Palo Alto Networks threatens to sue security startup for comparison review, says it breaks software EULA

Palo Alto Networks has threatened a startup with legal action after the smaller biz published a comparison review of one of its products. Israel-based Orca Security received a cease-and-desist letter from a lawyer representing Palo Alto after Orca uploaded a series of online videos reviewing of one of Palo Alto's products and …

[DryBones]

California? This should be good, they have anti-slapp laws...

[Anonymous Coward]

PAN = CRAP

Corporate IT uses PAN at my place of work. It causes all sorts of issues with the actual useful software our business relies on to make products like Solidworks. (Which has its own issues...)

[Ian Mason]

Is there anybody from Palo Alto listening?

If there is, please note that this one action by you has persuaded me that your products can't be any good because they clearly can't stand on their own feet without the support of some threatening letters from lawyers. I mean they must be soooo bad if you feel you have to prevent review of them by any means you think you can get your hands on.

If it persuaded me, I wonder how many more people there are who have been similarly persuaded by your antics, who haven't spoken out?

Well done, your competitors have probably just cracked open a few crates of champagne.

[avi_shua]

Re: Is there anybody from Palo Alto listening?

re:

If it persuaded me, I wonder how many more people there are who have been similarly persuaded by your antics, who haven't spoken out?

See some links that might be related -

https://www.linkedin.com/pulse/what-palo-alto-networks-still-afraid-dameon-welch-abernathy/

https://www.nsslabs.com/blog/2014/10/1/seriously/

https://www.linkedin.com/feed/update/urn:li:activity:6724335188131872768?commentUrn=urn%3Ali%3Acomment%3A%28activity%3A6724335188131872768%2C6724346763479789570%29&replyUrn=urn%3Ali%3Acomment%3A%28activity%3A6724335188131872768%2C6724348359022297088%29

[Anonymous Coward]

Re: just cracked open a few crates of champagne

and they're going to milk this David v. Goliath outrage for as long as possible, clearly. The best way to solve this would be to withdraw the claim, issue a non-apology apology on twitter, somewhere at the bottom (if there is such a thing as twitter bottom), and kick a few asses in their legal department for being too eager to please their masters. Alternative: embark on expensive court case which the other party will happily broadcast to the whole world for years to come. So, what is it gonna be, business or ego?

yes, big boys' privilege is to be a bully, and the privilege of an underdog is to whimper for the whole world to take their side.

[Anonymous Coward]

Re: Is there anybody from Palo Alto listening?

I came here to post the same thing...

"non-review clauses in the End-User License Agreement (EULA) of PAN's product."

Is that even enforceable?

Still, now I'll know to look out for such a clause in any future EULA, and if I find one, file the product

(along with all PAN products from here on in) in the trash.

[Marty McFly]

Losing

Classic tactic when losing a debate. When the facts don't support the position, then attack the opponent instead.

So if Palo attacks the competition legally, what does that tell us about the underlying facts?

[veti]

Re: Losing

"When the facts are against you, argue the law. When the law is against you, argue the facts. When both the facts and the law are against you, pound the table and shout."

Sounds like PAN is at option three of that classic formulation.

[eldakka]

Re: Losing

"When the facts are against you, argue the law. When the law is against you, argue the facts. When both the facts and the law are against you, pound the table and shout."

To make that saying flow better, you need to repeatedly use "pound" as in this 1956 version attributed to noted jurist Oliver Wendell Holmes:

“If you’re weak on the facts and strong on the law, pound the law. If you’re weak on the law and strong on the facts, pound the facts. If you’re weak on both, pound the table.”

Earlier versions of the saying used "hammer" instead of pound - "hammer the law, hammer the facts, hammer the table" or sometimes it's not 'table' it's "hammer the opposing counsel".

[RM Myers]

Is that Barbara Streisand I hear in the background?

Well done Palo Alto! Another company takes a minor issue, a review by a competitor, and makes it into a major tech story. Yes, I believe the orchestra may be ready, and Barbara has made her appearance. Shall we start with a rousing "Send in the Clowns" to honor Palo Alto and their attorneys?

[Michael Wojcik]

Re: Is that Barbara Streisand I hear in the background?

Perhaps it will distract people from their awesome parade of vulnerabilities.

[Unoriginal Handle]

Re: Is that Barbara Streisand I hear in the background?

Actually that search only lists 137 vulns. The full list is at https://security.paloaltonetworks.com

[Eclectic Man]

Fair comment?

I though that in the USA they had something about freedom of speech in an amendment to the constitution, plus there is almost always the defence of 'fair comment' on anything in the public domain.

[A Nother Handle]

Re: Fair comment?

The constitution only applies to government. In my opinion the authors had too narrow a view of tyranny.

[Claptrap314]

Re: Fair comment?

The object of the US constitution is its government. Therefore, it addresses the government.

[eldakka]

Re: Fair comment?

I though that in the USA they had something about freedom of speech in an amendment to the constitution,

That only applies to the government. A private entity is free to suppress your free speech as long as they don't do it by breaking another law like assault, blackmail, etc. to keep you quiet.

Private platforms like Facebook, Twitter, the local YMCA pin-up bulletin board, etc. are free to deny you any speech at all on their platforms.

This is why specific alternative laws need to be - and have been in some cases - enacted to prevent private entities from restricting your speech. Such as mentioned in the article, where California have a law that prevent entities operating in California from having non-disparagement-type caluses in their contracts and making them invalid even if they do appear.

[Ian Mason]

Re: Fair comment?

The constitution kicks in as soon as they threaten to suppress your freedom of speech by action in court, which is part of the government. So the threat of legal action takes it into the realm of the constitution. The company has no power of itself to suppress your speech in media not owned and controlled by that company, only the courts do, and the courts have to follow the constitution.

[Claptrap314]

Re: Fair comment?

You you believe that a court which enforces an NDA is violating the constitution?

Uh ... no.

[eldakka]

Re: Fair comment?

The result of such an action is not the supression of the speech, the court will not order the removal of the speech. What the courts may do is enforce the penalty clauses in such an EULA/contract, e.g. possible monetary damages.

[K]

Boot was on the other foot not long ago..

When Juniper were threatening PA... Shows how short term memory they have!

[Old Used Programmer]

Re: Boot was on the other foot not long ago..

That may be where they got the idea.

[Someone Else]

Re: Boot was on the other foot not long ago..

"Corporate memory" (assuming that is not an oxymoron) Is purely transactional -- much like our current President's memory is.

[Anonymous Coward]

Bad marketing, Palo Alto Networks!!

By hiding behind language in your EULA to prevent that age-old tech promotional standby, the comparison review, you make yourselves look like you have something to hide and that PAN's products can't deal with competition in the marketplace.

[Doctor Syntax]

Re: Bad marketing, Palo Alto Networks!!

It also raises the question of how much stuff hostile to the more typical end user might be hidden in there.

[ChrisElvidge]

EULA

Perhaps the EULA terms should be contested - it might help to make EULAs unenforceable (hopes). Then NDAs could/should be on the block, too.

[IGotOut]

Re: EULA

They are none enforceable in the EU.

[Old Used Programmer]

Re: EULA

I don't have a problem with NDAs, per se. I just think they should (legally) be required to have a fixed end date (with the term limited by law to something reasonable) and other end conditions. Beyond the fixed term or when reasonable termination limits are reached, the NDA becomes unenforceable no matter what it says.

[TimMaher]

Perhaps an independent expert?

Maybe a well regarded, independent, technical expert could review both PAN and Orca solutions and come up with a review.

It could be published in a well respected technical journal <cough>El Reg</cough> for us all to read and judge.

Then PA could sod off.

[Alan Brown]

Re: Perhaps an independent expert?

EULA clauses prohibiting comparisons tend to be drafted to prevent media from doing it rather than competition - and a lot of the weaponisation of this kind of thing had to do with lousy reviews

[adam payne]

Melinda Thompson described in her missive as “a clear breach” of terms “prohibiting an end user from disclosing, publishing or otherwise making publicly available any benchmark, performance or comparison tests… run on Palo Alto Networks products, in whole or in part.”

How can anyone make a fully informed decision about a product if you try to restrict the information publicly available? Oh wait..........

[CrackedNoggin]

Orca are remarkably honest. The usual tactic would be to pay an "independent" reviewer to put out the same report.

[Anonymous Coward]

Huh?

I don't understand. Everyone knows these benchmarking clauses exist in standard licencing agreements. That's why you would refer to something like "Leading industry product P" and not the specific product/company.

[Anonymous Coward]

Re: Huh?

It wouldn't have become a major news story though

[Jonathan Richards 1]

Re: Huh?

> Everyone knows these benchmarking clauses exist in standard licencing agreements.

Huh? right back at you!

I can understand (some) reverse-engineering clauses (though I think that often they're anti-competitive, too) but why should licensed software be exempt from benchmarking and review, provided that it's fairly conducted? Imagine if, say, Canon sold its cameras with a clause saying you couldn't compare them with Nikon's offerings?

You may say that PAN's customers haven't bought the software, they just have a license to *run* it. I would counter that any performance review is just examining the state of my finite-state machine hardware, which (almost certainly) doesn't belong to PAN.

Ineffective licensing clause is ineffective. Worse, counter-productive in a marketing sense, as pointed out by others, above.

[IGotOut]

Go the whole hog.

just say PAN stuff is shit. However, they can't prove us wrong as we have now added a EULA forbidding them from testing it. Oh also added a clause stating we are allowed to murder their first born.

[TaabuTheCat]

Off to look at Orca

and see what all the fuss is about - a company I had never heard of until now. Well played PA, well played.

[Mahhn]

Re: Off to look at Orca

I'm thinking well played by Orca. Poke the giant to get in the news to get all the minions to look your way and grab some of that market. I doubt Orca will end up paying any fine, but even if they do, it was worth the expense- it was a great marketing play, because until now I had never heard of them. Good job.

[Claptrap314]

Re: Off to look at Orca

Whoosh!

[EnviableOne]

Hang on a minute

PAN are just doing what they accused CISCO and Juniper of doing when they came on the scene

Unless the Claims Orca make are false, i dont see they have a leg to stand on