn't find the room.”

The vice president looks you up and down and says, “But had enough free time to get some coffee, I see.”

The signage situation at Microsoft is so pervasive that among some employees, if you want to send a passive-aggressive signal about who needs the meeting more than you, you make all the invitees come to your building. Likewise, if you need to make peace or resolve a conflict you think you might be wrong about, you schedule the meeting in their building as a peace offering.

No, really.

Oddly, Bird Was Never the Word

Back in the early nineties, Microsoft product support was based in three key places: Bellevue, Washington; Las Colinas, Texas; and Charlotte, North Carolina. All of the support work was done by Microsoft employees or contractors. There wasn't any outsourcing.

Upon graduation from your Fundamentals of Support training, you were assigned an Aspect phone and two computers. One was your work computer, which used our customer information and tracking system to tie itself to the Aspect phone, and the second was called a “break me,” where you tried to reproduce customer issues. I started off supporting various versions of Windows and of MS-DOS. Later they added Windows for Workgroups into that mix after I had my network training.

During busy times, your little light on your Aspect phone would shine red, meaning there were more than ten calls holding, and you spent seven hours a day making your call time and helping customers.

If all of this sounds terribly dry, it is because it was. We spent the day waiting for the rush of calls as Charlotte handed off to Dallas when their site hit closing time and then working straight through until we handed our calls off to the Bellevue site.

It should come as no surprise that enterprising geeks in such a situation would find ways to…challenge themselves. Thus was born the word of the day.

Written on the whiteboard of one of our cabal each morning was a word. Each person in on the game had to work the word into a conversation with a customer. The word usually had nothing to do with technology or our products. Since it was a cubicle environment and we all sat around each other, it was easy to tap the cube wall to have another engineer hear you work the word in. The challenge was not getting caught by the tier 2 people who were assigned to blind listen in on your calls for quality assurance.

Here are some examples of ones I remember:

“Well sir, think of himem.sys as the lamppost that illuminates all the upper memory so your computer can see it.”

“TSRs (Terminate and Stay Residents) are like goats. Enough of them together eat up all the memory like it was grass.”

“Think of DOS as a basement, and Windows is the house that sits on it.”

Eventually this became too easy and we had to move to phrase of the day:

“Well I would describe QEMM as a herd of buffalo, trampling everything in sight.”

“What we're going to do now is reset your graphics settings to the default for troubleshooting. It's going to make your desktop look like shag carpet for a bit, but it's only temporary.”

“What we're going to do now is play a little bob for apples to see if we can find the program causing the problem.”

It was all fun and games until we got shut down when one engineer was blind-call coached and chose a particularly poor way to work in hot-crossed buns.

I'll let you come up with your own joke on that one.

Chicago Will Always Have a Place in My Heart

I imagine that there are a few computer geek epoch moments, like working on the original Netscape Navigator, or helping to develop the iPhone, or working in the early days of Google. This story, written near the tenth anniversary of the completion of Windows 95, documents two of those times for me. The first was the actual completion of Windows 95, and the second was the day people could actually buy it.

I think geeks have a lot of “where were you?” moments. For larger, more historically contextual questions, people might ask “where were you when you heard Kennedy was shot?” or potentially “where were you when you heard Michael Jackson died?” or maybe, just maybe, “where were you when you heard Rob Zombie was going to remake Halloween?”

For me, a big “where were you?” day was the day that the Chicago Project was launched to the world as Windows 95, because I was on the inside.

I still remember the hours before that day, as the build* labeled Build 950r6 was cut and we, as the Product Support Services sign-off team, went to work trying everything we could to break the product. The build numbers were artificially inflated to reach 950. Around Build 582, they figured the product was ready. So they upped the build number to 950 and handed it to sign-off teams. (If you would to know the further detail around the Windows 95 build numbers, I totally recommend you investigate Raymond Chen's blog, http://blogs.msdn.com/oldnewthing/)

____________________

* A build is computer jargon for a version of a product. Software is compiled (or built) from the raw software code into the program that you actually run. Each time you compile updated or new code while writing a software product, it is generally referred to as a build, thus cementing the technology world habit of verbing nouns and nouning verbs. Bill Watterson, author of Calvin and Hobbes, said it best when he had Calvin note, “Verbing weirds language.”

What does sign-off mean? When Microsoft shipped a product, the Product Support Services (PSS) division owned the final sign-off, meaning that the product was finished and we could support our customers who were running it. In a sense, we were the final word in shipping a product. For several builds now (hence the “r6” in the previously mentioned build number), we had uncovered issues in our sign-off testing that had prevented us from signing off and the product reaching Release To Manufacturing (RTM). So it was with weary determination that we took the build and began our work.

We tried everything we could at the time: rebooting right in the middle of file copying during setup, yanking out power cords on first reboot after setup, running old games with odd memory settings. We kicked the computers during install, shouting, “C'mon, show us the pain of the mind!” We ran out to the local Best Buy to buy new modems and weird video cards and random consumer-level software for Windows 3.1 to install. In each case, the product performed exactly as expected or had been documented. We ran through the entire gamut of tests.

Mindless hours were spent running the software through the virtual version of a soap party. I ate more spicy beef with broccoli than I can enumerate in units of volume. It was our job to bash this product. It was our quest to force it to take one cross and form a line to the left.

And in the end, spent and exhausted, defeated and humbled, we signed off. The product was ready for release.

I got home that night around four in the morning, after the sign-off documents had been faxed to Redmond. I sat in front of my awesome computer at the time (24 megabytes of memory!) and clean-installed the final build. After install, I played Doom2 for a few minutes and fell asleep there at my keyboard. I woke up the next morning with CVBNM imprinted on my cheek. Stumbling into my bachelor pad kitchen, I brewed a pot of coffee and decided, Fuck it. I'm not going into work today. I downed that coffee and then proceeded straight to beer and loaded up every single game I had to test against the OS we had just approved, hoping to find some last-minute glitch.

By noon, I was drunk when I popped in a game I had completely overlooked. A new CD-ROM adventure, Star Trek: The Next Generation: Final Unity: Colon: More Colons: Final Colon.

Okay, the colons might not have been in the title itself. But I popped it in, and in a sleep-deprived, caffeine-enhanced, alcohol daze, I started on the first mission. Immediately, I found a huge bug! All the voices were really weird! I was ecstatic. Here, mere hours after sign-off, it was not too late to find a ship-stopping bug. The voices sounded muffled! Distorted! Alternatively sped-up and slowed-down at the same time! Cracking open my fifth beer of the morning, I set to documenting the problem sadsafkjsdaljh zzzzzzzzzzzzzzzzzzzzzzzzzz.

I awoke, this time with DFGHJ imprinted on my cheek. I loaded up the game again, worried it was all a dream. It was all a dream. The opening interception of the remote ship distress code sounded perfect through my speakers. The game ran flawlessly. This beast, slouching towards Bethlehem to be born, was neither a beast, nor slouching, nor shambling towards a metaphor to justify my and all of Microsoft's efforts.

It was, in fact, just an operating system.

Tuesday, 7.11.1995, a great product released to the vast impersonal replication centers for packaging and distribution. What we had no idea of at the time was just what an industry-shaking event we had set in motion. The ramifications and full impact would become clear 8.24.1995, when the product hit stores.

Fast forward.

It was about 10:00 p.m. August 23, 1995. The beer had been flowing freely as the Dallas Product Support Services site, both celebrated and prepared, as were all the PSS sites, for the first flood of support calls the next morning.

The betas were done. The speculation was done. The reviews were in. Windows 95 was a hit, and all our effort at making it a supportable product was about to hit some kind of goddamned fan the next morning. Not that our effort was in vain, mind you, but any effort during that time period of excitement was in vain.

You see, whenever Microsoft released a new operating system, there were a significant number of first-morning calls as people brought the product home and installed it on the myriad of configurations of hardware and software. Even if 99 percent of people have a smooth upgrade, that 1 percent is still going to need help. And Windows 95 was going to be a massive leap. For the first time, an operating system was available that was 32-bit in nature, but that had a 16-bit subsystem (known as the Win16 Mutex, which I still think is a bitchin' name) that would allow Windows 3.1 and Windows 3.0 application compatibility.

Invariably, people were going to run into issues and need support. No, really. I'm serious. Stop rolling your eyes.

We were getting ready for the next day. But that night, as I mentioned, the beer was flowing.

We'd heard the rumors. We'd seen the CNN video. The New York launch had happened, with the Empire State Building lit in the colors of the Windows flag. The rumors of midnight launch parties across Dallas had spread around. Being the largest central time zone presence for Microsoft, we decided it was upon us to witness what would surely be the ultimate Nelson Muntz ha ha moment of our lifetimes. I mean, what would draw this many people to a midnight launch? An operating system? No way.

It was at 10:00 p.m. that some of us decided to sojourn to the local Incredible Universe* store in Dallas to see if these midnight madness sales for Windows 95 were going to draw anyone at all. Thanks to a dedicated designated driver (Hey, Chris. I still remember your sacrifice all these years later!) we piled in and went to the store. Nothing prepared us for what we were about to witness.

The line was wrapped around the store. Incredible Universe had hired a Rolling Stones tribute band to play “Start Me Up” while the crowd cheered and waited for midnight.

____________________

* Think of Incredible Universe as what Fry's is today. Lotsa stuff.

A veteran of the “why won't my AppleTalk work with Windows 3.1” wars, I had sage advice: “Hide your work badges,” I told everyone. Coming from work, our Microsoft employee badges were on display. Anyone spotting our badges would probably have questions, comments, or otherwise. But for tonight, this weird night, we just wanted to be observers.

Midnight hit. We watched in abject shock as the doors opened and a flood of balloons fell from the ceiling of the store. The crowd rushed in, and people literally had shopping carts filled with copies of Windows 95 and different hardware that it was designed to support. The music was deafening, and the ten or so registers were full thirty people deep at all times. We just stood there stunned. People had told us this would be a moment; people tried to warn us epochs were changing. Somewhere that night, I swear I heard Pink Floyd playing “Another Brick in the Wall Part 2.” Finally one of us said, quietly, “Jesus. It's just an operating system.”

Little were we to know it was a lot more than that. It was the first time that computing really reached the common person. The first time that people could afford an operating system in mass production with a simple user interface whose metaphors (for better or worse) educated an entire computing generation about the insides of a computer. It was the moment when advanced general purpose computing broke out of user groups and hobbyist clubs and the workplace to be something that you could take with you on a laptop. It was the first mass-produced operating system to provide Internet connectivity right out of the box.

Of all the things I have done at Microsoft, being a part of the Windows 95 launch experience is second only to working with the Microsoft Security Response Center in terms of feeling an enormous sense of pride at providing customers with something useful and relevant to their daily lives. I remember turning to the group while the sale was going on. “We better get home,” I said, “If any one of these people need help tomorrow morning, we have to be on our toes.”

The next morning, we signed into our phones, already lit up red with East coast customers. While a trolley came around with mimosas and champagne, we gamely dove into the fray. Customers were buying Windows 95 and upgrading old copies of Windows 3.1 that had a million custom drivers and different hardware and old 16-bit shareware applications. I was a mentor on the support queues at that time. That meant that when an engineer was stumped on a call, he took a moment to call a mentor. We were the ones who had supported the product all throughout the beta and knew most of the ins and outs of the OS.

The first mentor call I got was an engineer totally stumped about why two Windows 95 computers using Intel EtherExpress16 network cards couldn't talk to each other. Turns out the customer was using RG-58 coax networking cable and joining the machines through a cubicle wall. Just one problem: he was using the T connector as a barrel connector, screwing up the impedance of the signal on the cable because the stem of the T wasn't terminated. He needed to go buy a barrel connector to join the two cables through the cubicle wall and make sure the T connectors were at the end of each card terminated with a proper 50ohm terminator.

Aren't you glad we have wireless now and you can freely ignore the preceding paragraph?

Immediately after that call, I got an application compatibility question: getting Rise of the Triad to work in MS-DOS exclusive mode, a mode of Windows 95 chiefly designed to help games run. Good thing I was a gamer.

It was a busy day. We took many, many phone calls. Along the way, we picked up some things our internal testing didn't find and that made their way to Windows 95 Service Pack 1. While it was a busy launch for product support in general, overall the call volumes were actually slightly below what people were expecting at the time. It was an astounding twenty-four-hour period, from the launch, through the first day of calls, to the end of that first support shift. We greeted our replacements coming on for the swing shift midday, weary and shell-shocked but happy.

I remember stepping out into the Dallas late-August heat near dusk and taking a deep breath and letting it out. I really didn't know if it would get any better than that.

Sometimes Your OS Is Like Diogenes, Looking for an Honest Hardware Report

I sometimes use the phrase “falling through the wormhole” on my blog. It's not my phrase, but I like it a lot. It means that something, usually music or a phrase or reference to a story or event, causes me to suddenly flashback to an earlier period in my life.

A friend bitched to me, a particularly youthful friend, about how hard it was to create a Windows-7-based USB boot key. He was incensed that you had to use a command line utility in order to create a partition on the boot key that the computer would read as valid to boot from. While he was blah blah blahing about how computers would be far better off if Microsoft had never existed because of how hard we make everything, I tuned the e-mail out and took a trip through the wormhole.

The development of Windows 95 really was a watershed moment in computing. For the first time, an operating system was going to work alongside BIOS development to end the ritual of hardware IRQ jumper settings, arcane memory offsets, COM port conflicts and…

Wait. It's likely some of you young'uns probably have no idea what I am talking about. Imagine this: every time you want to use some new application on your Apple Jesus Phone, you have to solve a Rubik's Cube and then thread the eye of a needle blindfolded, followed by drawing a per-point accurate Mandelbrot fractal using only a thick tip ink quill pen and a Bounty paper towel.

Now you know what it was like to get a 9600 baud modem working under Windows 3.1.

Except it was harder.

When you bought a new hardware card for your PC, you had to physically modify tiny plastic covers over jumper pins on the card precisely such that no one card would interfere with any other card's resource settings inside the computer. Never mind trying to avoid slicing your fingers on the razor sharp interior edges of the computer case.

This was roughly like trying to separate, through mere persuasion only, four extremely hungry fat men reaching for the same rib on a plate. When all four grabbed the rib, well let's just say the whole dinner got interrupted. Never mind the other two who mistake your fingers, bleeding from cuts thanks to the inside of the case, for more ribs.

Thus was born the idea of plug and play or, as it was known before it had an easily mocked name, soft jumper setting.

The idea behind plug and play is that the operating system, the computer Basic Input Output System (BIOS*) and the hardware cards that you installed would never need any other physical configuration than simply plugging the card in. Everything would be handled through software such that conflicts could not occur. If they did, then the operating system, BIOS, and hardware card could be set through software to resolve the conflict instead of creating a situation where the entire machine could not start due to resource conflicts and you had to reopen the computer case to fix it.

Windows 95 was the first widely available operating system that supported this type of capability. At the same time, it had to work with existing hardware set solutions that required the physical plastic covers on the pins. So during its development, a lot of testing went into the hardware detection section of the install for the product. Essentially, when you first installed Windows 95, it would go through an investigative phase where it queried various elements of the computer (both hardware set and software set) and tried to understand what was on the computer so it could either use it or prompt you for a driver that would allow Windows 95 to use it.

____________________

* The computer's BIOS is what loads when you first turn a computer on. It checks the memory and connected drives, usually beeps, and then loads the operating system. On most PCs, computer companies have hidden what the BIOS does behind a pretty screen with their logo. But it is still to this day an important part of the computer start-up sequence.

The problem was that some hardware was unprepared for queries. The hardware would invariably interpret it as being jabbed in the ass and being asked who the hell it was and what it was doing.

Case in point: a particular uninterruptable power supply (UPS) used an older type of cable connection to the computer to link its software based method of monitoring power status to the UPS battery. During setup, Windows 95's hardware detection of the cable connection caused the UPS to think the power had been cut. If setup lasted longer than the UPS battery, then the entire setup would fail because the power would die and the computer would unexpectedly switch off.

In another case, detection during the beta had a harsher effect due to buggy hardware. A laptop manufacturer used a BIOS that had a unique way of responding to a hardware plug and play inquiry. When Windows 95 calmly asked the BIOS, “Hi, who are you and what version are you?” the BIOS put a gun to its head and replied, “You'll never get me to tell!” and did the BIOS equivalent of blowing its brains out, meaning it overwrote its firmware strap code with zeros. This rendered the entire computer as useful as a doorstop. It actually had to be physically repaired by the manufacturer. It's one of the few documented cases of actual computer suicide that I have ever seen.

Of course, even back then, BIOS manufacturers were trying to implement new features that normally were provided by operating systems. Hard drives work by having what is known as a file system. Think of a file system like the language of a book. Some file systems can be understood without an operating system, and some cannot. An example of file systems are the two that came with Windows 95: File Allocation Table 16 (FAT16) and File Allocation Table 32 (FAT32). Once the FAT32 file system was introduced, in-place conversion of FAT16 to FAT32 file systems became possible. BIOS manufacturers had developed hardware hibernation capability into their products, meaning that by hitting a button on the computer, the BIOS, using the operating system file system driver, would dump the contents of the RAM to a file on the hard drive to be read on next boot. Great idea. Unless the BIOS couldn't read the file system on next boot. They could write to FAT32 using the operating system, but on next boot couldn't read the hibernation file. This again rendered the computer essentially a doorstop because you couldn't point the BIOS bootstrap to anywhere else. Probably the most frustrating and annoying event that can happen when excitedly upgrading to a new technology is for that technology to then render your favorite device about as useful as a carrot to the aforementioned fat men at the BBQ. This is one of the main reasons in the past decade or so that engineers have worked a lot harder to design failsafe uninstall abilities to get you back to where you started.

Eventually I faded back to the rant e-mail about how it's all so very hard today, all because of us.

I hit Reply and simply said, “Get back to me when you have a fat man gnawing on your fingers.”

That One Time, During the Windows 98 Launch, When the Pigs Got Sick

From May through August of 1998, I was in Bismarck, North Dakota. It's not a bad place to be for a summer if you're normally from Texas, don't really need the Internet, don't mind tornadoes just, you know, over there, and don't mind being in the same location as a virulent pig flu—all during a major Microsoft operating system launch.

One might casually wonder what in the fuck I was doing in Bismarck in the middle of a major product launch?

You see, before outsourcing product support overseas was fashionable, a lot of tech companies actually outsourced their support to companies in less expensive parts of the United States. One of the partners we used had an extremely large site in North Dakota. Most of the accounts handled by this vendor weren't necessarily technical. And the vast majority of the workforce were spouses of the local farmers and their high-school-aged children. So my team was sent in to train three hundred people on how to support Windows 98.

I wasn't looking forward to it.

Due to a variety of scheduling conflicts it took me forever to get out to Bismarck itself. I first had to fly up to Minneapolis and then catch a connecting flight to Bismarck. The layover was relatively long and my flight out to Bismarck was late. All of this meant that A) the plane was basically going to be the last flight arriving at Bismarck that night and B) it was mostly empty.

Empty except for my seatmate.

I'd always wondered what kind of person buys, then during the flight reads, porn. From time to time you could find in various airport bookstores a small section with Playboy or Penthouse, but what always fascinated me was the occasional row of porn novels. They always had varying titles displaying the intent to arouse: The Schoolgirl Prison. The Desperate Nun. Makin' Bacon. I never understood who would buy one of those books then read it on a plane.

Apparently it's a 20 year old woman with enough piercings and metal in her body that I seriously worried they might have to rebalance the weight on the plane. She sat there during the entire flight calmly reading The Boss's Secretary (with the subtitle “What will she do to keep her job? What won't she do!”) Now, I'm all for women (or anyone) enjoying porn. But not unlike personal grooming and loud cell phone conversations, it doesn't belong on a plane.

We landed in a completely empty airport. My porn reading companion and I deplaned and I headed for the rental car desk while she headed to the nearest scrap yard for more piercing adornments. I walked the long hallway to a point where I could see there was just a single person manning the rental car counters. My steps echoed and I was struck by the fact I had never been in an empty airport before in my life. Half the lights were off. I felt like those rare occasions where for whatever reason I was allowed to be in my high school after dark. It was more unnerving when I neared the counter to get a good look at the person behind it. Again, female, 20 years old, and I counted roughly nine piercings of varying degrees of oh my god that must hurt.

At this point my mind decided: Ok Bismarck, now you're totally fucking with me. I obtained my car, drove a completely empty highway to my hotel where I met my cohorts. Having already been there a week they introduced me to their night life in Bismarck: Get drunk and play StarCraft.

The location of the outsource vendor consisted of two very large office buildings out in the middle of nowhere, surrounded by miles of open farmland. We literally had to drive a few miles outside of Bismarck to get there. If you already thought Bismarck was remote, the vendor's office was…remotier. On my second day there, I had a crowd of my students standing outside the front door of the site.

I asked what was up, and one of them pointed. I looked out across the vast green field. The sky over the site was a bright intense blue with some puffy white clouds fading into some darker clouds farther out. I took in the crisp fresh air and thought about how peaceful being this far away from everything was. Then my eyes locked on the gigantic tornado about two miles away slowly chewing up farmland.

I had the presence of mind not to do what I would have done in Dallas, namely scream and run inside to the center of the building. They didn't seem concerned, so we watched it for a little while as a crowd might watch the circus unpack their tents. I wish David Lynch could have filmed it. Four or five peaceful people watching a tornado, and a fidgety sweating one staring at the ground and wondering when to run.

The Bismarckians were nice, however, and the training progressed, albeit slowly. One day, over a quarter of my class didn't show up. It was odd, but I didn't think much of it. The next day, only a quarter showed up. I looked at all the empty seats wondering if I'd missed some Bismarck-specific tornado festival or something. One of the remaining students noticed my scanning the empty room and piped up: “Pigs are sick.”

The words didn't register at all for me, and my brain resolved it into “Mxyzptlk,”* and I smiled and nodded, because hey, who doesn't like Super Friends? The student seemed to sense a disconnect and further offered, “There's a pig flu. All the farmers are trying to contain it. So most people are back there until it passes.”

There's a fine line between consuming information you never, ever expected to be given, and laughing out loud like a complete loon. I managed to toe the line but not cross it. So for a two-week course, anywhere from two-thirds to three-quarters of my class was tending to sick pigs for several days. It was during the troubleshooting section for the networking capabilities of Windows 98 too, so obviously everything was going to be just fine. In talking to the vendor about it, one of the arrangements they had with the local community was to allow for situations like this.

____________________

* Pronounced “Mix-ill-plick” for you non-Superman people out there. The common pronunciation is listed however, my first introduction to the character was in the cartoon Super Friends, which pronounced it as I listed it. For more information on this informative topic please see my next book, I Will Over-Explain the Joke Until You Cry and Beg Me To Stop.

Summer in Bismarck was remarkably pleasant, and days were spent teaching and writing portions of the Windows 98 resource kit, while nights were spent in furious StarCraft battles with the rest of my team. Windows 98 launched on June 25. Around June 26, the pigs got sick again. The call wait time jumped up, and sure enough my phone rang with a query from the other support sites as to why so many of our agents were offline.

I couldn't think of anything else to say.

“Mxyzptlk.”

The Art of Interviewing at Microsoft

I've had the fortune—I won't disclose whether it's been good or bad—to be on both sides of the Microsoft interview process many times over the past fifteen years. During the Great Recession, I actually had a couple of positions open to hire for. This gave me an insight into both how things have changed and how they remain very much the same.

An interview is a simple conversation. The goal is to try and gauge a person's skill set against the role you have open and the tasks you expect that role to achieve.

That's not always the case at Microsoft. You see, at Microsoft, if you're not careful, it can get drilled into you from your very first interview training session (called, deceptively, “Interviewing at Microsoft”) that you are evaluating the candidate as a Microsoft employee first, and for the role second. Much is made of the concept of imagining where you see the candidate in five years. In the technology world, and especially at Microsoft, five years might as well be twenty. So the five-year concept has the equivalent usefulness of saying, “Imagine the candidate can fly. How fast do you think they can go?” Thankfully that attitude is far less prevalent now than in the past.

As I've mentioned, I began working for Microsoft as a contractor in April of 1994. Back then, the sole mission once you got in as a contractor was to obtain a full-time position or go blue, which referenced the color of a Microsoft employee's badge as opposed to your own, typically gray, contractor badge. It quickly became such that instead of saying to your parents, “I have an interview tomorrow for a permanent position with the company!” you might blurt out instead, “I've got my go blue interview tomorrow!” This would invariably cause your parents to look at you as if you had just used Pig Latin to tell them they were the feet beneath your knees. Sure, they figured out the words, but…what?

There were two levels of Microsoft interview back in those days. The first was the one that's most commonly known: the all-day interview. This consisted of five one-hour interviews with an optional sixth, as appropriate. That structure is still mostly in place today, and I'll discuss it in a moment. The second type of interview was either interviewing a person for a contractor role or interviewing a contractor for an FTE* position. That type was usually two hours or three hours, consisting of a personnel section and a technical section. Much was made of the gravity and importance of passing the contractor to FTE interview, because you rarely got a second chance. Once Microsoft had decided you weren't full-time employee material, you typically finished out your contract.

I had my go blue interview in November of 1994 to move from contractor to FTE, and I failed spectacularly. I was so worked up and nervous over the formal nature of the interview that they could have asked, “What's your first name, Stephen?” and I would have had to check my driver's license to answer. And even then, I probably would have mangled the pronunciation:“My first name is Stapheen. Stuphane? Steenaph?”

The technical questions weren't hard. In fact, I went back to my cube and all the answers came to me in a flood. It was my first real interview for something I really, really wanted, and I blew it. True it was because I was insanely nervous, but I blew it nonetheless. I mean, I blew it so bad I didn't even get asked a brain teaser, a Microsoft interview staple so pervasive in our process that people made money writing books just listing the answers. A popular one was “Why are manhole covers round?” The correct answer, I know now, is, “Why is that relevant to supporting an operating system?” But at the time, figuring out the brain teaser was often considered to be the make-or-break item if they were on the fence about you. Thankfully I was given a second chance in December and was hired full-time in January of 1995. After that, I became one of the people who got to do interviews.

____________________

* Full Time Equivalent—in other words, a “permanent” job. We do love our acronyms at MS.

The vast bulk of my interview experience came when we were staffing up our short-lived product support site in Tucson, Arizona. The site was opened for time zone coverage in between the Windows 95 and Windows 98 launches. We needed to get three hundred technical support people hired in a short span of time, sixty days or so. Nothing against Tucson, but it wasn't known in the mid-nineties as having a massive pool of technical people. Our interview hit rate was roughly one hire for every seven or so interviews. I very quickly became immersed in how to conduct an interview and what was useful and what wasn't.

The first thing that is important when you are interviewing people is to ask questions that tell you things, and pay attention to the reactions. I don't just mean listen to the candidates' answers; I mean pay attention to their mindset and be empathetic about what they are going through. I found myself settling into a routine question pattern, and one of my go-to questions was “how do you handle stress?” I started to learn my lesson when an interviewee sipped his water (getting it mostly on his lap) and shaking and sweating finally cried out, “Well, like shit I guess.” I felt terrible for not noticing his nervousness. Other memorable answers I got during the process (that informed me I was not asking questions that would really tell me anything) were:

Me: “Tell me about your last role or current job?”

Candidate: “Well I'm not sure it's really applicable, but I'm currently a topless dancer at Curves.”

***

Me: “What would you say is your greatest success?”

Candidate: “My marriage of five years.”

Me: “Oh, congratulations. Now, what would you say has been your greatest challenge?”

Candidate: “My marriage of five years.”

Although sometimes I found my questions told me quite a bit all at once:

Me: “Tell me where you see yourself in five years?”

Candidate: “You mean in a fantasy world?”

***

Me: “What about this job do you find interests you?”

Candidate: “It's technical support right?”

Me: “Yes.”

Candidate: “Well I had to check, since the way you asked it…I mean it's not like anyone wants to do technical support. I'm here 'cause you pay more than America Online.”

Over the course of several hundred interviews, I figured out pretty quickly I didn't like being the interviewer any more than being the interviewee.

I'm glad that over the years Microsoft has gotten away from the concept of frontloading the interview experience with so much arrogance about even interviewing. And that some of the gimmicks of old, like generic brain teasers and reliance on challenging the candidate with stress, seem to be gone.

So when I had to conduct a series of interviews recently for my position, one that in this climate resulted in many, many, many dozens of completely qualified candidates, it caused me to reflect on our process way back in 1994 in awe. Now, with each person I talk to in an interview, I always open up by putting them at as much ease as I can, because I really want to know what they think and how, not how well they deal with a bullshit interview process.

Progress.

Sydney, Where the Bare Ass Spankings Lie.

In December of 1998 I was given a choice to go to Tokyo, Japan to deliver a three week training course on the upcoming version of Internet Explorer, or Sydney, Australia to perform the same task. I chose Sydney, and my life has been the stranger for it.

At the time I was living in Dallas. This meant a flight over to Los Angeles followed by a 14 hour flight to Sydney. Back in those days most groups within Microsoft had a pretty reasonable policy for justifying flying business class. If the flight was over six hours long and you were expected to work within 24 hours of landing, you could book business class. At this point in my life I had made two overseas flights to Europe, both coach. All my domestic travel had been coach as well. Thus was I introduced to business class, or as I called it afterwards: 14-hour long blowjob class.

I exaggerate, but only slightly. The change from coach was immediate. Aboard a very nice Boeing 747, I was ushered to the top deck, shown my enormous seat, and handed some champagne. The seat converted to an almost flat space to sleep on and there was a good three feet of room all around me. The seat had a screen that displayed the current position along with a real time map. You could also watch TV or movies on it. There was power for my laptop, and the food was real food served on real plates with real silverware. There was even a wine list! A clown came out to cheer me up any time I felt down! The stewardesses were all Angelina Jolie! I saw God! He made me some pancakes!

Well, I may or may not have taken advantage of the all you can drink cocktail list with its fine selections of Cognac.

Most of a day later I landed in Sydney. The approach from the coast was spectacular and I couldn't wait to see the city. Being early December in the southern hemisphere, the weather was warm and balmy. I was bemused to see many a Santa Claus in shorts from the cab window as I made my way from Sydney proper out to North Rhyde where the Microsoft office was located.

For the next couple of weeks I taught some of the most professional and customer centric Microsoft employees I had yet encountered. In almost all cases they spent serious time in class participation, provided product and training feedback, and were incredibly focused on providing the best experience for the product that they possibly could. I spent my days teaching polite and focused students. I spent my nights eating spectacular seafood and hitting the local bars in the area for the one-time novelty in my life of having hot girls actually fawning over my American accent as much as I was stricken by theirs.

Great story right?

The title promised bare ass spankings and we don't have too much more to go to deliver.

During my time in paradise I became fairly close to the students as friends. At some point during my time there, I got invited to the group's Christmas party. Apparently their local Halloween party had been canceled for whatever reason and they had chosen to do up their Christmas party as a costume party. I lacked a costume, but was assured that didn't really matter as there would be masks aplenty at the event. Up until this point I had spent a lot of time in Sydney meeting various Internet people unrelated to work that I knew from being on several different message boards. So each night had been a different low key affair involving dinner and drinks with couples or the stray person my age meeting up for beer. I had not been partying at all with the students. Perhaps it was some foreboding sense that as the teacher of the class that I should not fraternize too closely to the students until the class was completed. More likely, nay certainly, it was prescience of situations where I would be exposed to the largest field of marijuana I had ever seen personally and one of my male student's perfectly shaved genitals.

But I'm getting ahead of myself.

The night of the party opened with three of my handlers picking me up at my hotel. These weren't students, but employees assigned to make sure I got from point A to point B for the class. The idea was drinks and relaxing back at their place near the party. The party, it was described to me, was officially unofficial given the anything goes nature of the costumes. Are you noting the words in italics?

We arrived at their shared house. I hopped out of the car still a little bemused by the driver's side back seat being on the right, and paused to take in the place. It was nice; a large but older single story home in a spot near the industrial area of the city where apparently the party was going to be. My lead handler stepped out of the car and led us to the side gate which he unlocked and let us through. We meandered down a side path for a few feet before we hit the back yard and a small deck leading to the rear entrance of the house. I was preoccupied with merely following the path before we hit the deck and one of the handlers said, “What a view.”

I looked up and out and paused, pretty sure at what I was seeing but too much of a neophyte to truly process it. Imagine a camera in a movie, maybe it's Hoosiers or Field of Dreams or Children of the Corn. The view pans up from the ground then slowly rises to reveal an epic farm crop that extends to the horizon. Except it was pot plants. Sticky bud as far as the eye could see. I wasn't shocked so much as I was awed.

“Party starts in 2 hours. Let's chill,” one of the handlers said.

They went inside while I stood for a second longer on the deck, figuring one napalm strike on this place and the contact high would easily reach Canberra. Not wanting to appear freaked, I went inside and gratefully accepted a cold beer then freaked as the single largest bong I have ever seen was produced. As if suddenly realizing there was a foreigner in the room a handler, a stunning redhead girl, decided to check in.

“Oh hey are you cool?” she said, gesturing to GargantaBong, the Bong that all other bongs pray to.

“Oh yeah.” I said, then tried to deploy some slang, “Not my thing, but I'm 4:20 friendly.”

They stared at me blankly, and at the culture cross collision of the situation I finally busted out laughing.

“I'm cool,” I said, “I'll stick with beer”

The next hour was spent watching them conduct a bong based forest clearing experiment with a bag from the back yard while I drank all their beer. Seemed like a good trade, because by the time we had to leave, we were all laughing so hard we nearly forgot there was a party with a fancy dinner to go to. We piled into the car, the driver baked beyond the dreams of avarice. We arrived at the warehouse on time, all of us hungry, with some hungrier than the hungriest of hungry munchies hungry people who are also hungry and want food.

“Fuck I'm starving,” the redhead opined as she got out of the car.

“You get between me and the food, and you're breaky for the rest of us tomorrow,” the driver said, swaying ever so slightly.

Everyone except me broke into peals of laughter and stumbled on in. I watched and prepared to settle into yet another in a long string in my career of company parties that featured nice dinners, forced fun, and a boring speech or two. That was when I noticed the costumes.

“You need a mask,” the girl said at the door as my jaw hung loosely on its hinges.

“You shot who in the what now?” I said.

Culture collision again.

My accent gave me away as a non-Oz-ican and she took that look I had become so used to for a couple of weeks. “Could you say that again?” I was expecting her to say.

“A mask,” she said, “it's a costume party, you need a mask.”

The night was blazing hot and I looked up to see how halogen orange the sky was with the bit of smog in the city against the lights. I was pretty sure I had just seen several of my students enter the party in full bondage gear. Contact high, I thought, you just watched three people in a small living room smoke the Yellowstone National Park through the Death Star of all bongs while you pounded back a six pack of beer.

“A mask you say. Sounds perfect,” I offered after a focusing breath and the realization that it was all relaxing downhill from here. I was just weirded out, that's all. Surely this was going to be the standard Microsoft thing.

In retrospect, the inside of that party was like Stanley Kubrick's Eyes Wide Shut except with less clothes and less sex. Within seconds one of my best students approached me with his girlfriend. He was wearing a kilt, and nothing else. She was in all vinyl and carrying a whip. I reached for the nearest tray of booze as he casually chatted me up about how I was enjoying Australia. Seconds later I swear to the flying spaghetti monster the multi pierced airplane porn reading chick from my trip to Bismarck walked up in all her tattooed splendor. I had to do a double take to realize it wasn't really her, but the resemblance was striking.

“Oh my god,” She said, “I love your kilt!” This was directed at my student who of course was appropriately accepting of the compliment. “You're not wearing anything under, right?” she asked.

No. No. No, I thought.

“Of course not,” he said, lifting his kilt to reveal a generous dollop of perfectly shorn genitalia.

“Neither am I!” replied the girl, lifting up her skirt to reveal her everything to everyone.

I'm pretty sure they high-fived in that moment but the memory burned into my skull is of the site director walking by with a paddle and seeing my student's girlfriend's whip uncoil. While I was still processing the shaven Adam and Eve bits of the past 120 seconds, the high level individual involved in our core business of Australia took the paddle and proceeded, with glee, to bare ass spank my male kilted student while his girlfriend occasionally cracked her whip.

Everyone had a grand time.

I spent the rest of the evening holding my badge in the air waiting for someone from Microsoft Human Resources to collect it and let me know they were terribly sorry but I had to be let go due to this party.

I woke up the next morning in my hotel room. My throat was a bit raw from some ill-advised cigarette smoking at the end (hey, I thought I was dead anyway.) There were enough photos to prove I wasn't crazy, but we all agreed what happens on the other side of the Earth has to have mathematical proof.

Dear the Microsoft Australia Office: I've not been invited back. What do I gotta do?

Microsoft Career: 2.0

By summer 2002, I was getting a bit restless. I was at that time working as a technical writer and trainer for Microsoft. I had traveled all over the world educating Microsoft support people and engineers on new technologies. My most recent project had been helping to design and write the training inside Microsoft for Windows XP.

It was a really fun job. The problem was that I was stuck in a snake pit of terrible management and dysfunction.

This happens from time to time with any large company. People incapable of actually being good at a given task sometimes seek refuge in management, only to find out they aren't good at that either. That statement is in no way a condemnation of managers; it's just that in my fifteen years, I found it was far too common an occurrence that the people least useful to Microsoft were so because they were most often tasked with management and not leadership. In this case, the problem was magnified by a dysfunctional organization that was on the cusp of deep cuts and was about to be dismantled. My summer review for that period was the first time I had ever received the dreaded 3.0 score for an entire review.

In the old days at Microsoft, the performance review scale was 1 to 5, graded in half points. The scores 1, 1.5, and 2 were never used. Ever. A 2.5 meant you were on probation and about to be fired. A 3.0 meant you did the minimum. A 3.5 meant that you did very well and exceeded your goals. A 4.0 meant you greatly exceeded your goals and had organization-wide impact. A 4.5 usually denoted that you were performing way past your salary, and it was a key indicator that you needed to be promoted several levels. A 5.0 was reserved for the rarest of accomplishments, effort that from the lowest employee to the highest usually garnered the attention of executives like Bill Gates or Steve Ballmer.

In that world, a 3.0 was a huge demoralizer. You were one step up from probation.

I'd put in a ton of effort in that review period and was crushed at the score. When I asked my manager why, she replied simply, “You need to move on. There is nothing more for you in this organization. You should start looking for other jobs.” Lest I sound bitter or appear to be complaining, let me be clear: this was the best possible thing anyone could have said to me ever in my entire time at Microsoft.

I had always resisted the move to Seattle. Inside Microsoft, it was well-known that the career path at a subsidiary was limited. To affect real change, to have a real impact on the company and the business, you had to be in Redmond. It wasn't any type of corporate mandate, it was just reality. Redmond, at least for the United States, was where your career went if you wanted to, say, be with Microsoft for fifteen years. But I was not in the mental space to realize the gift I had been given. I came home, got drunk, and was sullen and morose for the next month.

As an aside, I had an already growing interest in computer security. I'll write more about this later, but the long story short is that I got hacked. This was a simple thing, really. For a long time, I'd run a public IRC* channel on my home network. I started hosting the channel and IRC software on Windows 2000. The community in the chat channel was a variety of people across the world looking for all manner of information technology advice or just shooting the shit about the topic of the day or trying to make each other laugh. In particular, there was one person who berated me to no end over my choice of hosting the server on Windows 2000. Finally, after a year of his…feedback, I caved. I went to Windows Update and made sure I had all the latest updates, and then I went back into the channel and told him, “Look, either you give me the contents of a file on my hard drive or place a file there, or shut up.”He got me in just about a half hour thanks to the method by which you had to apply updates back then. I missed one, and he was able to exploit it.

____________________

* Internet Relay Chat. Think of it like instant messaging with lots of people instead of just one.

After that, I got into security. As I mentioned earlier, to get anywhere in such a high-level sport* would require a move to Seattle and all that entailed. Through my internal job searching, I saw that an opening for the Microsoft Security Response Center (MSRC) had opened. I had some conversations with Scott Culp, then head of the MSRC, and he invited me up to Redmond to interview.

I wrote earlier about interviewing at Microsoft. My first experience with the six-hour interview process was when I interviewed for the MSRC in the fall of 2002. I about /facepalmed over what I had gotten myself into when I saw who I was interviewing with. It was a who's who of Microsoft computer security luminaries. Steve Lipner. Scott Culp. Michael fucking Howard. To a remote employee like me, these guys were heavyweights. And I was about to fly up to Seattle to convince them over a day that I could work alongside them.

Steve Lipner was going to be gone during my interview day so my first interview was with him by phone. We walked through a couple of security topics of the day (Steve Gibson's rampant paranoia about raw sockets being the undoing of the entire Internet within three months of Windows XP's release, the Code Red and Nimda attacks, etc.) and I felt pretty good at how I did. But the hard part of the six-hour process is not any particular interview; it's all about doing well on top of consecutive ones.

I arrived in Seattle and my first interview was with Scott Culp. His first question was, if I was an air traffic controller on 9/11, how would I handle the situation knowing what we know now? That was a million times better than “why are manhole covers round?” because it forced me to apply quite a few different problem-solving ideas relating to security into a sort of no-win situation. I struggled mightily with the scenario but forced myself to get up and whiteboard out the problem with Scott, and it ended up completely erasing my nervousness. After that, I interviewed with Iain Mulholland, who at the time worked for Scott. He asked me how I would redo our current vulnerability ratings. We talked it out, and I said, “Well, I guess we need to add a fourth rating.” He smiled and asked what we should call it. I said, “I wouldn't call it anything hackneyed like Important or something silly like that.”

____________________

* Interesting fact: when I wrote this, I meant “high-level spot” and typo'd. In proofreading, I decided to keep it. Computer security is indeed a sport.

The next day, Microsoft announced it was adding a fourth rating, Important, to the vulnerability ratings. It had all been researched and approved before I ever landed, so I stepped right into it. To say I felt stupid is like saying John Edwards feels amorous.

On to the next interview! Michael Howard welcomed me into his office, piled high with copies of his book, Writing Secure Code, which I had read. I sat there feeling pretty small surrounded by his patents on the wall and what seemed like eight computers. He walked me through a text book example of a stack smash and had me spot the software security vulnerability in some code samples (ahhh strncpy() thank goodness I knew how hard you were to get right). After fifteen minutes, he sat me down in front of a list of what appeared to be security bulletins.

“These are Red Hat bulletins for their security updates,” he explained. “Our Microsoft bulletins are numbered sequentially by year. Decipher for me the naming convention for Red Hat.” He turned back to his machine to answer e-mail while I stewed over the pattern.

After ten minutes, I figured it out.

“There's no pattern I can see. They're intentionally obfuscated.”*

He laughed. “Yeah I think so, too. I'm trying to get as many brains on it as possible before I call them out on it.”

I spent lunch in front of a small bowl of soup trying to figure out if I was doing well. These interviews were challenging for sure, but they had little to do with the standard single question/single answer format I was so steeped in. I couldn't say if I was getting stuff right, but I could say that I was satisfied with how I tried.

____________________

* After I posted this blog entry, a member of the Red Hat security team from that time period contacted me over Twitter to say the obfuscation was in no way intentional; they labeled their bulletins according to a third-party reference code. Fair enough. But Michael's meta point wasn't really intent but that Red Hat's bulletins were less than easy to figure out for customers.

The afternoon held much the same experience: thoughtful scenarios that had no single right answer. The interviewers themselves didn't have a bias one way or the other about the solution. I was rocked far more by this difference of maturity in the process than put off by it. It ended up forming many of my current views of interviewing: put people at ease, and put them in a mental place where you can find out what and how they think.

An aside for those of you who know George Stathakopoulos, longtime director of security engineering for Microsoft: He was my as appropriate interview. At Microsoft, you tend to know you did okay on the interviews if you get the final one, the as appropriate. I learned what not to do in a final interview from George. He welcomed me into his office with questions of my sanity at wanting a job in security, but told me not to worry, everyone loved me, I got the job, and hey, let's play with this new tablet PC! I spent the next two weeks in horrible suspense wondering if he meant it about getting the job while the formal offer worked its way slowly through human resources. I named the resulting ulcer George.

So, in late 2002, I joined the Microsoft Security Response Center. Very quickly I became the spokesperson for Microsoft security response to the press and customers over a variety of high-profile issues. I'll touch on some of them in the coming pages. But for me, in writing this series of stories, it was important to divide the epochs in my career.

Then, in 2002, I went full-on corporate and moved to Seattle. I still mentally play the theme song from The Jeffersons whenever I think about it.

I've thought a lot about that change in my life, and one thing is clear: when that manager of mine (who had no business being a manager at all) told me to find another job, it never occurred to me, not for a second, to find another job outside of Microsoft. And to this day, I cannot tell you why, other than I knew there was more to do here.

The Longest Call

I've dealt a lot with the press. From USA Today/CNN/MSNBC to computer beat reporters like Information Week and CNET News.com all the way to game publications like Kotaku and Joystiq. But this story, by far, is my favorite story of a call with a reporter. Mainly because only in computer technical support could this have turned out the way it did.

One of my roles within the Microsoft Security Response Center was to be the public spokesperson for security response. That involved being available to journalists whenever they had questions about a vulnerability in our software or whether an attack impacted our customers. First, they made a call to Microsoft's public relations firm Waggener Edstrom, who then put me together with the reporter so I could answer the technical questions, either face-to-face or (most often) on the phone. Needless to say, in my career at Microsoft, I've done quite a few press interactions over the years.

But my longest press call had nothing to do with actual public relations. Way back in June of 1995, I was one of the lead Product Support Services engineers supporting the Windows 95 Preview Program. This was a prerelease version of Windows 95 available for purchase. It came with phone support for customers who might have a problem with the leap from a 16bit operating system to the new 32-bit one.

And so begins the story of my longest call.

I was working the tail end of the late day shift in Dallas, which ended at 8:00p.m. central. I received the call with the notification that the caller was press. Now, time and alcohol have killed the brain cells that held the knowledge of the publication, but I do remember it was a large one on the East Coast.

The call opened up very simply. The reporter in question was not reviewing the product; he was just a technology enthusiast and was excited about the preview program. He had completed a clean installation just fine and was sitting at the Windows 95 beta desktop.

His question? “I just need to know how to create a shortcut to a document.”

No problem. In Windows 95, you just clicked on the right mouse button anywhere on the desktop and a context menu popped up, just like it does today, and one of the options was New Shortcut.

Being in Product Support Services really teaches you to be very precise in your instructions. Usually if you have a customer who trusts you to guide him, he will follow your instructions exactly. So I said, “Okay, just click one time on the right mouse button on the desktop. You should see a menu pop up under the cursor.”

“I don't see a menu,” he said.

Again, being in support really teaches you that the first try is usually done wrong, mainly because you are trying to get someone else to be your hands and eyes over the phone. So when the first try goes wrong, it's best to explain and repeat.

“Okay, not a problem,” I said.“The desktop is the main part of the screen where you see the My Computer icon. Do you see the My Computer icon on the screen?”

“Yes,” he said.

“Okay, great. Now, the desktop is the area that doesn't have any icons on it but has a background wallpaper usually. Do you have a wallpaper?”

“Of course,” he said.

“Okay, great. Just click one time on the right mouse button on that wallpaper and a small menu should appear that has the option to create a new shortcut.”

“I don't see a menu,” he said.

Uh oh. Now I have to ask the question. PSS people hate to ask the question because it never goes well. It's basically: “Are you sure you're doing it right?”

“Sir, are you sure you're clicking on the right mouse button on the desktop and not the left?” I asked.

“Yup, I'm sure,” he said. “I'm actually pretty well versed in the new capabilities; I'm just not getting a menu here.”

So now a million things are going through my mind, first and foremost being, Crap, somehow his shell (the graphical user interface for Windows) is busted. This call just escalated from a usability call to a tech support call. Back during the preview program, lots of things caused the shell to behave in unexpected ways, most notably 16-bit Windows 3.1 video drivers, Berkeley System screensavers, and general voodoo and fuckery. So our first step was to reboot the computer into safe mode.

Safe mode was a feature of the product that has turned out to be very helpful over the past ten years. Since a majority of problems with Windows 3.1 and Windows for Workgroups 3.11 were in regards to new drivers or software added to the computer, safe mode was created for Windows 95 to boot the operating system in a minimal state, removing as many third-party drivers and software programs as possible and only loading what Windows needed to load in a basic mode. So we booted into safe mode and had him try again.

Still no menu.

Fearing 16-bit legacy drivers despite the clean installation, we rebuilt a clean system.ini, which was a Windows configuration file that Windows 95 used to load up Windows 3.1 software settings.

Still no menu.

We uninstalled the mouse drivers.

Still no menu.

I'm sweating through my shirt at this point because I feel like A) I look bad, and B) our product looks bad. I had visions of him writing a review later saying Windows 95 was the best thing since a hard punch to the neck.

We opened up an application with right click capability and the menu worked fine inside the application! I wondered aloud if a change we'd made had fixed the problem, so we tried the desktop again.

Still no menu.

We tried every single solitary trick I had ever learned in technical support.

Still no menu.

Finally, we rebooted back into normal mode. I was just about to raise the white flag of technical support and suggest a reinstall when I tried one last time. I don't know exactly what made me ask this question quite this way, but I did.

“Sir, are you absolutely sure you are clicking on the physical right mouse button of the mouse in your hand?”

“Oh,” he said, “you mean the mouse on the desktop or the mouse in my hand?”

Now for a moment we must pause and fully appreciate the realization that I suddenly had. The default wallpaper upon completion of install of the Windows 95 preview program was a pretty blue background featuring a Microsoft natural keyboard, a CD-ROM, and, you guessed it, a Microsoft mouse.

Now flash back to my original instruction to the customer.

“Okay, just click one time on the right mouse button on the desktop. You should see a menu pop up under the cursor.”

The whole time the customer had been left clicking on the right mouse button in the picture of the mouse on the desktop, doing precisely what I had told him to do. So I had basically wasted the last forty-five minutes of his life. I put my head in my hands.

“Sir, try clicking the right mouse button on the mouse in your hand and seeing if the menu comes up.”

I've never been so grateful to any human being in my life for sparing my feelings as I was to this reporter who suddenly exclaimed:

“Hey, it worked! You fixed it!”

And that was the longest call I have had with a reporter. To this day, I hope he forgives me.

Hennessey

This is the part of the book I have been dreading. Of all the stories that I have taken from my blog and put here, this is by far the most emotional.

I've always been a dog person. I grew up with dogs up until the point I went off to college. After college, work and various things combined to leave me with little time to care for a dog, so I went without one for a long period of time.

When I met my wife, Rochelle, that introduced Illusion into my life. She was a black cocker spaniel mix that my wife had for a couple years before she met me. Her personality was like most cockers: she was actually wicked smart and you got the feeling that one day she was going to shock everyone by actually saying something to you. She was a fantastic dog.

After Illusion entered my life, we also got Isabeau the cat, but this is dogblog not catblog.

Once we moved into our first house in Texas, I really wanted a puppy of my own. I'd never had one before. I knew I wanted a big dog, and so my wife and I actually went through a whole list of breeders and pet stores. We finally narrowed it down to several candidates, a male yellow Lab, a male golden retriever, a male Chesapeake Bay Lab, and a female golden retriever.

The female stole my heart. We picked her up the next day and named her Hennessy. Our first few months with her were like with any puppy. She caught kennel cough from a vet visit and was sick for a bit. Her early- to mid-puppyhood was spent with me in constant worry about her. Was she eating okay? Why was she sick? What could we do? Were we terrible people who could not keep even a puppy alive?

But she grew into a sweet-tempered dog who was more interested in getting loved on by people than chasing a ball. She ended up being the dog that was always at my feet while I was working or playing video games in my office, and she was always the first one I saw waiting for me when I came out of the bathroom after getting dressed for work. She never left my side. She became so close to me that for a large amount of her life, I almost took her for granted. My hand always on her head. Her gaze always to me, looking for affection.

Buddy, our other golden retriever, entered our life by chance. We originally bought him for my parents, who had just put their dog to sleep. Buddy was a one-and-a-half-year-old male whose owners just couldn't give him the attention he needed because they were about to have a new baby. Rochelle discovered him and rescued him. But my parents didn't want a new dog at the time, and so we took him as a playmate for Hennessy and because I'm a big believer in having lots of animals. He's a rambunctious dog, and instantly became the arch nemesis of the cat and occasional tormentor of Hennessy with his constant playing.

So we moved three dogs and a cat up to Seattle by airplane. You'd have thought we'd moved them directly into heaven. We had a larger backyard there than we did in Texas, and space for Hennessy and Buddy was the primary reason for getting the amount of land. Their favorite part of being in the northwest by far was Marymoor Dog Park, which is an off-leash park and has a river running through it with plenty of ducks for the dogs to worry.

Dogs are funny creatures. My wife and I had decided to put kids on hold for a while for a variety of reasons, and each dog took on a uniquely different personality and effectively became our surrogate kids. Buddy was always rough and hyper and always there to cheer you up. Hennessy: the dog who never leaves your side, and who's happy as long as she's near you. And Illusion: the smart sweet dog who seems to just be humoring you. Each had their own set patterns, and to this day we love them all very much, both the ones here and the ones gone.

But Hennessy in particular was very special to me, both because she was my first puppy and, of all three, she had my favorite personality. She was always with me. She bonded very closely to Buddy after a bit of a tumultuous introductory period. She always got her way, and Rochelle and I gladly let her get away with it.

In the early to mid-aughties, the occasional Internet attack often tested the ability of the Microsoft Security Response Center to respond. But with each attack, we got better and more practiced, and the impact of the attacks lessened each time. The last major automated Internet-wide attack with significant impact was Sasser.

Sasser struck in early May 2004. It was an extremely difficult time in my life due to a lot of pressures, like money, workload, and the high-wire act with no net that was working Microsoft Security Response. The worm itself was programmed by a kid named Sven Jaschan to drum up business for his mom's computer shop, and it infected tens of millions of computers, not to mention caused our response team two weeks of nonstop work. When an attack like that happens, there's investigative work to be done, making sure people are protected, communicating via the web and press, and of course alerting the industry and Internet service providers. Until the attack subsides, it's easily a nice long string of eighteen-hour days. After the Blaster attack, I had a futon sleeper couch installed in my office to prevent me from trying to drive while sleep-deprived, which I used quite a bit during Sasser while we kept up with the attack and moved to help impacted customers.

What neither I nor Rochelle knew at the time was that during the Sasser attack, Hennessy was dying of cancer.

Just a couple of weeks before, Hennessy stopped eating and started throwing up just on an empty stomach. Back in October of the previous year, she'd gone through this similar behavior and responded instantly to antibiotics. This time, she didn't respond to the antibiotics. Several vet visits and X-rays revealed nothing. After two weeks, she bounced back briefly, exhibiting appetite and keeping her food down. But then she took another turn for the worse. After several more hectic vet visits, we finally took her to an internist. He took some more X-rays, and his physical examination revealed a solid mass in her abdomen, which due to her young age, he felt was most likely a collapsed portion of her intestines. He thought immediate surgery could quickly remove the segment and potentially solve the problem.

During her surgery, they opened her up to find inoperable tumors blocking her stomach from her intestines. We went from “She's going to be okay” to “You need to put her down, immediately. She'll starve to death before the cancer kills her.” The only thing we could offer her was a painless death. Luckily, my mother had just landed at SeaTac and was able to drive me and Rochelle over to the clinic to say goodbye. They had her awake for us. She was comfortable and in no pain, and we were able to be there with her. Of course, she didn't know what was going on, but she was alert and knew we were there. They gave her the final injections at around 6:00 p.m. or so Seattle time. I couldn't bear to watch, so I said good-bye to her and left. Rochelle stayed with her until it was done.

I'm simply not strong enough to write any more about saying good-bye or the anger I felt that my work had perhaps kept me from taking her to more doctors sooner. It's almost six years later and I'm still angry. Rochelle was working, and I was working of course with Sasser, and it didn't help that my mom and stepdad were also going through a painful divorce, and we were basically broke and went into deep debt just trying to figure out what was wrong with her. When she suddenly stopped eating, we had to juggle work, family stuff, and vet appointments. The work by far was the most crushing obligation we had to meet.

I loved her so much. She was my first puppy. I am grateful for every single second we had her in our lives.

By the time all that had happened, fantastic work by international law enforcement, in combination with our cracker-jack Internet investigation team, had resulted in the arrest of Sven Jaschan in Germany.

Jaschan was tried as a minor in Germany for the crimes of authoring the Netsky and Sasser attacks. As a result of German criminal law as applied to minors, though he was found guilty on all counts of infecting tens of millions of computers and causing untold amounts of monetary damage, he received a twenty-month suspended sentence, three years probation, and thirty hours of community service.

For a long time I was angry at him. Not just for my own horrible experience but for the havoc he wreaked across the computing world, all over a lark to increase his mother's business. I couldn't believe he'd been let off so easily. And yet as much as I once wanted to punch him repeatedly until my hand told my brain, “Please make him stop,” I was simply too weary to offer up the opinion that his life should be destroyed. If they were not going to punish him, I could at least help him understand. At that point, I decided I couldn't be mad anymore. Sven Jaschan was just a kid. He didn't deserve to pay for the rest of his life, but at the same time I felt he had an obligation to take the negative thing he had done and turn it into a great positive. If there's anything Star Wars has taught us, it's that no matter how many people you force-strangle, enslave, or destroy, as long as you eventually kill the emperor, you get to come back from the dark side and everything's okay.

The day of his sentencing, I wrote the following open letter to him:

I'd like to say the following to Sven Jaschan:

The attack you released to the Internet disrupted the lives of computer users and administrators all over the world. I know that people have told you all about the large businesses that were disrupted and the amount of money in damages you caused. I can speak firsthand to that, having helped customers during the outbreak. But here's how Sasser affected me in my personal life.

In addition to the fact I was working non-stop and sleeping in the office trying to protect customers from the attack, Sasser occurred in a time when my mother and stepfather were going through a painful divorce. It took time away from my ability to be there for both of them. My wife's birthday was May 6, and I spent it working instead of at the dinner and the night out we had planned. Finally, Sasser caused me to miss what would turn out to be the last few weeks that my first golden retriever, Hennessy, would be alive before we found out she had terminal cancer and had to put her down. Between dealing with Sasser and my wife's work schedule, it was difficult for us to get her to see the specialist she needed. During the third week in May, we finally were able to do it, only to find out the cancer had already spread too far long before Sasser even happened. I hate the fact that the last few weeks she was alive I was busy dealing with what you had unleashed instead of doing the things she loved to do, like going to the park, in the time she had left.

I don't say any of this to tell you I'm angry at you. I'm not angry at you, Sven, because people make choices all the time, and sometimes those choices have unintended consequences. But I don't think it's wrong to put a human face on those unintended consequences.

I believe you had no idea any of this would happen. And what was going on in my life would have happened anyway; I just would have been able to be there for it.

But other members of my team were impacted, including one who nearly missed the birth of his daughter. Millions of people had things going on in their lives that had to be put on hold while they dealt with Sasser.

So I have some advice to share. I do think I'm entitled to that much, as is anyone impacted.

You've been given a second chance. I hope very sincerely that you use it to serve as a cautionary example and speak out against the creation of these types of attacks. I know you just want to put all this behind you. But you have the opportunity to do a tremendous amount of good. Please use it; don't squander it. You've taken the first step by confessing and being honest about what you did. I respect that. Please don't waste the opportunity you have potentially been given to help some kid right now avoid your mistake and think twice before taking what seems to be a simple action, but that can impact so many people.

I'd like to tell you he turned around. I'd like to tell you he took that opportunity. If he did, it was never in any form or venue that anyone could see. My open letter was pretty widely republished in the security beat press, so there's perhaps a fair chance he saw it.

But a few years later, I checked up on him and was disappointed to find he had indeed simply tried to parlay his act into a mere career for him. I despair to find no evidence he ever made any statements publicly regarding his actions that might be construed as being helpful or serve as a warning to others who might take the same criminal path. It's tempting to feel rage about it. That was such a heart-breaking time in my life due to the actions of one stupid kid.

I suppose in the end we take our second chances for granted sometimes.

I don't have a lesson to draw from this. A year later, the Zotob worm was released, but thanks to a lot of product work and security education, it impacted very few people. If Jaschan had spoken up and become an advocate for not writing these types of attacks, would Zotob have happened? Impossible to say.

Hennessy's ashes sit on the dresser in our bedroom.

A Typical Work Day, 2005

This was a fun post. I'd really refined my work style after some of the major Internet attacks derailed my life. I wanted to create a way to be connected to work but not cloistered in an office. Being a Microsoft employee, I had access to a lot of really cool technology that let me design a way to work that didn't lessen my fourteen-hour days but allowed me to incorporate free time into those fourteen hours. Reading it now, the post is interesting to me because of how little has changed and how much has changed at the same time. At the time I wrote the post, I used all Microsoft technologies. Now it's a bit of a mix. Sure, I have a netbook now instead of a tablet PC, but my desktop machine is now an iMac. And I love my iPhone since I can get my e-mail and everything else on it. But in 2005, I still had a pretty good setup.

What cracks me up is my writing about reading e-mail in traffic, a bit before doing such things became a lot more commonplace. Believe me, I don't do that anymore.

So here's a day in my life from 2005.

***

It's 7:00 a.m. Rochelle has already gotten up and the alarm is going off. I roll over to her side of the bed to turn it off and then roll back over to grab my smartphone as I get up. I flip it open to read any e-mail that I got while I was asleep. The smartphone is set to sync over the Internet every hour in off-peak time, so its last sync with the Microsoft Corporate Exchange 2003 server was 6:30 a.m. I hit the sync button to force it to sync off-schedule. I scan the subject lines during my wake up routine. Typical. Since I went to bed around 11:00 p.m., I now have two new meeting invites occurring before 11:00 a.m.

The phone gets docked while Adia and Buddy, my two golden retrievers, meet me at the door and try to lick my face as I come out into the hallway. I say hello and move to my office where my main computer, a Toshiba M200 TabletPC, and the Stepto.com server all sit on one L-shaped desk. I grab the tabletPC and unplug it from its dock. My exercise bike has a mount specifically for a laptop. Once undocked, the tabletPC automatically switches to my 802.11g wireless network using wireless protected access (WPA) data encryption.

The tabletPC is my main work computer, so it syncs my e-mail automatically. From the bike, I triage the overnight e-mail from overseas and late workers/early risers here in Seattle. I reply to anything that needs replying to, and accept or decline meeting invites. After sorting the e-mail, I then proceed with my morning reading. This involves a variety of websites loaded in tabs using Maxthon* on Windows XP Service Pack 2. My normal reading involves MSNBC, CNN, Drudge Report, Slashdot, Blue's News, and a bunch of computer-security-specific websites and news sites to help me catch up on Bugtraq and Full Disclosure and any other computer related news or mailing lists that morning. Once I'm done, the tabletPC gets docked again and I hit the shower. Once out and dressed, I grab my tablet and phone and I'm ready to go!

It's 8:15 to 8:30 now. Rochelle has already left for work, and the dogs are looking at me with that expectant look that today, of all days, I'm going to stay home and dedicate twelve straight hours to playing with them in the yard. No such luck. That's what Saturdays are for. The tablet gets tossed into my backpack, and I get in my car and head for work.

I live out in a farming community called Duvall. Duvall is twelve miles from Redmond, where the Microsoft campus is. Not long after crossing over Redmond Ridge, I hit the morning traffic. The road I take into Redmond always backs up before I hit 520. Out comes the smartphone.

____________________

* Before Internet Explorer version 7 came out, you had to run something like Maxthon in order to get modern features like tabbed browsing, etc. Man, I really hated Internet Explorer 6.

Now, a word about reading e-mail in the car. Once this road backs up, it's literally a half mile of stop and start traffic. Long pauses before the car moves. So I check my e-mail.

While the car is stopped.

Never, ever, try to check mail or work a phone while moving. Being able to stay connected during the morning commute has come in handy about a million times. Since 8:30 or so Pacific time is 11:30 Eastern time, East Coast journalists have already been working for three hours, and we often have to act fast to help meet their deadlines or we might be calling together a phone conference to discuss outreach to security researchers.

I usually arrive at the office between 9:00 and 9:30. I hit the cafeteria for some breakfast (again, occasionally checking e-mail on the phone while pancakes are cooking) and have the tablet PC docked by 9:30. By that point, things are hopping in the office. If it's a normal day, I'm reviewing bulletins in progress for the monthly release or going over technical information about reported vulnerabilities to the Microsoft Security Response Center. I might spend the morning getting ready for a customer briefing later in the day at our executive briefing center or preparing for a speech at Tech Ed or a security conference. But mostly my time is spent working directly with the MSRC.

A lot of my day can involve meetings. Meetings with product teams, meetings with customers, meetings with Product Support Services, meetings with different communications teams, interviews with journalists, working with my kick-ass public relations team— meetings, meetings, meetings. Here's where the tabletPC has changed my work style.

The Microsoft wireless network is domain-account based and available across the entire campus. As soon as I undock my tablet and walk out of my office, it shuts off the physical network jack and enables wireless. I associate with the nearest access point, which validates me, and as I am switching my tabletPC into convertible mode, I'm back online like nothing happened. I can walk down the hall in between meetings, in tablet mode using the pen as I walk, and I can triage my e-mail as I move between rooms. In meetings, I take notes. For the longest time, I would attend meetings and have my laptop with me, and I would busily type notes as the meeting went on. But when I got my tabletPC, I started writing my notes using the pen and I realized something: when I write using the pen, I am thinking and processing information. When I am typing, I am not listening as much as I am transcribing. To write using a pen forces my mind to process the information and distill it down to written notes because I cannot write as fast as the information arrives. But I can type 100+ words a minute, so if I am typing, my brain simply records the information without understanding it.

I want to stress how important this is. Thanks to my tablet and hand-writing notes, I am far, far more productive at meetings. I listen more and retain much more information being discussed than I did before. And with One Note, everything is retained on the tablet. I never run out of “paper,” and with a click of a button, I can convert all my handwritten notes to text. This is invaluable to me, and I cannot imagine ever going back to the old way of having meetings.

The early afternoon brings lunch. Again in tablet mode (thanks to no optical drive, my tabletPC gets around four and half to five hours of battery life) I can grab lunch and sit outside in the summer, enjoying the sunshine while we get it here in Seattle. Thanks to MSN Messenger and Office Communicator, I can hand-write instant messages using the pen as they arrive from various sources, without having to convert back to keyboard mode. (Sorry for those IM buddies who have to deal with my handwriting!) I'm also known for handwriting e-mails as well, another great feature of tabletPC functionality and application integration. If a call arrives at my desk while I am outside or away, Office Communicator notifies me with a popup displaying the caller ID of the person calling, and with a tap of the pen, the call is transferred to my smartphone.

The afternoon might bring presentations or meetings. I might spend my wait for the shuttle to the executive briefing center listening to music on my phone, thanks to the 1gigabyte SD card that holds all my music, and Windows Media Player being built into the phone. As the day winds down, I hibernate the tablet and it's back into the car for traffic.

Once home, the phone goes into the charger and the tablet gets docked again at my desk and brought out of hibernation. It instantly switches from wireless to the wired connection, and I pop my smartcard into the reader so I don't forget it the next day as I connect to the Microsoft corporate network. I cruise through any remaining work for the day or any new items to read online. When I need to check in later when I'm downstairs cooking or watching TV or even playing in the backyard with the dogs, I just undock the tablet, it connects to the wireless, and, in tablet mode, I do any work I need to.

Before bed, the smartphone gets checked again, and the cycle starts all over again.

There's a lot of people who might read this and think, Wow, I never want to work that much. It sounds like a lot of time spent working, but in reality I prefer to work in a steady state than to go for hours letting work pile up and then have to clear it all out the next morning. Microsoft is a worldwide, 24/7 business, and security response at Microsoft is no different. My constant availability also makes me more competitive in my work environment, as I am usually pretty well informed and current on emerging issues. It's the kind of thing you can't let go slack when your business is security response. To me, reading mail isn't working, per se. It's merely keeping up with the flow of information. Now I can do that whether I am moving in between meetings, sitting outside having lunch, or buying fish at Pike's Market.

Besides, the weekend is where I spend all my free time.

The Redmond Reality Distortion Field

Sometimes I get asked, “What the hell were you guys at Microsoft thinking when you did [insert action/product/initiative]?”

It's not exactly our fault. The answer is the Redmond Reality Distortion Field.

The Redmond Reality Distortion Field:

The field that influences Microsoft employees and product designers to make wildly incorrect assumptions about the use of technology, computers, and devices by the world. The field is caused by the fact that Microsoft employees tend to be far more affluent than the general population and have free access to technology. Generated by Microsoft employees, the field is centered in Redmond but can manifest itself weakly in any area where a significant number of employees gather, such as remote campuses or subsidiaries.

Its most common effect on individuals is to cause them to make design decisions based on the way customers should use products as opposed to how they actually use them, or by the interoperability of a product in the unique environment of the employee's home.

The field itself is invisible and exceedingly hard to detect, as once you are under its influence, reality itself becomes distorted. Entire Microsoft products have been designed under the influence of the field.

An example of one is the Microsoft Cordless Phone System, released in 1998. While the system itself was innovative and contained many unique features, like multiple voicemail boxes, customized answering machine messages for individual caller IDs, etc, the phone system required a dedicated computer be on at all times to enable its features. Due to the software's high resource demands and the fact it would only work with Windows 95 or Windows 98, it was assumed customers would dedicate a second PC to the phone, thus essentially asking a customer to commit a $500+ investment to make their new $100 phone work. The assumption was that customers either already had a high-end computer or a cast-off second computer, or would be willing to buy a second computer to make it work. This was based on the fact that almost every Microsoft employee in 1998 had two computers at home (not including work machines) due to our access to technology and tendency to be on the high curve of technology investment. Now? Well it's ten years later and I have five computers in my home, which I bet is on the low end of most MS people. Imagine what decisions are being made about the general state of home networks today thanks to the field!

Another example of the pervasiveness of the field on the Microsoft campus is feedback between Microsoft product groups. The following is an actual e-mail to the Xbox team, redacted appropriately for confidentiality:

From: [Microsoft Employee]

Sent: [Recently]

To: [Internal Xbox Feedback Alias]

Subject: Xbox LIVE through ISA Server

[Redacted]

Nearly six years after Xbox LIVE was released, our own firewall/router product doesn't allow any setting above “strict” for an Xbox 360.

Repro Steps:

Set up an Xbox on a network that goes through an ISA Server

2000, 2004, or 2006 to get to the internet.

Set up ISA Server to allow ALL traffic.

Do the Xbox LIVE Connection test and note that the NAT type is “strict.”

Wait five years for these two teams to talk to each other.

Do the Xbox LIVE Connection test and note that the NAT type is still “strict.”

Now, on the face of it you might expect that indeed, our firewall product should work well with Xbox LIVE. Until you realize that the Microsoft Internet Security and Acceleration (ISA) Server is our corporate-level firewall, which requires significant technical expertise and a license for Windows Server to operate. So the ISA developers optimize their time and development tasks towards corporate scenarios. Xbox and Xbox LIVE dedicates our resources to optimize consumer scenarios.

This employee, due to his access to our products, is running $2500 worth of enterprise software capable of handling tens of thousands of users to basically perform the function of a $59 standard router easily capable of handling twenty users.

Where the distortion field comes in is that the employee doesn't just want the two teams to dedicate resources to make it work to his level of expectation, but expects it to already be a priority simply because Microsoft makes both products.

So when you wonder why exactly Microsoft would have a music initiative called Plays For Sure and then have it not work with the Zune, or release a digital USB speaker system (whose best features required USB) at a time when few computers had USB at all, the answer is the Redmond Reality Distortion Field. It's not our fault. Really.

Perspective

I wrote this post about impulsively going out to see the film United 93 after getting stuck in too much of a Microsoft mindset rut. It's one of my favorite things I have written. It's not completely related to Microsoft, but I was in a weird Microsoft state of mind, and this experience really knocked me out of it. Sometimes we need that.

***

Today I was sitting in a meeting. Like a lot of meetings at the Microsoft Security Response Center, it was a discussion of vulnerability information, trying to understand risk to customers, working on plans for fixes. And I was sitting there thinking in general about attacks, what shape they would take, who could be impacted, and all the things we always think about when we're investigating. I was kind of bent out of shape, unrelated to the specific meeting, about some of the things that people had said recently regarding our commitment to what we do. I know that there will always be those people. It will never be difficult to find someone, somewhere, who is willing to state we're not doing enough or we're not doing it right. But there are times when it's just difficult to cut through that to do the job.

So I decided I needed my perspective reset, and right after the meeting, I simply left work to find a showing of United 93. My thinking was, I work computer security and crisis management for a living and maybe I would identify with some of the higher-level crisis elements in the film and that would soften my dread at experiencing some of the emotional ones. How arrogant those thoughts were. How utterly stupid.

It is said that a liberal is simply a conservative who's never been mugged. On September 11, 2001, our whole country got mugged. I'm not going to go into what I was doing that day or what the country has been like since that time. I'm not going to go into it because that's not what the film is about. Of all the stories of 9/11, flight 93 has always been the one I found most compelling. Of all the people that day, they were the only ones who knew they could do something and knew exactly what it was they could do. They were scared. They didn't want to die. Not all of them took action. Some who did didn't want to. But all who did saved countless lives.

There's very little I can put into words about how the film will most likely impact you. Here's what I think it will do to you, based off of what it did to me.

I think it will reset your life view down to what became important to you on that day. It will seem like everything in that view will condense to a single point, and everything else that might exist outside that point will become irrelevant. The film does not linger on violence. It doesn't pander to the audience. Its characters are shown without backstories, without triumphant music, with barely any soundtrack at all. The film style is handheld. The ending is emotionally devastating, despite the fact you know it's coming.

The film is history, captured in a way that few films have provided for us. Think Schindler's List. Think the Omaha Beach sequence of Saving Private Ryan. Then picture the CNN footage of a plane banking into the South Tower, or of a person jumping to their death, fleeing the flames. Picture that morning in its entirety, because this film is an hour and half of it, and with the exception of the brief opening, the film is shown in real time.

I'm not going to tell you to see the film. I'm not going to tell you that you owe it to yourself to see it. I'm not going to tell you that you owe it to the people who died that day to see it. The film is not entertainment. The film is not easy to watch.

But if you do see it, I think United 93 prompts this question: Does what we have done since 9/11 do honor to the innocent lives lost that day? For some people the answer might be yes, and for others the answer might be no. But I couldn't help but feel it was a question I needed to answer for myself in order to understand how I felt about the film. It's five years later. What would those people think of the choices we've made? They died, and we did not. Every day since then, for us, has actually been a gift. Have we squandered it? Or have we risen up and made the most of it?

I shared the movie with a theater full of people near the Microsoft campus. I didn't know any more about the people in the theater than the passengers of United 93 knew about each other. The film ends silently, with a couple of simple statements on the screen before the credits.

People sobbed quietly, me included. The ending is so crushing and tragic that it's impossible not to. Then, as the credits came up, we began softly, almost reverently, to applaud.

Suddenly, a bunch of computer stuff seemed very distant and irrelevant. And that was just what I needed.

SecTor Keynote, 2008

I'm going to caveat this chapter; it gets pretty technical. I could go back and rewrite it, but it's based on a speech I gave. In late 2008, I was asked to present my first keynote at a security conference—specifically, the SecTor security conference in Toronto. A million things flashed through my mind, like, Will I do a good job? and, What will I talk about? and, Do I speak Canadian? Thankfully I was able to harness my special powers of fear and stage fright to craft up something passable. Just keep in mind it was geared towards security professionals.

The conference was packed; a variety of security researchers, security IT pros, and security vendors were in attendance. It was my first trip to Toronto. But I arrived late due to a flight delay that thankfully gave me a good story to tell to open my keynote. It takes place at a time when I had just left security for the Xbox team, a set of stories that I will get to shortly, but I've included it here because it sums up my Microsoft history and my thoughts on computer security.

The setup was a large keynote hall. Behind me on a giant screen I had black and white slides going with a humorous running commentary on what I was speaking about at the moment, and those are denoted by [SLIDE:]. I hear it was good, but to be honest I was a bundle of nerves and in the end realized the deck I provided was missing three slides from my practice so I actually ended ten minutes early and was a bit mortified. Luckily, the audience had questions. I hope you like reading it as much as I liked giving it.

***

Good morning. My name is Stephen Toulouse, and I'm known by my nickname, Stepto, which is also my e-mail name.

Before I begin justifying your being awake this early with a hopefully pithy and thought-provoking talk, I wanted to tell you a quick story about my flight out here. It was an 8:00 a.m. flight, so I was already kind of bitchy and cranky, because if there's anything I hate more than being repeatedly punched in the throat, it's air travel. Sure enough, the pilot came on after we were all seated.

“The flight plan computer in the cockpit has a non-recoverable fault,” the pilot explained. They were going to have to, get this, reboot the airplane. Sound familiar? I felt like they were calling Microsoft support. “Have you tried turning it off and back on?”

For those not familiar with rebooting an airplane (I sure wasn't), this involved turning the plane off, turning the plane on again, and waiting for the flight team to recertify the flight. This process takes thirty to forty minutes.

That didn't work. So they came on the speakers and said, “Well, we're going to … try it again.” So seriously, they rebooted the plane, again. And it didn't work. The pilot came on and said, “Well, folks, rebooting hasn't fixed the problem so we're going to potentially have to cancel the flight, but first we're going to…reboot it one last time.”

And that time it worked. [Slide: Third time worked? They must have known a Microsoft employee was onboard.]

So let me start off telling you what I do for Microsoft. I'm the lead program manager for policy and enforcement on the Xbox LIVE service. [Slide: Translation: BANHAMMER]Previously I was a program manager and communications manager for security response for Microsoft. [Slide: Translation: MOUTHPIECE]So when they asked me to come here and talk to you guys, at first I was a little stuck for what to talk about. [Slide: Was actually stuck on level three of Portal]

So I thought well, I'll talk about some history, explore some myths and things we learned; and then I can point out something that surprised me when I left security and the fact that the baggage I took with me was incredibly helpful.

[Slide: HISTORY]

So, what is my security expertise? You see, I didn't start out in security. Because I think there are two types of us out there: those who came into computer security and those who have always been there. My involvement in computer security at Microsoft wasn't really a natural career path for me. I got interested in security when I got hacked.

Back in 2001, I was working in Microsoft's office in Texas, doing technical writing and training development for operating systems. And on the side, I ran a little IRC chat server for friends and IT pros across the country to just hang out and share knowledge or whatever. [Slide: Rarer than a blue steak: a quality Win32 IRC Daemon. For good reason.]

And there was this one member of the chat, man, this one guy who was constantly griefing about the fact I was running a Windows 2000 Internet Relay Chat server. I mean, non-stop: “Worst operating system ever, worst security ever, blah blah blah.” One day I got fed up. I went to the server, checked Windows Update to make sure it had everything, and finally told the guy, “Okay look, either put a file on my hard drive or tell me the contents of a file on my hard drive or shut up.”

Thirty minutes later, he gave me the contents of a file in my system directory.

You see, back then, not all security updates were propped to Windows update. You had to run a manual command line file, HFNETCHK.EXE, to understand if you needed an update. Sure enough, I'd missed the Unicode update MS00-078. And because I was a terrible system administrator [Slide: And an awful human being] I was running IIS* 5 without even knowing it.

So as I was cleaning the machine, I kept thinking, Wow, if a Microsoft employee can't get this right, how in the world can our customers get it right?

________________

* Internet Information Server: this was the default web server software installed with Windows 2000. It was reviled across the security industry because it was activated when you installed Windows 2000 whether you needed it or not, providing a way for attackers to sometimes exploit otherwise hard to exploit security bugs.

I had no idea about the security landscape. Oh, I knew that from time to time my company tended to treat security issues as a PR problem. I knew that certain companies out there, who shall remain nameless, proclaimed their software to be unbreakable [Slide: Rhymes with Shmoracle] or were pressuring researchers to not present their findings through legal means [Slide: Rhymes with Crisco] or that some companies were even doing a horrible combination of all three! [Slide: Picture of Justin Long, the Mac in “I'm a PC, I'm a Mac” commercials]

But I knew I wanted to help, both out of my own embarrassment and because I wanted to learn. Oh, by the way, the kid who hacked into my server grew up to become the sound designer on a game you might have heard of [Slide: High-resolution graphic of Bioshock logo] so he did good.

Anyway. I interviewed with the Microsoft Security Response Center in summer of 2002 for a program manager role and moved up to Seattle in fall of 2002. I learned how to triage vulnerabilities incoming to secure@microsoft.com, and one day they had me do the press calls for a week's releases, and bam, that became my job as well, describing the scope and impact of the vulnerabilities to journalists.

This was actually a great move by Microsoft. There was no way for me to treat these as a PR problem because I was scared shitless just to be on the phone with a reporter.

The reporter would say, “So, what can an attacker do?”

Me (sweating): “Anything they want.”

Reporter: “Which customers are affected?”

Me (sweating): “All of them.”

Along with everybody else on the team, I wrote security bulletins, drove product teams through release plans to produce updates, and handled releases every week. [Slide: Trivia: The song we always played while bulletins and updates propped was “Yo, Pumpkinhead!” from the Cowboy Bebop soundtrack] My first experience with any type of crisis was the Slammer attack, just a month or two into the job. In addition to juggling selling my house in Dallas and all the other stuff that comes with a move, I was having a new stereo installed in my Jeep. So I woke up early the morning of January 25, 2003, and tried to log into mail and couldn't. I figured it was because the temporary house I was in had bad wiring, and I went to have the stereo work done. So they tear apart my car and I'm kind of geeking out watching them do all the stuff, and they then proceed to rebuild it. The first thing they hooked together was the radio, which I rarely listened to anyway.

“[pssht/staticy sound] Today the Internet was taken down by a worm in Microsoft's SQL server software.”

I start screaming, “Put the car back together put the car back together!”

So I'm racing down I-5 to get to campus and assist in the recovery. And we made it painfully through that experience and we learned a ton of things.

The first thing we learned was to create a much broader plan for incident response than we had. So we developed the Microsoft Internet Security Emergency Response plan. [Slide: M.I.S.E.R.]Well, the executive leadership didn't like that name for some reason [Slide: M.I.S.E.R. (Y)] so we went with Software Security Incident Response Plan, or SSIRP.

In Microsoft style, it was quickly verbed. “Are we SSIRPing?” “Have we SSIRPed?” This was the process we used to respond to Blaster and Sasser, and it continues to be refined and improved to this day. It was also at this time that the finishing touches were being put on the Security Development Lifecycle. We moved to monthly releases and began providing malware removal tools. The rest, as they say, is history.

[Slide: MYTHS and MISTAKES]

So being the accidental security guy, I really threw myself into it. And I realized pretty quickly that computer security, as a subset of being a computer professional, was very much a “drink from the fire hose” experience all the time. Along the way, as I began to meet and truly understand security researchers, I discovered mistakes we were making, as well as some myths.

[Slide: Myth #1: Microsoft hates security researchers

Mistake #1: We didn't work to understand them]

Thankfully, I think this one has pretty much been debunked thanks to the outstanding efforts of our ecosystem team over the years, but I want to bring it up here because of the mistake part. If I think back to 2003, I was always mystified by people saying we hated security researchers. Our rules for handling communications with researchers were to always be professional, get back to them with status and updates in a timely manner, and have them test our updates. I mean, it looked to me like we were being really supportive. But the reality was we were just being an interface. We weren't working to really understand what motivates researchers and where the trends were going in security research. And so we got over that by creating the BlueHat internal security conference twice a year, where security researchers present to both developers and execs in the company. We started making a concerted effort to be present at security conferences all over the world, talking and engaging with researchers to get their view on how we could improve. I'm not saying Microsoft is the single greatest company in the history of the world in regards to our relationship with researchers, but we've learned. But the team in Microsoft that created that outreach deserves credit for wanting to understand researchers.

[Slide: Myth #2: The SDL* is a failure; critical vulns are still present

Mistake #2: Not making the SDL more public, more quickly]

Myth #2 really bugs me and I still hear it to this day when I state that I believe other companies should either adopt the security development lifecycle or develop and publish their own. The SDL process is not a panacea; it's a quality driver that is designed to be adaptable over time to reduce classes of mistakes. I think today's Microsoft products are light-years more secure than previous ones at a baseline.

But it took us forever to really get it out in front of people in a way they could adopt it. We could say all day we created it and it has benefits, but getting it out there so companies developing in house tools could use it, or small and large software firms could consume it and add to it was way too long in coming. My work on the SDL has been very tangential; to be clear, I am just in awe of the entire team that works on it because those are some crackerjack folks. But the key is that no one else is leading in this space in the software vendor world.

________________

* Software Development Lifecycle

[Slide: Myth #3: Microsoft has the Trustworthy Computing Group. But that's the only place security is understood.

Mistake #3: Not setting the example of aggressive security knowledge “pollination” in the company]

This leads me into the final part of my talk, which is sort of wrapped up in the title. I've heard this before; people have said it to me directly. Sure, you have a group within Microsoft that's a central hub of security, but do the people writing the code understand security?

And the answer to that is yes. Just because a lot of the SDL work occurs in TwC* doesn't mean people aren't there in the product groups grokking security. I think that's one of the main reasons that BlueHat is so successful. It's one thing to read a paper describing a broad class of vulnerability that might affect your code. It's quite another thing to sit there in the audience and watch as a researcher demonstrates to you and your peers how shoddy assumptions lead to customers getting owned. So people out there, don't just bring in security researchers for pen testing or contract work.

Our mistake is not setting an example for every company on how to distribute security knowledge. Not to say our method is by any means perfect, but since the creation of TwC, it's served almost as a training academy for security knowledge. People leave TwC and go on to become great product leaders or developers in different business groups. Microsoft and our customers benefit every day when people leave core security roles to go on to product teams and support teams, and new people take their place.

I can't tell you how different things are now internally at Microsoft, how many security alumni there are out there who didn't need to have a security researcher brought to them; they've gone out to understand the trends. If I had one piece of advice to give, it's to encourage your security teams to be on loan to other groups in the company. Encourage them to move on and see other aspects of things.

___________________

* Trustworthy Computing, Microsoft's computer security and privacy group.

The skills we have as security professionals are portable to so many other aspects of computer professional work. I never really realized it until I made the decision to leave security.

Which brings me to baggage. By the time Vista shipped, I was worn down. I was finding myself becoming that guy who says, “But we've always done it that way.” [Slide: And get off of my lawn!] I helped the Xbox team get through a minor privacy issue they had, and they said, “Hey, we're expanding a lot of the work we're doing for safety on Xbox LIVE. Would you like to come over and work with us?”

Hmm let me think about it… okay, okay, okay!

My lifelong passion is video games, so I leapt at the chance. I figured, what could be further from computer security than the entertainment group? Their concept of bad news was people buying too many copies of a game that's scarce. You've all heard it, right? “Once you get into security, you never really leave it.” I think that's really the wrong way to put it. I would say, “Once you leave computer security, you're going to bring some baggage with you.” But it's good baggage.

The first thing you bring with you is the concept of misuse of functionality. My team's first task was to build a scalable enforcement tool for the service to replace the existing toolset. The tool would consume text data from the internal complaint database and render it for judgment by our agents. Oh, I was so happy to be working on a tool where my security knowledge could come into play. I had the team setup the database just the way I thought it should be. I had the web client designed to run on 64-bit Vista in low-rights Internet Explorer. I code reviewed, and we ran some pen testing to make sure people couldn't misuse the application and no one but my team could try to wreak havoc with it. It was isolated from any customer-facing interfaces.

Finally, we were done. The tool consumed input from a trusted database and rendered it, and things went perfectly. Did you know the first rule of gun safety is that the gun is always loaded? The computer security corollary to that is the data is never trusted, even when it's trusted. One day the web user interface for the tool just refused to render—no matter who logged in. I couldn't figure it out until I remembered something key: the tool was simply displaying text from a database. Text the users had entered into their profile fields. That's when I found that someone had set their Xbox biography field to this:

[Slide: <style

type="text/css"> .penis { height: 1000px; width: 300px; overflow: into your moms mouth;]

Of course, our web client tried to render it and got stuck. So I implemented a check to render the input differently. My developer asked what made me think to check for script. All I could think of was to say, “It's what I would have done if I was breaking it.”

The second thing you bring with you is an understanding of unintended consequences. We'd received some feedback from customers that finding friends on the service was harder perhaps than they wanted it to be. So the product team came up with a great feature to make it easier to find like-minded gamers.

They called it Friends of Friends. Basically you could now see the friends of everyone on your friends list, dramatically expanding the pool of people you might want to game with. The problem, we security-minded folk pointed out, was with luminaries, celebrities, and families. These are people most likely to not want to be as discoverable in that manner. It's especially sensitive with families who would want to restrict children's friends lists. So we provided ways online to turn the feature off before we ever shipped it so people who didn't want it never had to deal with it.

The final thing I think you take with you wherever you go is that if you're in security, you care about the customer in the end. Now the word customer can have many different meanings. It can be an individual user, a group of users, or the company that pays you to protect their network. But the point is, because we play in a realm where the stakes are so high, our professionalism and our focus is oriented to doing the job well and always learning about the environment we operate in. I encourage you all to explore great opportunities because I think our entire ecosystem benefits when people dedicated enough to come and learn and speak at conferences such as this share their expertise. And who knows, maybe one day I'll go back into a more computer-security-oriented role. But for now, I've got a plane to catch. I hear there are some jerks in Halo3 who need a good banx0ring.

[Slide: Thank you.]

Thank you all for coming this morning.

Drinking from the E-mail Fire Hose

I always wondered how people deal with a massive amount of e-mail. The past two years have seen a huge leap in the volume of e-mail I get daily. At work, it's not such a big deal to get five hundred or so e-mail messages in a day, because not all of them are to me specifically, and not all require a reply. Many can be reviewed as rollups every couple of days.

Personal e-mail, however, is a lot different.

I now get a lot of e-mail at my stepto.com address. From people asking me about security stuff to normal geek correspondence to Xbox stuff to other stuff. I was shocked a month ago to realize in the previous six weeks since I had cleaned out my inbox, I had roughly six thousand items in my personal inbox, thirty-one hundred unread. On top of me twittering like a crack-addled twitch monkey on speed, blogging like someone with diarrhea of the blog…hole…and just regular e-mail correspondence, it occurred to me I wasn't replying to like 75 percent of what people were sending me. Doh.

Unlike work e-mail, the majority of these e-mails to my personal address deserve or expect a response. It's been bothering the hell out of me how to deal with it, so I came up with some ideas. Should you ever find yourself in the wonderful position of having so many people want to talk to you that you cannot answer it all sometimes, this might help.

So here are my tips for handling large amounts of e-mail:

#1. Accept that you'll occasionally get a level of volume that you simply cannot read/reply to it all.

As a geek, this was a hard point for me to reach, and I'm thankful that this situation tends to come in waves and isn't constant. With the e-mail culture at Microsoft, not replying to e-mail that needs a reply is considered actually impolite. But between work and personal, I'm hitting that volume level occasionally and was surprised at how low the daily bar was before you realize that all that e-mail stacking up just compounds the problem. But at some point you gotta bend like a reed in the wind when it comes down to cooking dinner or wading through sixty more missives just because you would feel bad someone you have never met sent you something and you just don't want to come off like a dick.

The lesson here is eventually you'll come off that way unintentionally or you will die of starvation/insanity from never taking a break from e-mail.

How to cope with this? I've begun making sure that when I do occasionally hit the level where I can't get to it all, I make the time to pick a few at random and reply to them, so at least some people can get a reply to their question or comment.

#2. Beware the tyranny of the inbox.

Part of the reason I got into the thirty-one hundred unread mess in such a short span of time was that I was basically having everything go to my inbox, and then I would manually sort it from there into “reply to,” “records,” “family” type folders. So my inbox wasn't helping me prioritize at all; it was just a stream of incoming messages. But because it was my inbox, it's where I spent all my time.

Instead, create a series of subfolders to help prioritize, and spend most of your time there using aggressive filtering.

Which reminds me:

#3. Filter aggressively.

The reality is that personal e-mail, like work, has priority levels. E-mail from someone asking me particulars about how we do enforcement on Xbox LIVE is going to be a lower priority than an e-mail from my brother helping to plan my mom's sixtieth birthday celebration. Especially since the former is already available on my blog or existing podcasts. Create groups if your e-mail client supports it, and use rules to route mail from groups automagically into subfolders. I created a folder called Primary Senders that has mail family and friends sorted from out of my inbox. I further sub sort by whether I'm cc'd or on the To: line, and sort by domains and senders to filter newsletters, monthly meeting stuff, etc into their own spots. So I spend most of my reply time in Primary Senders or in the folder I use for when people report bad folks on Xbox to me. And I monitor Inbox for different things.

#4. Portability.

I'm very thankful I can get e-mail on my phone. My wife, not so much. But me, yes, because it means I'm not chained to a monitor. Get your e-mail into the cloud. It makes all the difference in the world. I find I can catch up on a lot of discussion list and digest stuff waiting in line at the cafeteria or in a cab or even offline on a plane trip. You certainly have to know when to put it away, and I'm still struggling with that part. But at least I don't dread sitting down in front of my machine because the blue number next to the folder is four digits and those four digits tick upward, distilling guilt units into my brain.

Lastly, try to find some way to let people know you've crossed the line into crazy e-mail land. I've written something like this on my blog:

To those sending me e-mail:

I do indeed try to read every e-mail, even if it's just in the preview pane.

You probably sent me something very cool or very witty or otherwise awesome. Please know that I probably read it and lol'd or was otherwise appreciative and thought, Wow, remember to e-mail him back, and then never did for lack of time. Again I apologize.

Often you might resend it, wondering if I'm actually reading my email, and upon receipt I felt guilt and said, “Wow, remember to e-mail him back,” and then never did for lack of time.

I'm honestly very sorry about that. But I've come to grips with the reality that my daily volume sometimes hits the point that between work and personal e-mail, thirty seconds on one reply each day for both would rack up to about two and half to three hours a day simply trying to reply to everything. And that's on medium-level volume days. So if you sent me something and it was something you really feel is important or cool or you worked hard on writing up for me, please know that it's not you; it's me. And I really don't want to get to the point where I setup some type of auto-responder, especially when people are reporting miscreants to me or ask me to join a game because some people are being dicks in it, etc.

Hopefully these tips will come in handy for other people, and I certainly don't mean to complain or have people think I don't want them to be able to e-mail me. It's just the law of large numbers has collided with a finite amount of time, much like goat butts up against hedge, and horns become…entangled.

On Bill Gates

Bill Gates officially retired from Microsoft in 2007. That was a huge adjustment for the company and the source of a lot of navel-gazing by the local punditry who had made their mark based on analysis of, or access to, Bill.

Being a Microsoft employee for so long, I had a better, different perspective. Bill was a guiding light more than anything to many of us. He was never the bogeyman or evil Borg king he was made out to be. I can say two things, and I will say them for a long time: Bill Gates is exactly as smart as everyone suspects him to be—I don't care if you are a smart ass Internet commenter who believes you are far smarter than he is. Second, Bill analyzed problems. He didn't conquer markets or crush enemies.

As I might have mentioned already, I'm of the Microsoft era where Bill really tipped from being the 60 percent technological/40 percent business, to 60 percent business/40 percent technological as the company ramped up and exploded in all directions with products and technologies—oh, and went from a small company to a ginormous one (it's a word).

Back in those days, Microsoft had about twelve thousand employees, but even then, the presence of Bill was often felt in everything you did—even if you were an entry-level support engineer in a satellite site (we weren't even really called a campus then because we leased two buildings). Bill was famous in the company for his nature of being unforgiving of mistakes.

Product support had a really outsized role in the shipping of products for Microsoft. As I mentioned previously, the processes and procedures for shipping software meant that the developer team handed off a release candidate to support, and support would sign off on the build. That sign off was an actual formal document where support said, “We've documented the known issues and we agree that this product is supportable and we will be on the hook to support it and the associated costs.” So after getting a build that the product team deemed a release candidate, support would then spend days bug-bashing it. Anything we felt was a bug that would impact customer satisfaction or dramatically increase support costs was filed, and support would withhold sign off (meaning release could not happen) until it was fixed. In the end, a contentious sign-off process always got escalated to the development and support executives to reconcile if development thought support was being over cautious or support thought development was being blinded by ship fever.

Well, a bug was found during testing of a side technology of a product that in this story shall remain nameless.

Development balked, as it felt the product issue was an edge case. It got escalated, and the product ended up shipping, but not before we in support studiously documented our projections on impact and our rationale for getting it fixed. That particular product experienced a record number of support costs due to issues involving this particular technology, way beyond projections. Of course, that type of thing reaches Bill, and he called a meeting of the support and development people.

With laser like intensity, Bill lit into the support people. How could this happen? Who was responsible? What kind of way was this to run a support business? The support folk, well-armed with the documentation from the sign-off process, handed it over to Bill. Bill looked it over.

He then pivoted his chair over to the other side of the table and lit into the development people. “How could this happen? Who was responsible? What kind of way is this to run a development process?” Needless to say, the development people had no documentation and no defense. The support people felt good after that meeting. The product team, not so much.

Not many people have had practical experience with just how overwhelmingly smart Bill is. He can take a completely new technical situation and dive to the deepest part of it quickly to find out things you never thought of.

When the vulnerability that resulted in Microsoft Security Response Center security bulletin MS03-026 was reported (the vulnerability that criminals exploited with the Blaster worm in 2003), we determined this was one of those issues that we wanted to make sure the executives were fully briefed on. Mike Nash, then vice president of the Security Business Unit, wrote up an e-mail summarizing the vulnerability, fix plan, communications plan, etc. to Bill and the executive leadership. That mail was sent on a Sunday afternoon, and I was on the cc line as the technical contact/MSRC owner for the bug.

Forty-five minutes later, Bill replied to the e-mail. (I confess, I let out a geek squeal of excitement. Bill replied to an e-mail that I am on!) The gist of the e-mail was, “I've read the technical breakdown and understand it. One question: What happens if [detailed technical scenario involving attack that none of us had considered].”

Bill had, in just a few minutes of reading some high-level exec summary stuff, uncovered a deeply technical edge case we missed.

I turned pale(r). My cell phone rang. It was Mike Nash.

“He's right, isn't he?” Mike said.

“Yeah,” I said.

“But as I understand the scenario, the fix still blocks it,” Mike said.

“Yeah, it does,” I replied, “but crap I wish I'd thought of it in the attack vector section of the mail.”

Mike laughed. “Do you want to reply?”

“Uh no, Mike. I'll let you tell him.”

So Mike replied and told Bill he was right but the fix addressed that and the scenario didn't affect our timelines to get this out ASAP. My wife, Rochelle, came into my office because she knew I was working this thing, and I just sat there gob smacked. I tried to describe to her that someone eight levels above me was engaged enough at the technical level to turn a problem inside out like that so fast.

You hear Bill is smart, but rarely do you realize the level at which he's smarter than almost everyone who works for him.

The last thing I will say is that when you've been a longtime Microsoft employee from the pre-Steve Ballmer presidency, you kind of take for granted how approachable Bill is. People are often shocked by it. A couple of years ago I was looking into getting a SPOT* watch. I liked the idea, and the screen, but it just seemed so clunky and heavy to have on the wrist. Then it hit me late one night while I was reading about them: Hey what if you made a SPOT watch that was a pocket watch? The form factor works much better, and the screen could be a bit larger, and perhaps you could even integrate touch to it. So knowing Bill was a huge booster of SPOT watches, I sent him an e-mail. “Have we looked at doing SPOT watches in the pocket watch form factor?”

People kind of freak out when they hear that. “You just, what, e-mailed the CEO? Out of the blue?”

Yeah.

You could do that. Not some long-winded e-mail about convoluted topics, but a quick idea involving something of interest to the company.

Bill replied almost immediately (at night!) saying yes indeed, they looked at the idea, but not enough partners wanted to make them (pocket watches being a niche market), and he cc'd the SPOT watch market research executive to give me more info if I wanted it.

And that was Bill. First and foremost, he is a lover of technology. He loves interesting ideas and never wants to wall himself off from them.

I could say I'm going to miss his influence at Microsoft, but that would be remarkably shortsighted. His work at the Bill and Melinda Gates Foundation is going to end up changing the world in far better ways than his work here did.

____________________

*Smart Personal Objects Technology

How to Be an Effective Spokesperson

A lot of people don't understand corporate communications. For better or for worse, Microsoft has handled some things well and some things poorly in this regard. When things get handled poorly, there's a tendency to lump everything together under the monolithic term Microsoft, not realizing that there's usually an entire team that worked on a plan to disseminate what eventually turned out to be bungled communication. Most of the time, bungled communication comes from an ineffective spokesperson. I don't mean someone who can't speak or stutters; I mean someone who doesn't take the spokesperson role seriously enough to make sure he is inserted not just into the communications plan, but deeply into the issue being communicated.

For a time, I was the spokesperson for Microsoft during security response situations, either routine or crisis. I spent nearly five years in the hotseat, doing crisis PR for the company. In short, this is about how to be an effective spokesperson.

Not a good spokesperson, by the way. That requires a lot of skill I would not presume to say I have or could pass on. I mean how to effectively understand the spokesperson's eternal dilemma: communicate what needs to be communicated to express transparency, and understand what won't or should not be communicated, so that you have the full context such that you won't lie—intentionally or otherwise.

First and foremost, dive into your beat reporters. Know them well. I don't mean their tone; I don't mean what a PR agency report tells you about their tendencies. I mean know them as people. Do they have families? What's important to them? Find this out from them. Talk to them; never be afraid to make the time to know them before, during, or after the interview. Don't waste their time, of course; learn this over several encounters. But know it and truly internalize it. Then, be sure you share the same information.

Never use that information as leverage; the point is that communication is never without human context. I think Tim Russert knew that very well, which is why anyone he ever covered today is talking about his family and his dad and his life in positive terms. The journalist is not your enemy or your friend. He is a human worthy of respect, and the understanding of the context he brings to the topic you are representing is crucial. Know that. Respect that. For any journalist I have spoken to officially to this day, I can tell you the salient facts about him in a positive and respectful manner. Even if I didn't like his coverage, I can say what makes him a three-dimensional person with character.

Crisis communication, in and of itself, is easy. Tell everything you know, and tell it yourself, first.

Such a simple rule. But often it becomes so caught up in “but if we did that, we would get sued!” or “if we did that, the terrorists would win!” or “if we did that, then just anyone could make Kentucky Fried Chicken.”

Regardless of the mechanics of the rule, the most important part about having a communications expert is to trust them. They have to know everything. Every decision. Every reason behind it. I've been locked out, and seen others locked out, on the premise (bought into by the decision-makers) that “we can't tell the communications folks yet…they talk to the press!”

If you're in that position as a spokesperson, immediately let them know that the person who has hired you has just expressed a no-confidence vote in you. The worst danger here is that the people who hired you are not interested in true PR and respect for journalists; they are interested in not being transparent (for whatever reason) and are making you the mechanism for that lack of transparency. You have to point out to them that you're the most trusted individual in the process, not the least. Otherwise, you have to eventually quit and your only recourse is a bitter tell-all book. And then you just become a regretful whistleblower for profit. Wait, I'm writing these words in a book. Forget I said that!

Good communications people and spokespeople insist upon being in the room when the decisions that they will have to communicate are made. And they point out to their clients that they were hired to communicate effectively and with integrity when they might be presented with resistance. Journalists will challenge you up to a point at the outset, but the Internet and speed of news cycles today means that you could possibly get away with a deception (intentional or not)—but that only if the stakes are high enough or the long tail of the topic is long enough.

Here are some warning signs to the fact you, independent of skill, cannot be an effective spokesperson. There are crucial meetings on critical public topics you find out about later that didn't involve you. Messaging you didn't write and had no hand in creating suddenly appears as “we need this communicated broadly, ASAP,” and when you push back, you are told, “Don't worry. This is all lawyer-approved. We didn't want to involve you,” or worse, “You are legally bound to say this and only this,” when you were never in any discussion with a lawyer.

Never let anyone you represent communications-wise cut you out. Period. There is no letter of exoneration where you can claim, “Hey, they made me say this!” You're either a communicator who trades on integrity to only communicate for people you trust, or you are the bettor for the person actually holding the cards; you're the sucker at the poker table. A table where you thought it was all fun and games until everyone else figured out you had a weak hand and some money.

Playlist Shame

The release of the Zune 2.0 garnered a lot of interest. We were locked in a battle with Apple over the iPod that everyone said we were destined to lose. In this case, however, the team looked at how people used music and saw something the market leader wasn't really delivering on. In the case of Zune 2.0, that was “the Social.”

I'm not a fan of the phrase, but it is what it is. Point being, we came up with a media player that was far better than iTunes, and added a few lessons from the Xbox world: tracking listening behavior and letting you publish it. Meaning you could get credit for what songs you played, and you could share that credit with others publicly on the web. If you liked to listen to Sting all day long, you could compete with other people to become the number one Sting listener in the system by showing other users who you listened to and how often.

This required, however, that you publish your complete playlist. Which quickly led to the phenomenon I discuss in this story:

I have identified a syndrome as a result of using my Zune: Playlist Shame.

I'm ditching using my phone for music for a while to use my Zune. Although I carry my music on my phone, I only very rarely listened to the device itself. More often I would plug it into whatever computer or Xbox was handy and just play the music off of that. So I'm now trying to get over my own weird discomfort of using the device in public. I've always felt weird walking around, say, the grocery store with the ear buds in. It just feels rude to me to be so obviously and visibly disconnected from everyone. I have no idea why the same shame doesn't apply to checking my e-mail on my phone or taking a phone call in public, but there you have it. Get off my lawn.

But now I'm addicted. I love the thing. Sure it does everything my phone did with music, i.e. plays it. But the Zune social stuff is pretty cool, as you can see what people are listening to and sample songs from them. Which brings me to the new phenomenon of Playlist Shame. First off, let me state my music collection has plenty of embarrassing stuff in it. And I'm not going to use the old standby that the crap is my wife's or songs I just have “for other people.” Look, there are just some times when I roll with Streisand. Occasionally Air Supply's got my back. And you can wince all you want, but that Xanadu soundtrack has some killer tracks.

Playlist Shame starts out like this. You put your collection on the Zune, sign up for the Social, and play your merry way along. Then someone sends you a comment or an e-mail to the effect of “Hey, man, you like Justin Timberlake, too?”

Upon receipt of that e-mail/comment, the sufferer of Playlist Shame will immediately form this thought: Oh no, what will people think of me? This is followed by researching how long it takes a song to register in the Social from start of playback (twenty seconds) to then creating playlists that buffer the embarrassing content with twenty tracks of more high-brow stuff like Miles Davis\Frank Sinatra\Bob Dylan. You can often find people with Playlist Shame in meetings, their Zune connected to the computer, merrily playing, but with no headphones as they try to shuffle Dolly Parton down the playlist so people don't see it.

If I'm not embarrassed about my playlist, or just don't have the good sense to be embarrassed by it, then how do I know all this?

Well, I don't want to name any names or anything, but the above behavior was recently detailed to me by someone who suffers from it and was consumed by self-loathing enough to confess.

Bloggin' in Millennium

Moving groups within Microsoft is always interesting. When I moved from Product Support Services to the Microsoft Security Response Center in 2002, I wasn't blogging a lot of Microsoft-oriented stuff. So when I moved from the MSRC to Xbox LIVE, I thought it would be fun to let people know what that was like:

So this week marks my first week in the Xbox group; I started Monday. Originally I was going to blog the whole week, but it's always hard to factor in all the new things you will be doing that take up the day when you change groups, so this is a bit belated.

Friday was my last day in the Trustworthy Computing Group. It was actually a real downer of a day. As I was looking around my office trying to figure out what to take myself and what to leave to the office movers, it struck me just how much my office was a reflection of a lot of the security response stuff I'd had to do. The futon I bought after Blaster, the microwave and fridge I had put in during Slammer, my SP2 posters and T-shirt on the walls. It's no wonder the Waggener Edstrom team referred to my room as the Dorm Room. Another sad bit was the ritual removing me from the circle of trust. I would have no business need in the Xbox group to have access to Windows and Office source code or security databases. All my rights to special access rooms like the MSRC situation room were revoked, and I was removed from a myriad of inside access lists and mail aliases. I was no longer need-to-know. It was like that inevitable cliché in video games where you battle through the whole game, gaining weapons and cool stuff, and then the game for a brief time strips you of everything somewhere near the beginning of the third act. I felt like I had just had my Portal gun taken from me.

So it was a bit of a melancholy mood I was in Friday. I'd transitioned my projects and other work over the past several weeks, so I filed some last-minute paperwork (expense report from BlackHat, etc) and picked up and lit out early Friday.

Come Monday, though, I was feeling pretty groovy. One of the really great things about the Millennium campus is that it's a mere fifteen minutes or so from my house, so my commute is now a short jaunt with no traffic as opposed to the long soul-crushing wait each morning and each evening at the 520/Avondale juncture where every Microsoft employee who lives on the far east side ends up.

The Xbox buildings themselves are fun for a gamer to just walk through. It seems like around every corner there's a display case filled with amazing stuff, like prototype cases for the Xbox1, or original clay figurines of Halo characters used to model the in-game ones. There are signed posters and autographed ship discs from famous games mounted on the walls.

Moving groups within Microsoft can be a bit of a long process, and there is both a set of tasks for the employee as well as a set of tasks for the group administrators. My first task was to go in and remove myself from all the non-confidential security e-mail aliases that I was a part of. There were dozens of internal Microsoft lists that I now had to remove myself from because I just wouldn't have any time to keep up with the discussions. So the first part of my morning was spent with an internal tool departing various discussion lists and joining new ones relating to my new role.

After that it was walk around and meet everybody time! My manager Ben came by and we basically walked the corridors. I'm just down the hall from Xbox Dad and Major Nelson. The first thing I realized very quickly was how much being in this group reminded me of when I first came to Microsoft. Back in '94, everyone was abuzz about Chicago (Windows 95), and there I was, walking around offices where everyone was running the pre-beta1 build of something everyone wanted. Well it's not too dissimilar here, as a variety of games I'm not at liberty to mention are being evaluated or tested.

Then it was equipment time! Am I using a lot of exclamation points? Yes!

Used to be, when you changed groups at Microsoft, you traded in your old hardware back to your old team and went and got hand-me-down or new hardware from your new team. We changed that policy a while ago such that your assigned equipment goes with you in terms of your work PC, etc. But of course there's unique hardware here, so I had to get a 360, Zune, monitor, and speakers. People asked me if it felt weird having an Xbox in my office, but actually, I had my personal Xbox in my old office with my old group. In fact, I went with the set of speakers that are my personal ones rather than the ones they had in the group (a pair of old but really good sounding Altec Lansing's with a subwoofer).

By then it was time for lunch and about a million(!) afternoon meetings. Then it was machine setup time. Each group has its own internal tools(!)* and websites you have to get to know and use. So Monday and Tuesday were spent learning all those and their functions. I wasn't working per se; I was getting set up to work. In most groups, it is a tedious process. Here, it was like being in a magical candy land.

Once I got my bearings, it was time to actually get to work. For the first time in a long time, I was going to be directing development of a software project: creating a new infrastructure tool to drive enforcement on the Xbox LIVE service. I was going to forge a new Banhammer.

And I even got to choose the name.

I won't reveal what I chose as the name just yet; that's for another time. But this first week at Xbox was filled with all of the joys, excitement, fear, ulcers, and relief that my first few weeks at Microsoft many years ago contained. I still don't know if I am worthy to be here in the video game industry, a place that no other version of me in my life was capable of contributing to until this version of me arrived.

I think it's going to turn out great.

___________________

* Okay, I'll quit it.

I hope it turns out well.

I fear that someone has re-upped Candid Camera and any moment the ghost of Alan Funt is going to punch me in the jimmy and point out the camera guy.

Looking at Microsoft

A site named Gaping Void wrote what I considered to be a smart and insightful post on the current state of Microsoft in 2007. The post mostly involved the sense of Microsoft as an entity, not an amalgamate of people and divisions. It described the culture as homogenous, where I have seen it flow more like oil and water depending on what group was being measured against another in the glass of the whole corporate liquid.

It made me think, so I posted the following.

***

Gaping Void has a very insightful post on Microsoft. It explains quite a bit about how the company should be represented by its employees and not so much by some of the things executives say. The goal is not to point out that executive statements are meaningless, but the Microsoft I became a part of back in 1994 was a company where every employee was considered internally to be a representative of the company as much, if not more so, than the executive leadership. Yes, everyone outside Microsoft associates the company with Bill Gates and Steve Ballmer, but inside, we were encouraged to be technology advocates and talk about the company from an evangelist perspective. There were actually training courses on this, at least in my group when I started. So let's set aside the executive bluster and cheerleading for a second.

Today, people flip out over an Apple person using Windows, or a Microsoft employee carrying an iPhone. How did technology, or the use of it, become religious? Probably the same way religion became religious: when money and power got involved.

Somewhere, that ability to look at all solutions without decrying the ones that are competitive went away for us, and I've been thinking about it a bit. I think people read too much into a lot of things that get said at the top that are meant to lead or be bold, competitive statements. Microsoft used to be a place where employees were encouraged to use other products or new technologies just because doing so feeds your intellectual curiosity. Seeing what other people are making and the problems they are solving is a good thing across the board.

Then along came the great curb stomp in the corporate ideal that was the Interweb (the tubes!), and we all went into a paranoid fit that caused a reverse effect. Suddenly everyone was forced into a mindset that being a good Microsoft employee meant never using other people's stuff because that took time away from helping whatever team inside Microsoft that was making our version make our product better with your feedback.

When you take that mentality as far as we took it sometimes, that doesn't breed intellectual curiosity. Instead, through some sort of insular intellectual inbreeding, it creates weird technology monstrosities like ActiveX that have disparate inklings of neat stuff but the sum of the parts drools uncontrollably and is prone to hemophilia.

All of this is a long way of saying I think it got bad there for a while for Microsoft. But a few years ago, we turned a corner slowly, back to the good old ways. I see a lot of Macbooks on campus. I see more people fooling with Linux for fun (Why does Ubuntu get all the love? Does no one love Puppy? It's my favorite.) I see iPods and iPhones. The Wii is actually pretty popular. I don't feel personally threatened by Google!

I'm often annoyed when people express surprise that I bought my mom an iPod Shuffle or that I love the look and presentation of the new iMacs (backhanded compliment: I still think Apple needs to get their security act together, but they are much better now than they were two years ago). Or that the gaming device I love the most and that has given me more fun per dollar spent is my Nintendo DS. (I should note that the 360 is rapidly catching up.)

Maybe annoyed isn't the right word, because people actually say, “You're allowed to do that?” in a hushed voice, looking around as if there's a Microsoft reeducation center I might get sent to—and they might have to go too simply for mentioning it. It's comical. There was a huge uproar when I once told Wired I use Firefox on one of my machines. People speculated I would get fired for that.

Sure, the Zune people want MS people to use Zunes. But they realize that right now, for certain uses, a Zune is overkill. This is why I bought my mom that iPod Shuffle; she just wanted something tiny to listen to music when she works out. And yes, we owe it to our teams to give them feedback on how we can make the best possible product.

As Microsoft employees, of course we should strive to be good evangelizers of the products we sell. But we can do all that and still be intellectually curious and be people who are excited about all technology. Those are the people I work with everyday—both before, in security, and now, in the Xbox group.

More of us are blogging now, and it is my hope that people read those blogs and see that if I had a kid and that kid made the decision that she wanted an iPod and had fulfilled any parental limits I might have set before she could have one, I'd get her one. I'd look at how she used it or what made it something she wanted over anything else and provide feedback to our own teams, but I'd want her above all else to be excited about what she uses.

That's what makes technology great to me and keeps me in the business, almost fifteen years later.

Blogging at Microsoft (2006)

I get asked sometimes, “How does blogging work at Microsoft?” Blogging is a fascinating subject for me. I've owned Stepto.com and been using it as a blog since 1998. So it always amuses me, this starry-eyed “it's changing the world!” view of blogging. All blogging represents is essentially a simple online diary that everyone can read. Sometimes you talk about the tuna sandwich you had for lunch. Sometimes you talk about Big Deep Important Things ”.

When talking about blogging as phenomena, I think the most important thing to note right off the bat is that blogging isn't new. There are two pieces to blogging that make it popular.

The first is that this method of communication is new and groundbreaking, which adds a bit of a fad element to it. Blogging is really just the logical extension of mailing lists and newsgroup posts. Take Microsoft blogs. People freak out about them. Oooooo, look! Microsoft bloggers! They must have the inside scoop! They're being transparent!

Actually, we've been that way all along, through newsgroup postings by Microsoft employees, and private and public mailing lists that we have created. The only difference is that the web allows people to have their online diaries or personal observations easily accessed. Why load up a third party application, find a newsgroup server, and go to alt.discussions.software.microsoft.windows.windows_security.vulnera bilities when you can just visit blogs.technet.com/msrc from any web browser? So the delivery mechanism is new and easy. There's also the fact that the web allows a better layout and graphics than just plain text, but since most blogs are relatively Spartan from a web design perspective that's nice to have, but not necessary.

The second thing that makes blogs popular is the idea that you are getting pure, unfiltered commentary from the writer. I love it when someone sniffs out what the author feels to be the horrible hand of PR in a blog. Oh no! Coordinated blog posts! They're going PR on us! No, not really. There's an unwritten rule at Microsoft about blogging that goes like this: “If you don't own it, don't blog it.” This keeps, say, a low-level tech support guy in a remote sub from being mistaken for being the product manager in charge of Office just because his blog is a Microsoft employee blog. It's considered common courtesy that you let a product team or the people who actually own a topic blog about it, because they know it best. Then you link to their posts.

But what if the Microsoft employee wants to blog about something because her readers might be interested? Well if you don't own it, what happens inside Microsoft is that you can query our blogging alias to find out who does, and see what they are saying on their blogs. That way you can either link to their posts, or have the post you want to make verified with the people actually in the know. There's a lot of traffic on that blogging alias, and people are always reading each other's blogs because with the breadth of stuff we do, there's always something cool and new to read and talk about. So yes, you're going to find people repeating other peoples posts and content because either they don't own what they are blogging about (but want to blog about it to keep their blog interesting to their readers), or they don't feel like duplicating effort.

While I'm at it, here's another thing about blogging. There's nothing wrong with running your blog post by a PR person or a lawyer for your company if you are worried about the content.

I'm amazed that people think that's some kind of anathema and that blogging means people can only be transparent if they are willing to take legal risks or are willing to make work for a PR team by wording something poorly and having it misunderstood. There's been a couple of posts on my blog I've made that I ran by someone on a PR team, and they said, “Oh, hey that could get misinterpreted as this or that so you should make it clearer.” That was it. No extensive rewrite, no talking points, just another set of eyes to help with clarity. And yet I've told one or two people about it and they got a little huffy and flat out told me they would have to take that into account when reading my blog in the future, as if now I had become a tainted source of information. Some type of ochre gurgling pustule that one now had to handle via tongs and a strong splash of Bactine.

Yeah, sorry, I'm just going to roll my eyes at that. There's no reason why you can't maintain transparency if you represent a company and still let your PR professionals know what you are saying. Or have your legal team glance at a post you are worried about because you want to make sure you aren't exposing yourself or the company you work for to liability. I think it's crossing the line when you have entire PR teams and legal people read every post you make. In those cases, you have perhaps lost sight of the blog. But there's no violation of the spirit of a blog to occasionally use the professionals for some help, especially if you are gainfully employed by them. In the end, you're the editor of the blog, and if you don't like something or can't write it out in a way that makes you happy with the post, get some help or don't post it.

Anyway, at Microsoft, blogging is certainly encouraged, and we all try not to step on each other's topics. With several thousand Microsoft bloggers out there and hundreds of blogging topics, I think we're actually way ahead of a lot of companies in the way we communicate.

Don't Be a Dick

“If I'd beat another kid in a two-player game and taunted him mercilessly with explicit references to his mother's sex life and my role in it, the way some online gamers do today, he would have justifiably kicked the ever-living shit out of me.

So, I learned, in arcades the importance of good sportsmanship. Because arcades were physical places staffed by real people, we had to worry about a lot more than being kicked off a server if we were complete idiots in a game.

And I feel like a cranky old man by bringing this up at all. But, there's a lot of you here, so would you do me a favor? When you're playing online, have fun…but don't be a dick, okay?”

–Wil Wheaton, PAX 2007 Keynote

Part of the reason I took on my role in the Xbox group was that I grew up in arcades. Gaming has been a part of my life for as long as I can remember. Gaming, from tabletop to video, has been probably my largest formative experience. You played in person. Your opponent, grinning and perhaps smacking his Hubba Bubba a little too loudly, was physically present. It was Thunderdome. There were set rules and an outside force to enforce it. Those rules were time honored. The quarter placed on the arcade cabinet meant you had the next game when the current player left or ran out of money. This didn't have to be explained; it just was.

I can remember exactly one fight in all my years of frequenting arcades. A kid got furious at a game that he was struggling in (Commando, if I recall correctly), and in his frustration, he kicked the base of the cabinet and the entire machine went dark. There was a brief moment of silence, and then the kid next in line punched him for breaking the machine because it was the only copy of the game in that particular arcade.

Then the Internet came along, and with it, the concept that if you're anonymous, you don't run the same risks of behavior consequences as you do in the physical world.

Some customers I have talked to have said my team has a job they don't envy. But I love it mainly because I think the arcade experience is that of a bygone era, and I have some better tools than just kicking someone out of the game. I can materially affect their investment in our platform should it come to that.

I got into an interesting discussion today about context in online communication. The crux was how people judge tone and content against what they expect to see or what they might judge to be unpleasant or offensive. On Xbox LIVE, you have a clear Terms of Use and Code of Conduct. So you wouldn't expect to see certain things—as opposed to someplace like my blog, where I note it's my personal blog and it's for mature audiences. I meta tag it as such, and I occasionally drop a salty phrase or discuss a racy topic, both in the blog and any derivative content.

Garlic-infused soy sauce! Hot nude NASCAR porn!

See? Meta.

Some things don't need context to be abhorrent in either space, like a racial slur for instance. Other things don't make you flinch depending on what you expect.

In this discussion, I was making a point that the more clear and unambiguous the rules, the more difficult it becomes to forgive content due to context. On Xbox LIVE, we have a detailed Terms of Use and Code of Conduct to help make the service enjoyable to the widest possible audience. In that system (being worldwide and for a variety of ages), the context is always going to be taken at the least forgiving angle rather than the most forgiving angle. You can't say, “Sure the content was offensive, but I was just quoting a movie!” because the rules specifically prohibit broad classes of offensive content for any reason. Quoting something doesn't excuse it.

What I didn't consider was the obvious fact that this applies in social scenarios as well, like loudly cursing in a quiet church. No one cares why you are doing it; you aren't supposed to do it. As opposed to loudly cursing in a private beer-fueled poker game with your buddies when you just went all-in on pocket rockets pre-flop and got nothing else. Meanwhile, your friend builds a 10 high straight off an unsuited 6 and an 8 on the turn and river. Why why why why did you meet a pre-flop all-in with a 6 and an 8?

“Because I wanted to see you flip out” is the obvious reply.

But I digress.

It was brought up during the conversation that video games could be like the poker game, provided the proper context, since people play video games in those environments as well. My counterpoint was that LIVE is a service that matches both friends and total strangers, depending. Would you go to a poker tournament and behave the same way you would in a private match with close friends? Probably not. Unless someone goes all-in with an unsuited 6 and 8.

It's hard not to break social rules when that happens.

Context isn't all that important in the physical space because a significant amount is already present and discernable. But in the online world, we serve to provide that level of rule enforcement even in the absence of clear context. We serve as the check on anonymity that too many people use as a justification for being complete douchebags online—or dicks, as Wil so perfectly put it.

Come a Long Way

This post entertained me quite a bit. I had spent so much time at Microsoft working on security that it was extremely jarring to enter a world where all the work we had done on institutionalizing security had been, for lack of a better word, successful. In changing groups, I'd nearly failed to note the five-year anniversary of a major security change I was a part of implementing: the move to issuing security updates for our software on a regular monthly basis.

***

I'm sitting in a meeting today, and just before it starts, I pipe up and say, “Has everyone made sure to get today's out-of-band update?”

Blank stares.

“Oh come on, guys, it's important. make sure you download it.”

“What the hell are you talking about?” someone asked.

“Today's Windows security update!” I said.

“Oh, I have mine set to automatic. What's the big deal? It will install like normal, right?” someone else said.

“Yes,” I replied, “but this is out-of-band so you might want to force install it now.”

“What the hell is out-of-band?” someone else asked.

“It's when we release outside of the monthly update cycle,” I said.“That's rarely done, and only for severe issues where we see attacks in the wild.”

“We do them monthly?” the first person asked.“I never noticed. How long have we done that?”

That's when I realized it is five years ago this month.

You see, before October 15, 2003, we released security updates every week, on Wednesday at 10:00 a.m. Pacific. There was no advance notice. You either checked the security site or Windows Update on Wednesday mornings or you weren't responsible for security updates in your org.

I remember at the time several of us inside the Microsoft Security Response Center were very much against moving to monthly updates. It struck us as leaving people vulnerable for way too long and aligning to an arbitrary schedule. In addition, we worried about the impact to our relationship with security researchers, who more often than not adhered to the religious zeal that once a vulnerability was revealed, we should force every single human in existence to install untested fixes immediately. That last part was difficult. Security researchers tend to be a prickly bunch. After all, they found a horrible bug for no charge for their research that can impact hundreds of millions of people. In addition, almost 90 percent of the researchers we dealt with had no idea what it took to make and ship software in use by hundreds of millions of people, nor did any of them really care. So there was some consternation within the MSRC.

Boy, were we wrong. A couple of customer visits cured me of any notion that regular monthly updates were a bad idea for most security issues. I saw firsthand how customers could not handle having critical updates every seven days. The risk model to update reaction time was not scalable for even medium-sized organizations. Essentially, by the time a customer decided they could absorb installing an update, two more weeks of updates had been released. After a ton of research from customer feedback, thirty days was determined to be the optimum spread to make sure organizations could evaluate and deploy updates on a manageable schedule. I think it's turned out well. (Weirdly, Oracle would later mimic us but feel like they had to make it different so they made quarterly security updates.)

So on today's out-of-band update, I wish a very happy birthday to consumable and predictable update schedules and more protected customers in the intervening time. No disrespect to the security researchers, of course, but an update no one installs because they can't trust it…well that update doesn't protect anyone.

E3 2009: E, Cubed

In June of 2009, I got to attend the Electronic Entertainment Expo, otherwise known as E3. Held in Los Angeles, it's one of the largest video game events of the year, if not the largest.

And we were going to announce something super secret there: Project Natal, which was later released as Kinect.

One of the more amazing things about working on the Xbox is the relentless drive on the part of all teams to take the device and constantly increase its capabilities with new technology. Project Natal was probably the biggest leap of technology we could envision: a set of software and hardware that would work with any Xbox 360 that added full-body motion capture, speech recognition, and motion controls. The tagline for Project Natal was “Your body is the controller.”

Keeping something as awesome as Project Natal a secret is a difficult endeavor. I'm still not entirely sure how we pulled it off. But a mere forty-eight hours before our keynote address in Los Angeles, no one had any idea about the bomb we were going to drop. And I was going to be there! But first, I had to get to California. I decided since this was my first real visit to LA, I was going to drive from Seattle over two days. I've made the drive from Seattle to San Francisco many times, so I had an idea of what I was getting into.

Ah, California. There's a certain feeling you get when you enter the state. It's a feeling that's very difficult to describe. Things just seem to go a bit more slowly; you're able to look around and appreciate things more. Greens are greener. You notice little details on road signs a little more clearly. There's a distinct lethargy that seems enforced. It's not altogether unpleasant as you drive down that shining highway to the promised land and find yourself going from seventy to forty-five to twenty along with all the other drivers. Then, finally, you stop completely as everyone must, and a goateed man with enough piercings to fashion a nice chainmail shirt from his various rings and loops asks you if you have any fruit.

Yup, at the entrance to California on Interstate 5 and all other main highways, there's a full stop checkpoint to ask you one simple question: “Got any plants or fruit?” The state halts all traffic, just like an international border crossing, simply to ask that one simple question.

Ask him if he has the same problem Michael Palin did in Time Bandits, my brain fairly screamed to me as my mouth simply said, “Nope.” I half expected, as I always did when I reached the checkpoint, that a cursory search would occur—that the individual charged with protecting the state from foreign fruit would not simply take my word for it.

I counted five lanes of traffic stopped in such a way, each manned by a fruit checker. I thought of budget-broke California in that moment: how many times did people say yes, and of those times, how often did the plants or fruit have whatever contagion or infestation they were looking for? I'm just saying, California, you might be spending all that money fortifying your border trying to solve for the .001 percent case.

I arrived in LA the night before the big speech. The sun was just setting and I drove around thinking of Steve Martin's wonderful LA Story. On 101 heading towards downtown, I swear I saw several of the unique houses from that movie perched along some hillsides. I was getting pretty excited; I'd been with the Xbox team for two years but now I really felt like I was a part of the industry. Meeting up with friends for dinner, I discovered another huge surprise we had managed to keep secret: Sir Paul McCartney and Ringo Starr would be at our event to showcase the forthcoming The Beatles: Rock Band video game.

Security was incredibly tight. Special guests for the keynote and people preparing the final materials were cloistered on one particular floor. Every time the elevator stopped at that floor, exit from the elevator was blocked by two enormous private security guards. I'm incapable of lying about the level of sheer excitement I had that the stuff we were planning was so cool there was physical security preventing people from accessing that floor of the hotel.

And finally it was keynote time. I watched with glee as we finally got to spill the details on all the kick-ass stuff that it had been so difficult not to scream out loud about.

I had been brought into project Natal several months prior to E3, as any camera-based system has the potential for abuse. Once I saw the new hardware and software in action, I was astounded. Just five minutes into using Project Natal, you understood fundamentally that the world of gaming was about to change. Controlling games without an actual controller isn't going to be for everyone. But the learning curve to use and enjoy a high-end gaming console was suddenly a whole lot lower. Instead of handing my mom a controller with eighteen buttons, two joysticks, and a direction pad, she could just use her hand. No controller, no remote, no holding anything.

Project Natal wasn't the only set of announcements we made. In fact, we had such a wealth of things to announce that we actually had too much and had to cut a bunch of stuff. But the lead-up to the keynote and the overall success of the announcements had me on a video game geek high that was unprecedented for me. I finished the keynote waiting to be hit by a meteor, or a bus, or one of those enormous security guys.

I held up okay under that high, right up until I totally and completely lost my shit.

I got up early to catch both the Nintendo and Sony keynotes. The only thing that excited me was the possibility that the Wii Vitality hardware attachment might give us the ultimate video game experience: a game powered by your heart rate, Wii Crank.

Keynotes watched, I went to have lunch with Xbox LIVE's e and his girlfriend to debate the presentations from Sony and Nintendo and talk about what had us excited as gamers.

That might seem puzzling to the some people. There we were, all charged up with excitement at how our keynote had totally owned everyone else's content, but were still excited over the other announcements, too. I can only say that I'm a gamer first. I wrote before about being a lover of technology and how understanding how people use all technology helps Microsoft make better products.

I own all consoles from Xbox competitors, and one of my favorite video game toys is my Nintendo DSi. As of this writing, I work at Xbox to make it the best possible platform, and I think it is clearly the best platform. But this isn't a zero sum game. Fanboyism isn't really my thing, because it's really limiting.

But back to the story at hand: then Steven Spielberg walked right by me and I temporarily lost the power of speech.

Wait, I'm getting ahead of myself.

After our lunch, we hit the crown jewel of the event, the thing I was looking forward to the most: the deep fried Twinkie and Snickers bar combo of hot, sticky, sweet, dense, awesome gaming event goodness—the E3 expo hall.

The expo was divided into two halls: the south hall, which was mostly the Xbox booth plus a variety of other partners, and the west hall, which had Sony and Nintendo, alongside big names like Activision and Capcom.

We started off checking out all the titles in the Microsoft booth. Of course we'd seen a lot of them because, you know, we work there. But pausing slightly at a demonstration of the Sky integration LIVE feature, I looked up from the demo to see, passing less than a foot beside me, Steven Spielberg and a couple of his bodyguards. As my jaw hit the floor with an audible thud, e saw my reaction and delighted in taking the opportunity to try and engage me in conversation, “Are you okay?” he asked impishly.

My speech cortex tried to communicate with my brain, but my brain was screaming Did you just fucking see that? Eyes, gimme a replay on that shit that just happened!

“He—that—walked just now—things—movie I like—just now—right by us—he…” I stammered.

Did I diss on fanboyism just a minute ago? I lost my shit. Steven fucking Spielberg walked mere inches from me on the way to our private briefing area to show off Natal. In retrospect, there was thankfully no opportunity for me to engage him in conversation because I would have forever made him hate me by saying, “Thank you for Close Encounters/Jaws/Saving Private Ryan. By the way, what the hell were you thinking with Jurassic Park: The Lost World?” Of course with my temporary lost speech center, it would have come out “THANK—CLOSE—JAWS—PRIVATE RYAN—HELL—LOST WORLD?”

The final night we rocked the Bethesda party in Hollywood. I'll just say there was drinking and karaoke, and I dedicated Pearl Jam's “Alive” to the Lone Wanderer from Fallout 3. Our execs showed up, too, and to say a fun time was had by all is a bit of an understatement

I hopped into my car the final morning for a leisurely drive back home. I'd finally gotten to visit the Mecca of video game fans everywhere. I had gotten there on my own; I'd earned it. Little was I to know it was only going to get better.

I've got the PAX

To frame my final chapter, I should explain the Penny Arcade Expo. Established by Jerry Holkins and Mike Krahulik, the Penny Arcade Expo is the largest consumer-oriented pure gaming event in North America. It started out as a place where readers of their web comic, Penny Arcade, could gather for a couple of days of fun. It has become something much greater than that.

In the video game world, there has historically been only one type of event: the industry event. By that, I mean events like E3, as discussed in the previous chapter. These events are put on, at a high dollar value, by the only people who can afford to put them on. Industry events bring out the best of the best from a gaming perspective: expensive stars, demos of new technology, big industry announcements. It brings out the money—the bling, if you will. But those events are without fail closed to the public, or the cost of entry is set so high as to prohibit participation by normal blingless folk.

But now there is the Penny Arcade Expo. PAX.

Lest you need a whole lot of explanation, PAX is the convention for the people. It is the convention that is designed from the ground up for the person who games, be that video or tabletop or other. PAX, for lack of a better word, is real. It started out in Seattle in 2004. Over the years, it has grown into a massive organic event, a gathering so purposeful as to be given life via a whispered ideal: being at PAX is like being home.

It soon grew beyond one coast. And in that glorious year we make contact, 2010, it debuted in Boston, MA, to the tune of more than sixty thousand people.

In my role at the Xbox group, I had spoken at what was now to be known as PAX Prime in Seattle in 2009, the original (yet now overshadowed) event. During that time, I was humbled and proud of being a representative at that most worshipped of gaming Meccas.

Again, thanks to my role at Xbox and work at Microsoft, I was invited to present at PAX East. Being invited to speak at an inaugural event, I felt an obligation to raise the bar beyond just encouraging good behavior or listing what my team does. I felt I had state the philosophical position around behavior online and give a call to action. My thinking was that this crowd, PAX attendees, were completely in sync with what I wanted to share with them. That if PAX was like coming home, then we should use that to connect and try and make things change.

I gave my speech and steeped myself deep within the entire experience of PAX. As I departed, I tried to capture the feelings I had at both the honor as well as the camaraderie of the entire experience. As always, as a geek, I found the voice I thought was appropriate from my past. I flew out of Boston, and I wrote this:

It's March 28, the year we make contact, and the physical me is present in seat 6c of a 737-800, cruising away from PAX East 2010 in Boston at thirty-four thousand feet. I'm heading back to Seattle along with a number of other attendees. In theory, I am looking forward to being at home with Rochto and the dogs, back at home after the culmination of two weeks of prep and work, ready to take tomorrow off and relax. But if you could scan the mental state of everyone on the plane, there's just a wormhole in seat 6c.

***

It was 1982, and summer camp was the greatest thing ever. As a kid growing up awkwardly, summer was the time of fresh beginnings—a place where the cliques or trials of school were cast aside in favor of the daily romping with the neighborhood kids who you might not share schools with. During the summer, you weren't the person you were in school. Or, more accurately, you could be yourself freely without any real repercussions that came with time spent forced to be around those who didn't quite understand you. When school started up again, it always felt like every year was a fresh start and would be different. The things that weren't pleasant about the previous year wouldn't happen again.

But the best manifestation of the freedom I always felt during summer was summer camp.

I started going to summer camp around age ten. For two weeks, I was away from my parents, away from my normal comfort zones, and most important, away from my normal discomfort zones.

At summer camp, you were all equal. You typically only knew a few of the kids you spent time with. Because you were away from home and perhaps missed it, the tolerance level and friendliness level was much higher. Kids who might beat the crap out of you if you went to school with them nine months out of the year were suddenly interested in why you had all those graph paper drawings of dungeons. In turn, when it came time to pick teams for baseball, no one knew you were always last to be picked in gym class, and by surprise you could find yourself playing shortstop instead of right field. At summer camp, nobody played games like dodge ball or wall ball. Instead it was the classics: soccer, baseball, football. Summer camp became a place you went to be among people who might not be like you but felt the same excitement about being in a new place and being with other kids.

***

It's the day before PAX East and I'm grumpy. Flying always makes me grumpy. But at least I am on the ground in one of my favorite cities on Earth: Boston. And I am planning to spend the next seventy-two hours with people from all over the world who love, as much as I do, the idea that your imagination and a little bit of framework (be it tabletop cards and boards or the vast worlds that consoles create) can fundamentally unite all of us. I feel a charge of excitement. Beyond a couple of set PAX related events, the recording of the Major Nelson Radio show, and my own speech, the next seventy-two hours hold a kind of promise and mystery that feel familiar, though I can't place it in the moment. I get off the plane early because I am at the front, and stand for a moment waiting for my friends. Suddenly a big stupid grin slaps itself on my face before I can even tell you why it's there.

I am at PAX. Better yet, I am at PAX East. The very first Penny Arcade Expo ever held outside of Seattle. I am with a posse of awesome friends, in a city that has no idea what it is in for, and I am about to encounter a crowd some sixty thousand strong that has never experienced anything like they are about to experience.

I check my backpack, which will end up being my constant companion. All the essentials are there: bottled water, my Nintendo DSi, my netbook, snack food. It is important to be prepared. My friends are at the back of the plane. I want to get going, I'm practically bouncing in place as more and more people deplane.

I want to get started, because too soon it will all be over.

***

When you went to summer camp, typically you provided your luggage and a variety of other things to your camp guide. Their job was to make sure any special needs were held by them. This included medicines or other essentials. But every kid knew one of the great secrets of summer camp was the backpack you got to bring in yourself.

The idea behind the backpack was that you would fill it with books or perhaps items from home that would keep you from getting homesick. Invariably, any smart kid would certainly pack one or two of these types of things. But the smartest among us would pack it with anything we couldn't get away with playing with at home, or if you were really bright and had an entrepreneurial streak, lots of candy.

After a tentative first few nights missing home and hoarding your treasures, the inevitable friendships would develop. Free from the responsibilities of having a set bedtime or having to worry about school, late-night sessions were spent teaching the best hitter on the camp baseball team what those weird dice were while everyone shared the rich kid's stash of atomic fireballs. Comics would be pored over and traded. Arguments over the mystery of the girl's camp across the lake would ensue.

Each morning, we gathered in front of a central area for breakfast. And they would let you choose your own breakfast! You could have anything there, and more if you wanted. There was cereal of all kinds, pancakes with syrup, eggs, and bacon! At home you got what was delivered to you. But here! Here for the first time you could mix and match, have whatever you wanted! Each child chattered excitedly in line: “What are you going to have?” Kids who never had time for each other elsewhere were opening up due to the common thread of being away from home.

Away from everything else, you reset expectations. We recharged that part of all of us that saw kindred spirits and then bonded with them.

***

It's one day into PAX East. I walk through the lobby of the Sheraton hotel on my way to record the Major Nelson Radio show. Across all the tables of the lobby, cards and games are spread out. I spot Munchkin, Magic: The Gathering; several people had spread out a Settlers of Catan game on the huge hotel lobby main table. The Sheraton staff seem perturbed. This is a business hotel. A nice hotel. What are all these people doing playing games everywhere?

I hear an argument break out as I pass a table game, an arcane rule disputed. It was argued politely and is resolved just as I exit earshot. I move out into the main hall, again a grin I cannot control on my face. I spend a lot of time like that, smiling just at the charge of being around so many diverse people all in one place. People of common purpose and passion. This was the main message of the opening keynote of the event, delivered by Wil Wheaton: “Welcome home.” I run into people I just met yesterday who stop me and excitedly show me cool stuff they picked up at a booth that they thought I might enjoy. One of them is an ardent PlayStation fan, the other only owns a Nintendo handheld. We chat for a moment and move on. We're all different, and we're all the same.

I move through the main hall to spot the line of people waiting to get into our talk, and I balk for a moment. They are turning people away, so many people wanted to hear the presentation. Each week we sit in a small conference room and record the show for tons of people to listen to. This is the first time we are going to record it live in front of an audience. And there are so many people who want to see that, they don't have a big enough room for us and the audience.

I pass some people who recognize me and say they can't make the talk, and I offer them some tokens for a PAX East hoodie for their Xbox LIVE avatars as I apologize for the lack of space. They are beaming with excitement as if they never tried to get in; this is their very first gamer event and they are going to the expo floor, where they will be able to play games that will not be out for months. Their energy is infectious and banishes my nervousness. They are so grateful for the event and so excited to be amongst gamers. That silly grin hits me again.

***

I was holding a gold-spray-painted rock in my hand. It was the middle of summer camp, and this was the gold rush. Overnight, the adult camp guides had scattered gold-painted rocks across the camp. On this particular morning, we had all been told that overnight the local (nonexistent) gold mine had exploded, scattering gold nuggets everywhere. Of course this was preposterous, but us ten-year-olds couldn't help but want to believe.

The goal was to gather the most gold nuggets; then whichever kid had the most would win a prize when he turned them in. It didn't take long for this to seem fishy to us. “If these are real gold nuggets, why would we give them away to the camp guides?”

The rocks were pretty convincing. As we began to spot them and gather them, we could see that only certain parts of the rocks had gold on them, roughly looking like the types of gold rocks we'd seen in the occasional Western film. Most adults would have spray painted the whole thing. Still, we knew the likelihood of actual gold being scattered around the area from an explosion in the night we had not heard from a gold mine we'd never known about was extremely low. We then began to inquire as to the prize for the nuggets. It was, essentially, a ribbon plus anything you wanted for dinner that night for the top five kids who got the most rocks.

So we turned it into a game. Quickly, we began trading fake gold rocks for candy. Some of us figured that the prize did not equal the hunt, unless there was a better reward. Thus unified, we gathered rocks for those who wanted to compete for the ribbons and special dinner, and in return we got candy. No one lost. If anything, we bonded more closely together because we created a game and united against the one influence from our outside world that was present: grown-ups.

***

I am sitting in a bean bag amongst all my friends, watching Paul and Storm perform Frogger: The Frogger Musical mere feet from me. It's the second night of PAX, and at the end of each night, there is a concert. Different geek acts from all over play for several hours, many of them known nationally (like Paul and Storm, or Jonathan Coulton), some not so well-known but just as good (like Metroid Metal). For PAX Prime, the concert is usually held in a gigantic flat open room at the Washington Seattle Convention Center, but here at PAX East, it's in a multilevel stadium theater that looks like it seats four or five thousand people. Since there is actual seating, the place is jam packed.

I am lucky enough to have been given a VIP pass, which allowed me and friends who also had passes to enter the coveted bean bag reserved area in front of the stage. I choose not to waste it, soaking up the acts as they come on, knowing how many people would want to be where I am. But there's one moment where I want to be in the crowd: when Paul and Storm sing the last part of Frogger: The Frogger Musical.

The chorus at the end is a bit of a play on the end of the video game,* with the refrain “And Now I'm Home.” The soul of PAX is a unique mixture of a sense of camaraderie and place of comfort. The song speaks to that very deeply. And it does so through the lens of a decades old video game, a funny parody, and a finale that melds all of those aspects so well that an auditorium filled with geeks and nerds and gamers are all waving thousands of cell phones and gaming handhelds back and forth as they sing, “And now I'm home,” as loud as they can. I stand up from my coveted VIP spot at the front of the stage, and I look back behind me, and I see everything that PAX means to all of us, wrapped up in one magnificent moment of song and light and singing and unity. Silly? Sure, a lot of people might say so. But when you're there and you see it, you kind of realize just how fucking outstanding it is to be in a room filled with thousands of people who you can be pretty sure you would like to spend at least some time with.

______________________

* A frog must reach his home through a roadway and swamp filled with multiple obstacles. If you are actually reading this to learn it for the first time, it confirms you were born after the release of Return of the Jedi.

***

We were all clustered around a bush beside a wooden bridge that overlooked the dry creekbed below. There were four of us and for all we knew we're the last four going to be left if we screwed up. Our flag football belts were brightly colored and might have given us away, but it was a moonless night and the bush provided enough to hide behind. We whispered amongst ourselves. It'd been ten minutes since the game of Jail had started. The counselors had yet to show themselves. One quick grab of the belts around us meant we were out of the game if it broke away unless we could be rescued by our team mates.

It was the second week of camp, near the end. The excitement was high. Not only were we out late at night by permission, we were playing a game against our camp guides that we had a decent chance of winning. The goal was to reach the safe house with your flag belt intact. If enough kids reached it to equal or better the number of camp guides, we would win.

My team was the scouting party. Behind us were another thirty kids spread out in groups of three or four, set to scatter if we gave the call. We couldn't see anything across the bridge at all. Beyond it on the other side, in plain view of lantern lights, was the safe house. So far, we had eluded the adults! One of our scouting party wheezed a bit from the dash to the bush. He was scrawny and even more of a typical nerd than I was, but we had learned already from late night fooling around the camp that he had superior night vision.

“I don't like this,” he said.

We argued briefly that it was possible that the adults had gone to the other side from the figure-eight pattern that the play field represented. Therefore, a mad dash was our only chance. After brief consultation, we gave the go-ahead signal for the first few groups to come up. Carefully, they crossed the bridge and then waited. Nothing.

Perfect! The adults had obviously come around the opposite side from where we had just left. Our scout party gave the all clear.

When about half of us were across the bridge, an enormous roar arose from the dried creek bed below us. On both banks, camp guides poured out from below the bridge, screaming loudly and yanking belts off startled kids as fast as they could. Terrified and exhilarated and chagrined at the same time, my scout party bolted into the woods with the intent to circle around to the safe house in the confusion. Upon reaching the trees, I was grabbed roughly by the waist by a guide hiding behind the tree, and my flag belt was stripped off. I lay there for a moment, dazed and only slightly disappointed. When I looked up, I could see the main group had decided to hold together and more than half of them made it in force to the safe house. All of our planning had been to scatter, but they knew by staying in a herd that close to the safe house, the adults could only pick off the outsiders.

That was one of the most thrilling fifteen minutes of my childhood.

***

My PAX East panel is beginning. It's the moment I traveled here for. The theater I am delivering the talk in is full, and I note with some amusement the enormous seventy-five-foot arched ceiling of the room. It's fitting for my plan to open my talk with a pseudo-religious reading from the Xbox LIVE Book of Enforcement.

I take a deep breath and say:

Ladies and gentlemen, welcome to the Cathedral of Enforcement!

The following presentation is rated T for Teen. It is presented under a Creative Commons non-commercial non-derivative attribution license.

A note here: I have been made aware there are some users of Foursquare in the audience. Is that correct? [applause] I have been instructed to tell you to cut that crap out. There's only one mayor in this room, and it's me. And let me be clear: I'm not getting ousted by no one, no how.

Another public service announcement: I have been made aware that there are a lot of geeks out there taking some doses of Airborne to avoid conSARS. Apparently there is some bad Airborne being passed around. I want to urge you all to avoid the brown Airborne. Hey, man, it's your trip. Do what you want to, but be careful with the brown Airborne.

That's right, I just made a Woodstock joke at PAX.

All right, now that the announcements are out of the way, ladies and gentlemen, my name is Stephen Toulouse and I am the director of policy and enforcement for Microsoft's Xbox LIVE service. I am commonly referred to alternatively as Stepto, after my Gamertag, or That Stupid Bastard, after the effect I tend to have on your online gaming experience if you violate our Terms of Use and draw the ire of the banhammer—which is named Chaucy, by the way.

To my side is Boris “Boom Boom” Erickson. [applause]

To his side is Andreas Holbrook. [applause]

Coincidentally, Andreas is also known as Boom Boom, but he often insists that the Bs in Boom Boom be inverted when spelling it, because that's how he rolls.

I would like to ask, by show of applause, how many of you have heard my speech from PAX Prime? [applause]

I would further like to ask, by show of applause, how many of you, having heard that talk, have come here to witness a new chapter read from the Xbox LIVE Book of Enforcement? [applause]

[I turn to Boris and Andreas]

Wow Boom Boom…and…Boom Boom. I'm disappointed. This crowd doesn't appear to be mustering up the energy for a reading. How many of you are hung over?

[loud applause]

[Andreas]: I think you have to ask for thunderous applause.

Thanks, Boom Boom. Ladies and gentlemen, I was remiss in my query. By show of thunderous applause and also the Arsenio Hall Show crowd noise, how many of you showed up today to hear a new chapter read from the Xbox LIVE Book of Enforcement?

[Thunderous applause and hoots from the crowd. I wait for crowd and then slowly pull out the Book of Enforcement, a large, leather-bound, metal-studded book. I pause for effect.]

And a voice spoke out among the heavens and said, “Let there be a vast void!” And it was so, and it was good.

And a voice spoke out among the heavens and said, “Let there be light!” And there was light. And it was good.

And a voice spoke out again and said, “Let there be an Xbox LIVE vision camera!” And there was an Xbox LIVE vision camera. And it was good!

And the voice spoke out once again and said, “Let there be more light!” And…and…and the camera needed more light, so…

And the voice cried out again, saying, “Seriously bring in some lamps and stuff from the other room and open up the blinds and, hey, I think there are some flood lamp bulbs downstairs,” and finally there was more light!

And it was good.

And a voice cried out, “Let there be games that use the camera to its fullest extent online!” And it was so! And it was…

[I pause.]

Well I mean, it started out as good?

But there was merriment! And people did use the vision camera to wave and say hi to other users in games. And there was a glorious detailing of tells in Texas Hold 'em. And the righteous did use the camera to smirk and gloat on slapping a draw-four on that smart-ass punk who did just proclaim Uno.

[I pause again, take a look at the book, turn it over, etc.]

Ladies and gentlemen, I apologize. Whichever apostle who wrote this gospel was clearly really into Uno.

But yea, verily! There was a dark shadow on the heart of the Xbox LIVE service. That shadow did take the form of males aged thirty-five to fifty-five who allowed the camera to broadcast their iniquity to their fellow players. Their behavior defied the rules and the very foundation of decency. Players were exposed to such atrocities as “the flaccid All In,” the “my girlfriend will [****] for Microsoft points,” and on at least one occasion, the dreaded, the feared “Helicopter.”

Ladies and gentlemen, I must pause to let my team recover from the very mention of the Helicopter.

[Boris and Dre put their heads in their hands.]

You guys okay?

[Boris and Dre nod.]

I mean surely that guy had to hurt himself even doing it, right?

Let me proceed.

And a great cry came up from the users, saying, “Why! Why would anyone do this? Why is there something even called the Helicopter?”

But the service was designed to be vigilant. And, my children, the service heard the cries and swept into action. There was a righteous punishment that came down from the heavens. It blocked the offending accounts and banned consoles and was heard all the way to the very halls of the [Hans Gruber voice] F. B. … I.

And there was a wailing and gnashing of teeth! And the service did smite them directly upon their camera-exposed bits and parts and … stuff and things. And they were filled with punishment.

And the service looked upon the fires of the work they had done, and it was good.

Can I get an amen?

I get an amen from the crowd. I've shaken the nervousness and humbleness out doing this, actually getting paid to present to gamers at PAX. I talk for a bit about the nature of my job and my team's role at Microsoft, dry but necessary information that describes the day-in and day-out of working on Xbox LIVE. But soon that part is over, and I'm reaching the heart of my speech, the part I care most about delivering:

But more important, I think, is why we do what we do. And I think there are two levels to that. The first is a personal investment and the second is the investment we as a company bring to the service.

I grew up in the world of playing in arcades and in the local park by my house. For those of us who were children in the seventies, computers and games weren't quite as ubiquitous and pervasive as they are today, mainly because of cost. And of course the number of people using the Internet back then was heavily outnumbered by HAM radio operators. So I learned my concepts of gaming and sportsmanship in the physical world. If you cheated, there were repercussions. If you were a jerk, there was a reaction to that, and it was immediate, and sometimes tactile. I admit it, there were times when I violated Wheaton's Law. And either through correction by my parents or correction by a swift punch to the throat, I learned the boundaries of behavior.

Now, there is a subset of all humanity known as jerks. And the Internet has connected all of humanity. The ability for all of us to interact wherever we are in the world in real time and in a variety of ways is almost…almost making up for not having our damn flying cars that our childhood said we would have by now. But somewhere between the arrival of 500 million America Online CDs and now, something happened to some of the basic ideas of sportsmanship. Not just trash talk, but also the fundamental underpinnings of fair play and accomplishment. Yes, there were always jerks on earth before, but now they have a conduit. And of course Xbox LIVE is simply a subset of the Internet, so we have jerks, too.

There are times when I hear someone saying something online and I think, Really? When did it enter their heads that that was okay? I'm not talking about a random off-color joke or funny exclamation here. I'm talking violent speech. Hate speech. Sexist speech. Homophobic speech. Racist speech. It being over the Internet doesn't make it okay. In fact, nothing makes it okay.

A second thing I've noticed a bit more of lately is that with the application of anonymity came not just the idea you could be a jerk and get away with it, but also the idea that people have a right to something they have not earned. Not just because they want something they didn't earn, but because they feel entitled to it.

When I was a child, the most competitive thing I ever did was participating in swim meets. I'll pause for a moment so you can mentally make your orca jokes, trying to imagine me swimming.

I only did it for a couple of years and I wasn't very good. My number of green participant ribbons severely outnumbered any other ribbons I had on my achievements board. But one meet I really trained, and I really practiced, and through that hard work I ended up taking home a red second place ribbon. That ribbon meant more to me than just about anything in my childhood at that time, even my most treasured possession, a large-size Optimus Prime that had Roller in the truck trailer and had an actual plastic chrome truck grill instead of a sticker. For a long while, that red ribbon made me really happy.

So I learned behavior and I learned accomplishment. And those things became important to me.

I look at those Gamerscore cheaters out there, or those people trying to hack up fake tenth prestige ranks in Modern Warfare and I wonder…why? What world do they live in where that became not just okay but something they demand? Someone asked me once, after I gamer score reset them, why I did it. He actually tried to explain to me that his fiddling with some hex values in a tool on his PC to make everyone think he had played hundreds of games was his right, and we shouldn't do anything about it. He laid claim to an accolade he did not earn and, in a bizarre perversion, was proud of that.

It was as if instead of one bright red ribbon standing out amidst a deep field of green ones, I simply stole the box of ribbons and filled my board with blue first place ones and then asked my mom to be proud of me. I would have gotten a smacking like no other. I'm serious. She would have popped me so hard my head would have left a red shift.

I get that there will always be cheating, and I get that I'm probably not going to be the first person ever to understand all the aspects of it and make it go away. It is actually because of that fact that I am very proud of my company, Microsoft, for not turning our backs on bad behavior and cheating on the online service. We may not be able to get them all, but we will get them eventually. We don't Gamerscore reset people so much to punish them as to show you that we believe in the value of the experience we provide.

I'm so proud of my Little Rocket Man achievement in Half-Life 2: Episode Two. I carried that gnome all the way across Episode Two, even on the car level with the helicopter chasing me. I can't imagine flipping a bit somewhere and granting myself that just to brag that I had it. Or tenth prestige in Modern Warfare 2, which takes many days of continuous play to earn. We want the people on our platform to not just feel a sense of pride in their legitimate accomplishments, but also to know that there are people like my team out there working to help protect that.

I know there's ways that we can improve, and that's why we're here today at PAX to hear from you. I believe strongly in the work that my team does around safety and behavior and fairness. I believe we are the check against the lack of some real world consequences that govern behavior. But more important, Microsoft believes that too. We believe that we need to invest in helping to govern bad behavior on the service.

I'd love to one day put me out of business. (I would still like to get paid, however, for achieving that, but we can negotiate that…) So I have some requests to make of you. Chances are if you're listening to this you're not part of the problem, but we can all be part of the solution.

Because please know this: if there's one last bastion of ignorance out there that still questions the integrity and honor of us as gamers, it's due to the behavior of that small subset of people online who behave like jerks. Not just on Xbox LIVE, but any online gaming service. That's why it's important to have a team like mine, and that's why it's important that people on Xbox LIVE help us as well by filing those complaints and muting players that are bad and letting us know.

If you're a parent, please, please talk to your children about sportsmanship and fair play and online safety. I don't just mean watch them and make sure they don't cheat in a game or game with unsavory people; I mean please talk to them about the importance of those things as concepts. Why they matter. We have an entire website that we have made in partnership with child and parent groups across the world called GetGameSmart.com. There you will find all sorts of educational materials that can help you teach your child not just about safety and good behavior online, but also about how to integrate gaming into a healthy lifestyle. Doing things that, like in my childhood, combines the awesome world of games with play time outside, schoolwork, and family time, too.

Please be involved in your children's gaming even past the age where you feel they must be doing okay, because, hey they're smart kids and surely couldn't be causing any problems. I promise you some of the worst behavior we sometimes see occurs right around that age group when a parent might feel more confident in not being as involved, in the fifteen- to seventeen-year-old range especially. But also please make use of our parental controls as well for younger gamers to help enable and restrict their activities as you see fit. If you've given a console to a child and he set it up, I can promise you he or a friend will occasionally do or say some pretty bad stuff. Some of the hardest discussions I have to have in my role at Xbox start with, “Actually, I'm afraid little Jimmy did indeed threaten to rape one of my employee's grandmothers till she flies across the room.”

And if you're an adolescent or college student or young adult, first off, please obey Wheaton's law and don't be a dick. But more important, it's okay to point out to your friends who are breaking it that that just isn't cool. We need more of you to let that buddy who's screwing up the entire battlefield match by continually taking the only Blackhawk, waiting until it's filled with teammates, and then smashing it into that lighthouse out near the ocean that that type of behavior is Not Approved. I know there are fantastic people all over our service and that the bad guys are a tiny fraction. But I know how youth and anonymity can lead to ….questionable choices. Please be an example to your friends where you can.

My team has a lot of power to take action on the system. But it is nothing compared to the power you guys have as parents and players to affect change. Let us know how we can help you.

Thank you so much for allowing me the opportunity tell you all this today. I hope this, your last day at PAX East, is even more awesome than your first day was.

***

I always felt deeply depressed the last day of camp. Not even the breakfast could cheer me up. People packed bags and generally started half-heartedly making good-byes they realized they didn't want to make.

Some of us continued on as pen pals, and some of us might go on to see each other next year at the same camp if we were lucky. But the sadness was always overcome by the great memories and knowledge that those times were amazing and among the best you could have as a kid.

Then the busses would come and we'd return to tearful moms who'd missed us terribly the whole time we were gone, just as much as we'd missed them the first day. And we realized once we got home to our parents and our toys and our own beds that things in the normal world were pretty good, too.

***

I'm back in 6c. There's turbulence over the Rockies, which is par for the course if the course is a cross-country flight and the metaphor is about golf. I think briefly about whipping out my phone and looking at some of the pictures I took during the event, but I don't. Earlier, in the airport bar enjoying a beer, I did that, and suddenly that same sadness from so long ago came welling up and I realized I didn't want the weekend to end.

So I sit and think instead. I think about how lucky I am to have worked at a place like Microsoft. And there's PAX Prime in Seattle coming up soon, so I don't have to wait a year for that feeling again. And I met some amazing new people and can talk to them and all my old friends, too, over the Internet or LIVE. I think about landing, and that reminds me that I'm coming home to my dogs and my wife, who I wish were with me all the time. I have some great games to play. I'll be back at work at Xbox, starting down the home stretch to help make sure awesome stuff like Project Natal has a great launch later this year, and generally doing what I love.

And I think about how awesome it is to live in the future, and that smile comes back again.

A Career in Infinite Repose

So here we are, near the end of this collection of stories, and now I'm all out of beer having put them all together.

I'm often amused at people's reactions to my working at Microsoft. Over my fifteen years, it's ranged from “Wow that's cool” to “How can you work for the company that kills humanity?” back to “Wow that's cool.” What most people don't think about when they spend any emotional currency on the company as a topic is that Microsoft is made up of people—the vast majority of whom live in a state of constant amazement over the fact people believe them to be evil and power hungry.

Over my career I have been a support engineer, technical writer, computer security expert, public spokesperson, crisis response planner, and policy maker. I've met executives high and low, and served at the bottom all the way up to the soaring heights of the very lower middle. At each level I have worked, I have met good people and bad people—thankfully more good than bad.

That's the thing I hope most to have communicated with this collection of stories. Microsoft is a huge city. Inside that city are lots of organizations, predominantly made up of great people. There are also some bad apples. Sometimes the bad apples win. Most times, the great people win. Then the effect of their win becomes the stuff of completely misunderstood speculation by those who feel it's easier to create a caricature than to have any real understanding.

It's really tough sometimes, watching people throw their hearts into making a great product, based solely off of studying customer needs and feedback, only to see that just because that product has the Microsoft name, some computer beat columnist writes an entire story about how it's a secret move to destroy everything geeks hold dear. Then that gets picked up by your favorite geek websites and news outlets as truth, often accruing many hundreds of comments asking for the Microsoft developer's head on a pike. This is why I had to stop reading Slashdot.org. It became far less about geek interest stories than about reporting about how terrible Microsoft was and what small German municipality recently switched to Linux.

I don't mean to suggest in this collection that Microsoft hasn't made mistakes. I'm saying the lens became binary somewhere. Either we were okay or we were entirely evil. That's just silly. And I get to say that as an authoritative source.

I look back on my time at Microsoft with affectionate bemusement. I remember when Microsoft Bob launched. I remember the Stac lawsuit that resulted in MSDOS 6.2, 6.21, and 6.22 and forced me to memorize the file names for dblspace.sys and drvspace.sys. I remember when the Microsoft Network being bundled with Windows 95 was going to result in the complete monopolization of all online service access worldwide by Microsoft. When people feared that Microsoft Money pre-installs on new computers were going to crush Intuit's Quicken and drive Intuit into bankruptcy. I remember how Freelancer was going to be the best game EVAR. Why did you have to suck so bad, Freelancer?

I remember finding out inadvertently from a head marketing guy over dinner at a Windows 95 beta customer visit just how much we paid for the rights to the Stones' “Start Me Up” for the Windows 95 launch campaign.* I also remember that being our last decent ad campaign. (Trust me, a lot of us long-timers are still trying to get over the dinosaur office ads and “the Wow starts now!” The herbs, they are bitter. I still wonder when will we have our sweet treat to cleanse us?)

I remember a lot of shipping parties and a lot of great, good, and not so great products and technologies. But mostly I remember when our team hacked a Microsoft Arthur Actimate doll to interact with The Life of Brian VHS tape instead of the one it came with. That was awesome.

___________________

* Nope, not going to tell you.

So I hope you get from all this that working at Microsoft over such a long time is both more simple and more complex than a lot of people think. I don't have the easy analysis that's going to make you love or hate the company more or less than you already do. That's not my job. For my part, I love it, despite its mistakes and flaws. If you already hate Microsoft, perhaps you will read this and hate it about the same, or maybe less. If you already like the company, then perhaps you will like it more, or the same.

For me personally, it's been an amazing fifteen years. When I put all of this together, I noted these stories don't lend themselves to a clean narrative. Just like my life, it meanders from lore to observation, humor to seriousness. So I decided at the end to call it A Microsoft Life.

I hope that you have enjoyed it. Thank you so much for taking the time.

Outtro

There's been an invisible presence and observer to every single one of these stories in this book. That presence is my wife, Rochelle.

Rochelle loves to complain, and rightfully so, that I rarely mention her on my blog. She's not wrong to point this out. I often write my blog as if I am talking to myself. And in fact, one of my chief faults in our marriage is that many times—okay most times—I am very closed off about bringing her into my public/private mental monologue. A lot of people would read this and think perhaps that she had pointed it out or thrown a fit about it and this is my way of making an apology. But as I write this, she has not read the book. She's aware of it, the fact that I am writing it, and didn't even ask if she was in it.

As I write this, Rochelle is finishing her master's degree in Psychology. Where I never got one degree, she will soon have two and will decide whether to seek a doctorate. Where I work in the world of entertainment and video games, she will soon be helping people with real problems in their lives and will make a difference.

Even when my work had a larger impact, for instance my work in computer security helping to protect millions of people from attack, she was there also working a job, and making sure our house was taken care of, the dogs were fed and loved, and that I had a clean shirt to wear to work.

I'm writing this not even sure she will read it before it's finalized and sent to print. Her life now is busy with the concerns of others. I couldn't be more proud, and I couldn't be more thankful. This book, my career, and my life would probably not exist without her help, especially when we both wanted to wring each other's necks over some silly fight or another.

This book is dedicated in the first page to my mother. But I don't think intro dedications are the sole dedications. So please know this: this book is also dedicated with all my heart to my wife, Rochelle.

If you enjoyed all this, don't thank me. Thank her. Without her, I would not have had the Microsoft life documented here.

So let me be the first. Thank you, Rochelle Conway. Thank you for marrying me, for reading this book, and for all the time in between.

Stephen Toulouse

Duvall, Washington

May 30, 2010 (the year we make contact)