Slashdot Mirror

Saint Aardvark writes "The Register is reporting that Microsoft forgot to renew their hotmail.co.uk domain. A Good Samaritan renewed it for them, but was unable to get a response from anyone at Microsoft. Those who forget history are doomed to repeat it."

Remember Michael Chaney? He's the Nashville-based Linux consultant who saved Microsoft's Hotmail service from a Christmas 1999 outage by kindly paying a $35 NSI registration fee for them. Michael has always humbly maintained that this little act of bacon-saving was more of a Slashdot thing than a personal act on his part. Now, in the same spirit of generosity, Michael has some suggestions for the World's Largest Software Company about how to back gracefully away from its most recent attempt to keep its proprietary Kerberos Protocol extensions secret while still appearing to "publish" them.

On Microsoft, Kerberos, Slashdot, and Trade Secrets

A few months ago at an NLUG meeting, I jokingly asked a presenter to reveal his root password to the assemblage, adding "it's just us, we won't tell anybody." The "us" in this case referred to the 50 or so people in the room, and we had a chuckle while the presenter wisely decided against giving us his password.

The point of this story is something that we all know to be obvious: the level of secrecy afforded a piece of information by a recipient of that information is directly related to the way in which the secret piece of information is passed along. A password freely given to all in a user group meeting wouldn't be held in much confidence by the people present; they wouldn't really consider it a secret.

Likewise, it's difficult for anyone to consider a document to be a trade secret if it's posted on a website for anybody to freely download. Yet this is precisely the manner in which Microsoft is distributing their "Microsoft Authorization Data Specification v. 1.0 for Microsoft Windows 2000 Operating Systems," which we know is nothing more than a slightly modified version of Kerberos.

In a click-through (aka "ignorable") license, Microsoft states that their specification is "confidential information and a trade secret," and that "you must take reasonable security precautions... to keep the Specification confidential." Who, exactly, must I keep from knowing this "secret" information? Presumably someone without internet access.

Contrary to [what seems to be] popular opinion within Microsoft, they have nothing to lose from making their products compatible with existing standards. As a matter of fact, strict compatibility actually raises the value of all products, including those from Microsoft. Given that fact, it makes no sense for Microsoft to create an incompatible version of Kerberos. And if they do make an incompatible version of Kerberos, it makes even less sense to restrict access to documentation concerning your "extensions." (I can imagine a Microsoft internal memo: "Embracement achieved, on to step two.")

So the situation as it stands is that Microsoft has released a document that they're claiming is a trade secret and copyrighted, parts of it have been posted to Slashdot, and Microsoft is pulling out the DMCA to get those posts removed. Given that Microsoft has made the information freely available, I can't imagine what this can gain for them.

But I really take offense to the fact that they go a step farther and request that a link be removed, and that instructions on bypassing their goofy EULA be removed. First, we've had plenty of discussions on here about the dangers of sites being forced to remove links; specifically at what level do we decide that a chain of links is no longer offensive. If I link to the Slashdot article that links to an "Unauthorized Copy of the Specification," is that a "crime?" How about a link to a link to a link? At some level, I'm sure I could find a chain that I could follow from Microsoft's own website to the offending Slashdot post (for those of you who wish to try, search for "samba" on Microsoft's site, it'll link to www.samba.org, try to find Slashdot from there).

As for posts "Containing Instructions on How to Bypass the End User License Agreement and Extract the Specification," I'd like to see someone from Microsoft explain how that constitutes a copyright violation, as J.K. Weston has stated (under penalty of perjury, no less). Self-extracting zip files are nothing new, J.K. Weston, nor is the concept of using WinZip to extract their contents.

The most offensive part of this whole ordeal, though, is that it's just been five months since Slashdot bailed Microsoft out when Network Solutions mistakenly shut off the passport.com domain on Christmas Eve. How soon Microsoft forgets! If it wasn't for Slashdot, it's likely that Hotmail would have been down for another day or more after Christmas, and that surely would have been a bigger blow, in terms of PR, than a bunch of Linux advocates solving their problems for them.

It's my not so humble opinion that Microsoft is in the process of making yet another major PR blunder. The company is famous for them, and it couldn't come at a worse time than as the Justice Department is trying to get them split up for doing exactly what they're doing right now: changing the specifications of an open protocol to reduce interoperability with other products.

Here's my advice to Microsoft: drop the silly EULA and make your Specification freely available under the terms of the new GNU Free Documentation License, or something like it. You'll gain some PR points, which you desperately need. This provides you with a way out that allows you to save face.

And my advice to anyone who talks to the press regarding this issue: remind them that it was Slashdot that saved Hotmail over Christmas.

- Michael Chaney

Oryx Gazella writes "Unable to access Hotmail this Christmas morning? This would be why! You may have received an error like "unable to locate host", or "no such domain" after your browser was directed from www.hotmail.com to lc2.law5.hotmail.passport.com. There are no NS records for the domain passport.com in any of the root name servers. Hotmail (www.hotmail.com) uses the Passport Service (www.passport.com) which allows users of the Microsoft Messenger Service to login using their "Passport" and to add other Passport members to their contact list. The new MSN Messenger Service 2.0 is integrated with MSN Hotmail and Microsoft Outlook Express for real-time email notification, and retrieval. " Not being a Hotmail or regular Windows user for that matter, I cannot verify this - but I've gotten several e-mails from people this morning wondering about it.Update: 12/26 01:39 by H :Click below to read the quite humourous conclusion to this story.

Effugas writes "Oh, this is just beautiful. Linux user Michael D. Chaney of Doublewide.Net, upon reading of Microsoft's Christmas loss of the passport.com domain, took it upon himself to donate $35.00 for the world's largest software company to restore service for its customers. I've heard about Linux empowering its users to truly prevent downtime, but this is ridiculous ;-) I'm still laughing--Merry Christmas, Microsoft, from the Linux community to you! "