Q: You work for Microsoft, so why should we believe anything you say?
The other variation on this is “would you have still published if the results for bad for Microsoft?”
People may be surprised to learn that I always like it when I get this question. The real answer is that I was not really worried about getting bad results. A better question might be why I was confident enough in the results to initiate the project.
Think about it – Microsoft has been investing heavily in security improvements for products for about 6 years now. The commitment to security is real – I made myself as sure of that as I could before I joined the company. Others may believe that or not, but I’ve been here for five years and observed the executive commitment and hard work first hand. I’ve had the pleasure of working with some great security people like Mike Howard and David Cross. I was here as the team grew and we attracted great industry experts like James Whittaker and more recently, Vinny Gullotto.
Because of that, I can say what I always so. Be skeptical! Assume I’m “spinning” things if you wish and try to go find out for yourself. That is ultimately my goal – to get people to actively question and dig into why the results turn out the way they do. All of my sources are identified in Appendix B: Sources and Methodology, so anyone can work to duplicate the analysis in this report. I am happy to discuss findings with them.