Windows 2000 & Windows NT 4 Source Code Leaks

PeterHammer writes "Neowin.net is reporting that Windows 2000 and Windows NT source code has been leaked to the internet. More on this as we hear it."

Comments

it's true

[sperling]

A quick peek around indeed shows something named Windows.Source.Code.w2k.nt4.wxp.tar circulating, but this had to happen sooner or later, considering the number of institutions with access to the source. Wonder how long it'll take before a torrent of new worms using newly discovered security holes tear up the net.

I for one would love to peek around in this, more out of curiosity than any desire to actually do something useful with it.

Re:it's true

[Anonymous Coward]

I wonder how long till hackers go in and fix some of the bugs. That's the real danger to microsoft, if the bugs were fixed people wouldn't have to upgrade.

Re:it's true

[Anonymous Coward]

Mirror here

Re:it's true

[Strudelkugel]

Seems a bit of a stretch to thing 'soft would have given all of these organizations the complete source tree. If they did, then I am far more amazed the source wasn't leaked a long time ago. It's a bit hard to believe 'soft licensed the entire build tree to anyone.

Makes a pretty good headline, though.

Re:it's true

[MenTaLguY]

I for one would love to peek around in this, more out of curiosity than any desire to actually do something useful with it.

I hope you weren't planning on ever contributing to any Open Source projects after doing that. If it's later demonstrated that you had access to the W2K source and contributed vaguely similar code (even by accident) to a project, it could have severe repercussions for that project.

I doubt Microsoft would leak it deliberately, but this does open the door to a whole SCO-esque can of worms from now on.

Re:it's true

[Marillion]

Sure the source code will make it easier to find exploits, but I've believed for a few years that "institutional hackers" those who have long ago reversed compiled Windows into something suitable for writting worms. How else does the Code Red author decide, "Hey! I found this buffer overflow routine in the unicode support for URLs in the IIS Indexing Server"?

There are probably paranoid governments who have teams who do this just this kind of work just to make sure those fabled NSA back doors in either are or aren't windows.

Re:it's true

[uradu]

> I for one would love to peek around in this, more out of curiosity

Morbid curiosity perhaps. Considering the amount of backward compatibility in there, and the generations of tools and code frameworks used over the past decade and longer, I would expect the Windows code to be a BLOODY MESS. In fact it would probably be amusing to just grep for comments--"what does the next line do?!" or "what the h3ll were we thinking?!"

Re:it's true

[JPriest]

Has anyone verified that this is the actual source code yet? So far neowin is the only source.

Re:it's true

[sperling]

And that's exactly why I won't even consider downloading this. I make a living as a programmer, and if I have access to this source Microsoft, with the resources they posess, could make the rest of my professional life a nightmare.
As much as I'd love to peek around in this, I won't risk it.

Re:it's true

[Zork the Almighty]

I'm a little curious as to why you seem so uncomfortable saying "Micro". Actually, scratch that. I don't want to know.

Re:it's true

[pegr]

"Wonder how long it'll take before a torrent of new worms using newly discovered security holes tear up the net."

Speaking of torrents, anybody got one?

Re:it's true

[RancidBeef]

At least this blows a hole in the security-through-obscurity theory Microsoft has been claiming. One leak and "poof!" all your "security" is gone. Open source code is there for the world to see. One would think all the easy exploits get fixed quickly in open source.

Re:it's true

[El]

So, if any Micro$oft employees have ever looked at Linux kernel source, they are no longer allowed to work on Windows 'cause now they are tainted? Either the sword cuts both ways, or not at all.

Re:it's true

[Geertn]

http://leak.windowsbeta.net/ posted a link to a presumably file in the source code: http://www.geocities.com/paalstok/main.ccp.htm

Re:it's true

[boelthorn]

Come on! Give it sufficient time and copies of Windows source code will fly around everywhere. Even if Microsoft tried, they could not persue one percent of the people... No one cared if you had MS-DOS 6.22 source code either.

Re:it's true

[Anonymous Coward]

grep the Linux source code for "microsoft.com".

Re:it's true

[weileong]

Either the sword cuts both ways

You're assuming the law will be applied fairly and evenly.

Re:it's true

[rjamestaylor]

Someone may have already brought this up (I'm lazy to look) but there was a high-profile break in revealed in the year 2000 in which someone ostensibly based in Russia was able to get Windows code directly from Microsoft.

That it would now be circulating is probably a sign that whoever wanted it is done looking and wants to ShareSource.

Don't be smug. Linux vendors better be careful -- they could be next!

Re:it's true

[nikkipolya]

Not to worry. You haven't signed any NDA's. So its fine I guess.

Re:it's true

[LinuxGeek]

So, if any Micro$oft employees have ever looked at Linux kernel source, they are no longer allowed to work on Windows 'cause now they are tainted? Either the sword cuts both ways, or not at all.

In Microsoft's closed source world it would have been tough to know if someone had included code that was similar to something they had seen in the Linux ( or any other opensource) codetree. It will be interesting, if this windows code release (escape?) proves true, if any suspicious code is found.

Re:it's true

[Anonymous Coward]

And that, more than anything else, is why this code leak helps the black hats far more than the white hats.

Re:it's true

[TioHoltzman]

Why is everyone running around like the sky is falling in? Has this thing even been proven? Are there any facts to back this up? What's to say this isn't just a big publicity stunt? Christ, people are acting like there's a Martian invasion in progress. Please, just a little perspective!!!

Re:it's true

[bangular]

I remember a high ranking Microsoft offical once stated that if the windows source code ever got out, it is so bug filled it would be devastating. The part I find funny about this is no one even questions that holes will be found and worms will be written. It's just a question of how many.

Re:it's true

[Bendebecker]

If this is real, I doubt MS could us all.

Re:it's true

[Anonymous Coward]

It was a quiet nice evening couple years ago. Someone pointed me on IRC to 2 links on some unnamed (I won't tell) microsoft.com server. 2 huge .tar.gzs, totalling couple gigabytes. The Windows XP source code.

The links circulated very fast and the servers started slowing and slowing down and then they died. The first ones did manage to get all the stuff. I envied them because I managed to get only couple megabytes. :-(

It seemed real. Very real. Someone had broken into their development servers, stuffed the stuff to the web servers and escaped with it all.

There was some small mention about it on the Slashdot too but I couldn't find it right now. It seems the Microsoft was able to really sweep that one under the carpet. I wonder how.

There are people around with self compiled Windows XP copies, trust me. I envy them. I would gladly remove some features and tweak couple edges I am not now allowed to. Even though it would be a HUGE task.

So the now leaked source codes to NT/2k are mostly just boring and obsolete.

Re:it's true

[alienw]

And how, pray tell, will they ever "demonstrate" that you read and/or copied the code? Just don't go bragging about it on public mailing lists or forums and you will be fine.

Re:it's true

[caluml]

fw calum $ grep -ir " shit " /usr/src/linux/* | wc -l
15
fw calum $ grep -ir " fuck" /usr/src/linux/* | wc -l
40
fw calum $ grep -ir " crap" /usr/src/linux/* | wc -l
98

Should I have been doing this on the company firewall? Probably not.

Re:it's true

[Zork the Almighty]

What the hell, it's just one big .vbs file!

Re:it's true

[danila]

If it could have had severe repercussions for the project, MS would have done it eons ago. But this is bullshit, although pretty well-spread around here.

1) Everyone, feel free to download this from your favourite P2P network, Usenet newsgroup or IRC channel. Nobody will be able to prove you did it.
2) Feel free to look at it. If you don't copy the code, there is no harm in just looking. Just don't tell MS you did it.
3) Unless you steal really huge amounts of code, nobody will notice, so feel free to learn from what good examples MS has.
4) Feel free to modify/fix the code. Making binary patches to go around copyright restrictions is a bit bothersome (different builds + dll hell), but certainly doable. The world can surely use a better Windows OS.

And don't listen to scaremongers around here.

Re:it's true

[microbox]

I for one would love to peek around in this, more out of curiosity than any desire to actually do something useful with it

I'd love to peek around in it to see if there's any GPL'ed or BSD code in there. Maybe there could be a few licences missing from a few files.

Re:it's true

[starm_]

but what if theres kinux code in it??? woukd you pass on that opportunity?

Re:it's true

[Erwos]

I was told by a Microsoft recruiter that they didn't want you looking at GPL code _while you worked there_. That seems fair. They made no clauses on what you do before.

-Erwos

Re:it's true

[cb8100]

I'd like to look at it to make myself feel better about my own code.

Re:it's true

[grumpygrodyguy]

This is one of the coolest things I've ever read on Slashdot. I would love to see a revamped NT4, frankly it would be a great beginning point for the next best open-source operating system.

Linux has lots of useability issues, and still doesn't have any object-model framework...let's all drop the Linux stuff and start building anew!

Re:it's true

[kerrbear]

If it's later demonstrated that you had access to the W2K source and contributed vaguely similar code (even by accident) to a project, it could have severe repercussions for that project.

I seriously doubt that having looked at that crappy code, anyone would want to duplicate it in even a vague way. At best it would provide an example of what not to do

Re:it's true

[Cylix]

I don't make a living as a programmer and I still won't touch this. I want to keep my programming options open and I don't want to consider myself even remotely tainted.

However, if someone should glance upon the evil known as win2k source, I hear that are some mystical perl monks who can cleanse your soul.

Re:it's true

[RancidBeef]

That's what I've always found so bone-headed about Darl's arguments that it's hard to keep other's intellectual property out of Open Source. On the contrary, it's there for everyone to see. Only in closed software can someone insert someone else's code and have a reasonable chance of getting away with it.

Re:it's true

[fishbowl]

If we developed techniques for working with object code, we could forget about the whole concept of source code being something distinct from object. It wouldn't matter if people release source code, since the program *is* the code. The only reason source code is an item that one considers worth guarding, is that dealing with object code is difficult, there's the platform-specific thing, plus source code has a documentation aspect that's lost on compiling, you lose symbols, optimizations happen, etc., etc.

But back in the 6502 days, it didn't concern us much that we only had machine code to work with...
Today, it's more a matter of scale than scope...

Re:it's true

[alienw]

Here's my favorite. BY FAR. Who the fuck accepted this into the kernel?

[from drivers/usb/spca50x.c, a usb camera driver]

/*
* Function compares two strings.
* Return offset in pussy where prick ends if "prick" may penetrate
* int "pussy" like prick into pussy, -1 otherwise.
*/
static inline int match(const char* prick, const char* pussy, int len2)
{
int len1 = strlen(prick); //length of male string
int i; //just an index variable
const char* tmp; //temporary pointer for my own pleasure // We skip all spaces and tabs
for (i = 0; i len2)
return -1; //Fuck off, no fucking

if (!strncmp(prick, tmp, len1))
return i + len1;

return -1;
}


To get around stupid slashdot filter:
# mportant Stuff: Please try to keep posts on topic.
# Try to reply to other people's comments instead of starting new threads.
# Read other people's messages before posting your own to avoid simply duplicating what has already been said.
# Use a clear subject that describes what your message is about.
# Offtopic, Inflammatory, Inappropriate, Illegal, or Offensive comments might be moderated. (You can read everything, even moderated posts, by adjusting your threshold on the User Preferences Page)

# mportant Stuff: Please try to keep posts on topic.
# Try to reply to other people's comments instead of starting new threads.
# Read other people's messages before posting your own to avoid simply duplicating what has already been said.
# Use a clear subject that describes what your message is about.
# Offtopic, Inflammatory, Inappropriate, Illegal, or Offensive comments might be moderated. (You can read everything, even moderated posts, by adjusting your threshold on the User Preferences Page)

Re:it's true

[jafac]

/Beavis voice. . .

heh heh. . . he said "torrent". . .

Re:it's true

[Tin Foil Hat]

How else does the Code Red author decide, "Hey! I found this buffer overflow routine in the unicode support for URLs in the IIS Indexing Server"?

Maybe the dude just ran a bunch really long URLs through ISS and studied the ones it barfed on. It really doesn't take that long once you know where the problem is, especially if certain patterns are known to work in other areas.

Re:it's true

[cb8100]

Anybody been able to verify this torrent yet? I can't run bittorrent at work...:(

Re:it's true

[Anonymous Coward]

Try this torrent

Rakshasa

Re:it's true

[Tin Foil Hat]

s/ISS/IIS/

Re:it's true

[yourruinreverse]

O, this is simply a hilarious quote (spot the two great new concepts): "People could use the code to find exploids or figure out how those Operating Systems work".

Re:it's true

[Thng]

Yes, it is true. A friend worked at MS Great Plains, and IIRC he was not allowed to look at any FOSS while he was working there. He didn't specify if he meant look at it while at work, or at all. But yes, the sword (mostly) cuts that way.

Re:it's true

[plj]

I think we should check it out now. I hope the lawyers at FSF et al will get this source and check it for major GPL violations. It would be impossible to check for every possible violation, but it would still be good if someone would try to make sure that MS is not fixing their products - at least not in large scale - at the expense of those OSS programmers publishing under GPL.

Re:it's true

[0WaitState]

Microsoft, with the resources they posess, could make the rest of my professional life a nightmare.

What, they haven't already? Think of all the idiot employers running win[nt|2k|2003] on the server side--places you don't want to work.

Re:it's true

[LO0G]

Actually it was Ballmer explaining why M$ didn't license one of it's protocols - the protocol was so broken that documenting the protocol would immediately open the machine to exploitation.

Re:it's true

[TwistedSpring]

Do you know what NT stands for? Maybe look that one up!

Re:it's true

[H310iSe]

hrm, not so much exploits but there are some pretty damn good root kits out there right now, can you imagine how much better the next batch will be? just replace a couple windows binaries... it could be possible to make a rootkit that literally can not be detected without an uncompromised system to scan.

Now THAT will make for some interesting tricks. Just when i was getting bored of computers, a new fun thing comes up! I might stick around another year just to see how far some clever hacker w/ a political agenda takes this ...

Re:it's true

[HungWeiLo]

A friend of mine who works on the Windows dev team says there's something to the effect of: /*

Do not, under any circumstances, modify this section. There is no documentation available for this section, and the individual who wrote it is no longer working here.

*/

Re:it's true

[tjw]

Looking at the file listing linked to in other slashdot comments, it looks pretty likely that suspicious code exists:

114 07-26-00 02:17 win2k/private/inet/urlmon/compress/gnumakefile
0 11-18-01 14:24 win2k/private/inet/urlmon/compress/gzip/
3627 07-26-00 02:17 win2k/private/inet/urlmon/compress/gzip/api.c
1978 07-26-00 02:17 win2k/private/inet/urlmon/compress/gzip/api_int.h
639 07-26-00 02:17 win2k/private/inet/urlmon/compress/gzip/common.h
1838 07-26-00 02:17 win2k/private/inet/urlmon/compress/gzip/comndata.h
871 07-26-00 02:17 win2k/private/inet/urlmon/compress/gzip/comninit.c
3927 07-26-00 02:17 win2k/private/inet/urlmon/compress/gzip/crc32.h

Last time I checked gzip was licensed under the GPL. Although, it could be a totally re-written version of gzip or something else named gzip I guess.

Re:it's true

[Marillion]

That's funny.

The way I've been misspelling lately, I'd make it:
s/ISS/IIS/g

Re:it's true

[HungWeiLo]

I wonder if the source contains the ENTIRE Windows system, or just the kernel?

It would benefit outfits like Transgaming or Wine if the DirectX source happens to be in the tar file...

Re:it's true

[CrackHappy]

Uh... you might want to fix your keyboard or your fingers as you cannot seem to hit the "l" key correctly.

kots of kuck to you!

Re:it's true

[zapp]

Actually, I'm not sure about your example exactly, but here are a few stories I've been told from a friend that works at MS:

Due to the highly political/legal nature of a lot of their projects, when they have meetings with 3rd parties about standards or whatnot, the engineers are not even allowed in the same room. Engineer1 has to ask the mediator a question, mediator goes and asks Engineer2, and mediator brings answer back.

Come to think of it, that myserable process could explain some of the poor standards compliance microsoft has :p (I know, it's more political than that, but wouldn't it be funny... )

Re:it's true

[Anonymous Coward]

It was a quiet nice evening couple years ago walking around Washington. Someone pointed me to an open door at the white house. 2 telephones sitting side by side. One direct to Moscow, the other direct to central nuclear command.

People were milling about in the room, I finally took the dive and made a couple of prank calls for pizza. Some other guys managed to get the US up to def con 4. I envied them because I managed to get only arrested. :-(

It seemed real. Very real. Someone had broken into the potting shed, stuffed a key to the nuke room under a bush and escaped with it.

There was some small mention about it on the Drudge too but I couldn't find it right now. It seems the government was able to really sweep that one under the carpet. I wonder how.

There are people around with the phone number still, trust me. I envy them. I would gladly make the call to nuke France. Even though it would be a HUGE task.

So the now Brittany Spear's leaked cell number is mostly just boring and obsolete.

Re:it's true

[iminplaya]

And that's exactly why I won't even consider downloading this.

And here lies one of the most basic problems of copyright. Nobody can see the other's code...to build on and possibly improve. Everybody has to learn what is already known by themselves. That slows down the whole developement process to a virtual standstill. I think this whole copyright mess has probably set us back anywhere between 50 and 200 years. This applies to all human work, not just computers.

Re:it's true

[74nova]

its an installer, go ahead and use it

Re:it's true

[Strudelkugel]

Just 'cause

Re:it's true

[alienw]

This is not a troll! Check for yourself with grep or something.

Re:it's true

[Bendebecker]

forgot the 'use'. just another unnamed victim of the backspace button.

Re:it's true

[booch]

They can already easily make your professional life a nightmare. First, they could randomly decide to sue you for some arbitrary reason. With as much money as they have, they could find lawyers who would bog you down in a legal quagmire, taking years and hundreds of thousands of dollars in legals expenses. Second, they could create a collection of APIs called Win32, and require you to use it if you want a programming job. Third, they could create a collection of APIs called .NET Framework, give it the same name as a whole bunch of their other products, deprecate their previous Win32 APIs, and charge you a bunch of money for the luxury. Fourth, they could ceritify you as an MCSE and make you work on Windows servers all day.

Re:it's true

[Saint Stephen]

When I worked at Microsoft I had read-only access to the NT tree. The full, current "main" branch was about 20 GB, you needed about 80 GB to compile it, but *much* of that was binary versions of things like DAO checked in to support all the Internationalization. So I'd be shocked if you all were passing around the whole thing.

The base stuff is probably 4 GB.

Re:it's true

[Bendebecker]

forgot the 'sue', damn i need to get more sleep. 3 hours a night ain't cutting it.

Re:it's true

[jsebrech]

How else does the Code Red author decide, "Hey! I found this buffer overflow routine in the unicode support for URLs in the IIS Indexing Server"?

Didn't code red take advantage from an already published security flaw? Most worms exploit known flaws for which patches are available.

Anyway, reverse engineering an entire operating system into something like source is quite difficult. If you don't have debug symbols you can't deduce from the name what each variable stores and what each function does. And assembly doesn't even have a concept of variables and functions (well, that last bit can be argued, but let's generalise). It's all byte manipulations and conditional jumps. Not easy to see what's happening, especially when you're talking about literally tens of megabytes of assembly. Blackbox testing (throwing random data into the input and seeing what the output does) is much more useful to find exploitable problems.

Re:it's true

[rixstep]

I don't speak of the ethics here, but you've got to figure that whoever leaked it is one good soul. It will improve things on the net and in IT in general. It's almost like forcing MS to accept open source.

Re:it's true

[whittrash]

At least it isn't a trade secret anymore.

Re:it's true

[madoptimo]

I wonder if Microsoft is so tired of supporting old software, that they released this themselves. Not so clever, but a good way nonetheless to get people to upgrade very soon. Should be good news for stockholders.

Re:it's true

[darkfus]

Apparently Microsoft's intellectual property/code segments have already shown up in the Linux kernel..

Ok guys, just kidding... Really... Don't flame m... Ouch!

Re:it's true

[ttys00]

How else does the Code Red author decide, "Hey! I found this buffer overflow routine in the unicode support for URLs in the IIS Indexing Server"?

The Code Red author, and others like him/her, merely take advantage of exploits that are widely known and have patches already. The Code Red vulnerability had a patch available for a year before the Code Red worm was released.

Re:it's true

[noisehole]

found a torrent: ed2k://|file|windows_2000_source_code.zip.torrent| 16496|5506C49CCCA12204BAB6FE960CE5602C|/

btshowmetainfo.py windows_2000_source_code.zip.torrent
btshowmetain fo 20021207 - decode BitTorrent metainfo files

metainfo file.: windows_2000_source_code.zip.torrent
info hash.....: f03fc1e04869294d5644d3c8c5d0fb8f2d26aa59
file name.....: windows_2000_source_code.zip
file size.....: 213748207 (815 * 262144 + 100847)
announce url..: http://alge.nlc.no:6969/announce

maybe its that thing, atm 23 seeders, 185 downloading

Re:it's true

[Bendebecker]

It doesn't really matter if it is real or not. How difficult will it be to prove you had some type of access to it. You just posted to a slashdot story about it. With a good enough legal team (which M$ will have) they could proabbly pin it on you already. In addition, how many different ways are there to implment something. I would imagine that the code that allows Windows to run windows applications are very similiar to the code that allows wine to run windows applications. You have code, you have to translate it to something executable, hiow many way can one do that translation. If you looked at the code or if you didn't, the code you wrote would probably in the end look the same.

Re:it's true

[rixstep]

Moving from cathedral to bazaar isn't easy. This stuff has been closed all along, and although people have been able to sense what moronic code the Beast has produced, it will be first now that they'll see with their own eyes.

Linux has had the advantage of being checked, line for line, from the beginning. NT was an estimate 16 million lines of code; 2K three times that much. That's a lot of code.

I think what people will see, most for the first time, is exactly how bad the coding is in Redmond. This will cause some laughter, and some shock. I think they'll find that parts of the NT kernel were strangely well-written, coming as they did from David Cutler's 'tribe' and the DEC Prism project on which NT was based. On the other hand, I think they will find that other parts, such as the GDI, were horribly written.

And it's all good, IMHO: eEye and Guninski and others have been able to give us a bit of a picture of how bad things are there, but we'll finally be able to see with our own eyes.

It won't be a pleasurable experience.

Re:it's true

[Bendebecker]

By 'it doesn't matter if it is real or not' I mean the accusation that you viewed the source code.

Re:it's true

[FyRE666]

more out of curiosity than any desire to actually do something useful with it.

How about doing something not-so-useful but funny? Say for instance compiling it for Apple ;-))) THAT my friend, would be the greatest hack of.... well, this year anyway...

Re:it's true

[mmp]

You remember incorrectly. That looks like zlib (which gzip is based on). zlib's license is very flexible:

http://www.gzip.org/zlib/zlib_license.html

/* zlib.h -- interface of the 'zlib' general purpose compression library
version 1.2.1, November 17th, 2003

Copyright (C) 1995-2003 Jean-loup Gailly and Mark Adler

This software is provided 'as-is', without any express or implied
warranty. In no event will the authors be held liable for any damages
arising from the use of this software.

Permission is granted to anyone to use this software for any purpose,
including commercial applications, and to alter it and redistribute it
freely, subject to the following restrictions:

1. The origin of this software must not be misrepresented; you must not
claim that you wrote the original software. If you use this software
in a product, an acknowledgment in the product documentation would be
appreciated but is not required.
2. Altered source versions must be plainly marked as such, and must not be
misrepresented as being the original software.
3. This notice may not be removed or altered from any source distribution.

Jean-loup Gailly jloup@gzip.org
Mark Adler madler@alumni.caltech.edu

*/

Re:it's true

[DroopyStonx]

hahaha... wtf are you talking about?

I'm a programmer. I'll take a look at the code, I don't care. How is looking at the code going to affect your future as a developer? You gonna start making crappy code as a result?

It's not like MS is gonna take a look at the source code to your apps. It's also not like you're gonna look at the source and the MS programmer's brain who coded it becomes part of you and as a result you "duplicate" code you saw.

If you look through it and see a more efficient way to do something, more power to you. I know I'll be taking a look through as soon as I get it.

Re:it's true

[DrPizza]

gzip is the name of the compression format (RFC 1952) as well as the utility often used to create files using that format; as such a rewritten version is quite possible, and it wouldn't be surprising to find that the rewritten version is named something such as "gzip". And the zlib compression library itself (unlike the utility) isn't GPLed, in any case. It uses a sensible license instead. A cursory glance doesn't suggest that any of those files are from either project, however. elsewhere

Re:it's true

[mix_master_mike]

"A quick peek around indeed shows something named Windows.Source.Code.w2k.nt4.wxp.tar circulating"

How does one take a quick peek to see such a file is circulating?

Re:it's true

[GlassHeart]

here lies one of the most basic problems of copyright. Nobody can see the other's code...to build on and possibly improve. Everybody has to learn what is already known by themselves. That slows down the whole developement process to a virtual standstill.

I agree that a lot of reinvention has to go on, but I think you exaggerate the effects of not being able to reuse code. To begin with, people tend to forget the steep learning curve required if you choose to reuse code as opposed to rolling your own.

Case in point: Microsoft started nearly from scratch (licensed a simpler browser, IIRC) with IE, at around the same time Netscape decided it was unable to maintain its aging source code. IE overtook Netscape 4 in terms of quality (despite illegal bundling) over a few years. We cannot know if Netscape could've survived if they kept maintaining their 4.x browser, but it's pretty clear that Microsoft wasn't moving slowly at all.

Apple then did the same years later, starting with KHTML (generally considered inferior to Gecko), and within a pretty short time has a really polished Safari browser. It's not as maximally compatible as some of the more established browsers, but it's probably 90% of the way there within a year or two of development.

In fact, the projects that truly move at a glacial pace tend to be the free software projects. Sourceforge is full of these projects, gasping for attention, despite disclosing full source code. In the commercial world, when you throw money at a problem, code gets written from scratch pretty quickly.

Re:it's true

[Zaiff Urgulbunger]

All potential MS employees are sent away to have their memories erased.

Re:it's true

[michael_cain]

Do not, under any circumstances, modify this section. There is no documentation available for this section, and the individual who wrote it is no longer working here.

MS isn't the first place where this has happened. For many years, Bell Labs would not modify the source code for "troff". The original author had died, and the code was so twisted that no one was willing to try making changes for fear of introducing bugs worse than the ones they were trying to fix. I believe that eventually there was a completely new implementation.

Re:it's true

[_Hellfire_]

Now that it's on the Internet (maybe), everyone has access to it. It would be very hard for Microsoft to say "hey you had access so that's our code you're copying" because the obvious answer is "well so does everyone else." The fact that the code would be ubiquitous nullifies Microsoft's claim that you might be writing tainted code.

Re:it's true

[LittleBigLui]

Copyright. Re-inventing the wheel since 1709.

Re:it's true

[LittleBigLui]

First, they could randomly decide to sue you for some arbitrary reason. With as much money as they have, they could find lawyers who would bog you down in a legal quagmire, taking years and hundreds of thousands of dollars in legals expenses.
[...]
Fourth, they could ceritify you as an MCSE and make you work on Windows servers all day.

*crying* nooooooo, please noooooo. show mercy, Microsoft! the first option seemed perfectly reasonable, really.

Re:it's true

[orthogonal]

You're assuming the law will be applied fairly and evenly.

Or as Anatole France wrote,
"The law, in its majestic equality, forbids rich and poor alike to sleep under bridges, beg in the streets or steal bread."

(And no, he wasn't referring to trolls when he mentioned sleeping under bridges.)

Re:it's true

[Jotham]

This applies to all human work, not just computers.

well the original intent for copyright - books, research papers, etc, allowed you to read them but protected the author from direct copying. So just reading the source shouldn't really be copyright infringement -- theft or possession of stolen property/trade secrets maybe -- but copyright infringement only should apply if it's reused. That said, I wouldn't want to be the person trying to argue that in court.

I think the project which'll worry about this the most is WINE -- it's making great strides on its own but how can the maintainers ensure that code submitted doesn't breach copyright if they can't read the copyrighted material to check?

Re:it's true

[SirTalon42]

Also ReactOS, their trying to make a replacement for NT (working with WINE), though the full version will also be POSIX compliant, support DOS, OS/2, and JAVE all as subsystems (how quickly a statement turns into an add for my favorite pet OS :) )

Re:it's true

[the drizzle]

Wonder how long it'll take before a torrent of new worms using newly discovered security holes tear up the net.

So where can i find this .torrent?

budum-chink!

Re:it's true

[FluffyBot]

http://zdnet.com.com/2100-1104_2-5158496.html

This explains that they think the actual source code is 40 gigs and the one being released is only around 600ish megs just to fit on a cd

Re:it's true

[rixstep]

I would expect the Windows code to be a BLOODY MESS

You expect intelligently, monsieur.

Re:it's true

[Deadplant]

grep -ir fuck windows_2000_source_code/*

private/shell/applets/welcome/html/webapp.cpp: // HighContrast mode is turned on. This totally fucks our style sheet as most of it will
private/shell/shell32/copy.c:// want to fuck with.
private/shell/shell32/util.cpp:// the fucking alpha cpp compiler seems to fuck up the goddam type "LPITEMIDLIST", so to work
private/shell/shell32/util.cpp:// around the fucking peice of shit compiler we pass the last param as an void *instead of a LPITEMIDLIST
private/shell/shell32/util.h:// the fucking alpha cpp compiler seems to fuck up the goddam type "LPITEMIDLIST", so to work
private/shell/shell32/util.h:// around the fucking peice of shit compiler we pass the last param as an LPVOID instead of a LPITEMIDLIST
private/windbg64/debugger/tl/remote/ shell/windbgrm .c: // The user fucked up
private/windows/media/avi/verinfo.16/verinfo.h : * !!!!!!!!!!!!!!DOING SO FUCKS THE BUILD PROCESS!!!!!!!!!!!!!!!!
private/windows/shell/con trol/midi/map.c: // !!!this is fucked if a map goes to multiple physical devices

Re:it's true

[Deadplant]

hehe, some days people on IRC can be so nice and helpfull. here's another grep i was given.

grep -ir " shit" windows_2000_source_code/*

private/inet/wininet/urlcache/conman.cxx:// BUGBUG - DON'T DO THIS SHIT.
private/shell/ext/netplwiz/mnddlg.cpp: // this shit's read only
private/shell/win16/commctrl/ctl3d.c: // Some ugly shit goin' on here!
private/windows/media/avi/avicap/capdib.c: // Holy shit, couldn't change formats, time to punt!
private/windows/media/avi/avicap.16/capdib. c: // Holy shit, couldn't change formats, time to punt!
private/windows/media/avi/avicap.io/capdib. c: // Holy shit, couldn't change formats, time to punt!
private/windows/media/avi/msrle/rle.c: // lets do some majic shit so the compiler generates "good" code.

Re:it's true

[cshark]

I was unable to find Windows.Source.Code.w2k.nt4.wxp.tar Anyone have a URL?

Re:it's true

[TheGrayArea]

You'd probably be surprised. Some of it is really, really clean and some of it is a mess. It all depends on which part you look at. As far as searching for curse words and such (as referred to in a reply later in this thread) there actually was a concerted effort at MS a couple of years ago to actively 'clean' the code of offensive comments. There were actually bugs submitted against a whole slew of "WTF" and "hack" and "shit" comments back then.
The code varies greatly in style and how it's put together. The MSMQ code where I spent most of my time when I worked at MS support is just friggin brilliant and a real joy to debug. I can't say that about everything (IE ....).

Re:it's true

[donutz]

I seriously doubt that having looked at that crappy code, anyone would want to duplicate it in even a vague way. At best it would provide an example of what not to do

That's the beauty of it, from Microsoft's point of view.

If you copy Windows code, bam! You're guilty of copyright infringement.

If you write your code to do the exact opposite of the piss-poor examples you find in the Windows source code, bam! You've just created a derivative work without their permission.

Re:it's true

[SirTalon42]

is this real? someone out there must have emule!

Re:it's true

[Gudlyf]

Then there's the old joke:

// Begin Windows 2000 Source Code
#include "dos.h"
#include "windows2_0.h"
#include "windows3_0.h"
#include "windows3_1.h"
#include "windows3_1_1.h"
#include "windows4workgroups3_1.h"
#include "windowsnt3_1.h"
#include "windowsnt3_5.h"
#include "windowsnt4_0.h"
#include "windows95.h"
#include "windows98.h"

...

Re:it's true

[kmcg83]

Heh. As soon as this story broke, some guy I knew broadcasted that he was sharing it on the DC++ hub at my school. So I downloaded it (surprisingly quickly) and read:

/* Windows 2000
** by Bill Gates
*/

#include
using std::cout;
using std::endl;

int main() {
cout << "Hello World!" << endl;
return 0;
}

I should have seen that coming a mile away

Re:it's true

[Anonymous Coward]

This notice DOES appear in the Windows documentation, btw, so it's not exactly a state secret that they used zlib.

Re:it's true

[iminplaya]

The thing is that when you read somebody elses work, it's almost impossible to determine if it had an effect on your own thoughts(I'm sure it always does, whether you realize it or not.) Copyright holders know this and use the law to control what the gov't can't directly. It's censorship by proxy, and I have to admit, it's working pretty well.

I think the project which'll worry about this the most is WINE -- it's making great strides on its own but how can the maintainers ensure that code submitted doesn't breach copyright if they can't read the copyrighted material to check?

This is one of my points. They might be spending way too much time worrying about legalities instead of writing code. It's a needless distraction and can diminish the quality of their work.

Re:it's true

[uradu]

> Some of it is really, really clean and some of it is a mess.

Well, that's exactly what I'd expect from a large number of developers. Same thing going on around here, too. I would assume that the older the code, the more f*cked up it would be--something like the GDI code maybe. And it looks like drivers traditionally tend to be particularly obfuscated. Those hardware guys take special pride in immortalizing themselves through wacko code.

Re:it's true

[KarmaMB84]

How do you know it's crappy unless you've been viewing it? Bill, release the hounds! :D

Re:it's true

[TheGrayArea]

Based on what I had seen in my time, the oldest code (ie the low level base stuff that Cutler was directly involved with and the 'base' stuff) is still fairly clean. There's a middle layer in there that gets pretty grungy. It's not all bad code, but commenting practices sure did change over the years. There's a lot with only comments in the top of the file about updates/etc. They made some more rigid standards about 99-2000 that made it better. It also depended on the group. The guys out of MS Israel (MSMQ, Proxy/ISA) wrote some really nice clean stuff. A lot of the Inet/IE stuff is really messy. The cluster code was really nice as I recall (bud of mine was cluster support). It all really depended on the group. Windows is broken down into a LOT of subpieces handled by specialized groups.

Re:it's true

[stor]

What the hell, it's just one big .vbs file!

Well for God's Sake man, don't click on it! It's a virus!

If you want to download it safely, manually type the URL into your Addess bar.

HTH.

Cheers
Stor

Re:it's true

[MobyTurbo]

So, if any Micro$oft employees have ever looked at Linux kernel source, they are no longer allowed to work on Windows 'cause now they are tainted?

Microsoft may do that. According to a footnote in an essay by Paul Graham:

"I've been told that Microsoft discourages employees from contributing to open-source projects, even in their spare time. But so many of the best hackers work on open-source projects now that the main effect of this policy may be to ensure that they won't be able to hire any first-rate programmers."

Re:it's true

[�berhund]

"...this does open the door to a whole SCO-esque can of worms from now on."

Apparently Microsoft thought things were going so well for SCO, that they should get in on the action.

Re:it's true

[ianr44]

...the fucking peice of shit compiler...

And people are worryed about this crap getting copied into open source projcets!? At least we can spell right in our coments.

Re:it's true

[darkmeridian]

GZIP is used a lot of closed-source software. A few months ago there was a vulnerability that allowed arbitrary code to be run. Winamp released a new version and Windows XP had a patch. So it seems that everyone has basically said that GZIP is in their software. And it probably not illegal because other commenters have said that the GZIP license is really flexible.

Re:it's true

[rzbx]

"In fact, the projects that truly move at a glacial pace tend to be the free software projects. Sourceforge is full of these projects, gasping for attention, despite disclosing full source code. In the commercial world, when you throw money at a problem, code gets written from scratch pretty quickly."

First sentence, completely garbage. Neither true nor false. It all depends on the software. Second, you want software to be built extremely fast no matter how buggy, inefficient, or unorganized it is? Yes, MANY open sourced projects exist that have little to no audience. Now ask yourself this, what open source projects do have a large audience? The popular, important, and most used ones. These are developed at an alarming rate and with all the advantages. You can throw money at anything, but that doesn't always produce best results. Why would you want to throw a ton of money at a project that will have a small user base and/or little importance? Linux, GNOME/KDE, XFree, OpenOffice, Mozilla, Apache, Samba, and many more are arguably the strongest competition closed source projects have ever encountered. "Glacial" speed eh? Have you looked at the add-ons available for Mozilla lately? More features than any other browser. Sure, most are still in the infant stage, but in time the stronger ones win. How much money do you think Microsoft would have to throw at IE to produce as much output as the Mozilla project and sub-projects have produced? By your comments I strongly believe you know very little when it comes to education and progress. Although some of your facts do have some truth to them, your conclusions based on them just don't fit well.

Re:it's true

[This is outrageous!]

you exaggerate the effects of not being able to reuse code

Case in point: Microsoft started nearly from scratch (licensed a simpler browser, IIRC) with IE, at around the same time Netscape decided it was unable to maintain its aging source code. IE overtook Netscape

You might want to read Eric Sink on how this happened:

What was interesting was the day we learned that Netscape didn't have the funding to keep up with Microsoft. (...) At one of those meetings we sat down for a talk which was a major turning point for me and for Spyglass. Scott told me that the IE team had over 1,000 people.

I was stunned. That was 50 times the size of the Spyglass browser team. It was almost as many people as Netscape had in their whole company. I could have written the rest of the history of web browsers on that day -- no other outcomes were possible.

Apple then did the same years later, starting with KHTML (generally considered inferior to Gecko), and within a pretty short time has a really polished Safari browser.

Well you're making the other guy's point, since KHTML was, precisely, (open source and) being reused.

Re:it's true

[Wyzard]

Copyright infringement occurs not when you read the Windows code, but when you download it -- the person you downloaded it from didn't have the right to give it to you. So the person you download from commits copyright infringement directly, and you probably commit contributory copyright infringement or something by voluntarily participating in the transaction knowing that the other party is infringing.

The Windows source code could probably be considered a trade secret, too. (IANAL, of course.)

Re:it's true

[harmonica]

How does one take a quick peek to see such a file is circulating?

Some P2P network, I guess. Or one of the aforementioned IRC channels.

Re:it's true

[identity0]

I don't know if you are telling the truth, but if you are, you should count yourself lucky.

Although I don't think MS would deliberately release the windows source code just to "taint" open source projects as some here have suggested, I think it's quite plausible that MS could fill up some zips with garbage data and release the IP and password of a honeypot server containing the 'windows source code'. They could catch a whole bunch of warez and script kiddies, without exposing themselves to real damage.

The moral of the story: never accespt a free ride from Microsoft, even if they offer tasty candy.

Re:it's true

[myg]

Cutler is meticulous. Clean commented code. Ohh, and who on their right mind would actually accept hungarian as something useful?

MS Israel did the OS/2 SS as well, right?

And I would love to know whos architecture the object manager was? That has to be my favorite section of the code.

Re:it's true

[gglaze]

Don't pretty much all of us who graduated in CS and took CS372 learn operating systems by studying some real operating system code and concepts? And isn't it likely that most of us studied a unix or unix-variant codebase? So are you saying that only Liberal Arts majors are hired to work on Windows?

Hmm...actually, you may have a point...

Re:it's true

[mpe]

Moving from cathedral to bazaar isn't easy.

As shown with Mozilla and OpenOffice.org.

Re:it's true

[jrumney]

Gzip does not contain any files with those names, so it is more likely that the code simply implements gzip compression as used in the HTTP protocol, probably using zlib given the acknowledgements in Windows documentation, and is not copyed from the gzip command line utility in any way.

Re:it's true

[PhxBlue]

That's kinda sad. I've written a lot of code, and I've never felt the need to use profanity (no matter how frustrated I might have been). Programs should be written as professionally as any other document--there's room for humor, but words like fuck really shouldn't have a place in them, IMO.

Re:it's true

[lynk]

From the FreeBSD sources (4.9-RELEASE)

gbopsp02# grep -ir " shit " /usr/src/* | wc -l
47
gbopsp02# grep -ir " crap " /usr/src/* | wc -l
43
gbopsp02# grep -ir " fuck " /usr/src/* | wc -l
85
gbopsp02# grep -ir " buggy " /usr/src/* | wc -l
269
gbopsp02# grep -ir " hell " /usr/src/* | wc -l
116
gbopsp02# grep -ir " arse " /usr/src/* | wc -l
6
gbopsp02# grep -ir " broken " /usr/src/* | wc -l
1350

Re:it's true

[waxxie]

These are whats floating around:

windows_2000_source_code.zip - 213,748,207 MB
windows_nt_4_source_code.zip - 241,131,483 MB
Windows.2000.SOURCE.CODE.LEAK-iND - 660 MB


And apparently its confirmed that at least the 660MB one, does indeed have the source code for internet explorer, explorer, the whole shell, the games, notepad/wordpad, etc....
But mind you this is just what i've heard ;)
MS should release win3.1 src code...hehe

Re:it's true

[nikster]

i fully agree. "code" - e.g. some ascii files - is generally highly overrated.

what is valuable about code is the knowledge that went into generating it. coding is the process of understanding the problem - as much as everybody would just wish it weren't so. therein lies the value.

once you have a sufficiently deep understanding of the subject matter, and an adequate architecure, the rest is trivial: code monkeys can do it.

when you see a pile of source code, however, the value is not easy to see. the reasons for design decisions are not mentioned so you can never know if something is a certain way because A) somebody came up with a good design, B) somebody came up with a bad design, or C) somebody simply pulled this piece out of their behinds.

e.g. raw source code is great for reverse engineering, but not for basing development efforts on it. closed source therefore does not impede innovation.

Re:it's true

[cluckshot]

The story here is a bit more simple than a lot of people may think. His Highness Sir Bill of the Gates trapsed off to India recently trying to stick his finger in the dike to prevent Linux from taking India. He got met by a few problems. http://www.theinquirer.net/?article=6609 http://www.theinquirer.net/?article=6254

So he got mad and released the Source code http://search.yahoo.com/search?p=Windows+Source+Co de&ei=UTF-8&fr=fp-tab-web-t&n=20&fl=0&x=wr t to a few people in India to try to cork Linux back in the bottle. http://www.theinquirer.net/?article=5767 Those Indian Pirates did him in as was to be expected... This is why outsourcing to India is not wise. The climate there is a bit hostile to property rights. But those Ignorant Arrogant Americans keep on foolishly thinking that things are just like back home when they deal there. I apologize to anyone who thinks I am talking out of court when I shoot at the Asian Pirates with such remarks. I was raised around about 10 people who had a cumulative total of about 450 years experience dealing in India and China. The behavior over there is just something I know about. I have had to deal in South East Asia and in the USA with Asians and found that this information was extremely correct.

Linux is absolutely essential to dealing with these people. It completely destroys the value of their "Pirate" mentality. It allows US Programmers to work with these people without fear of the Indians or Chinese using source code as an "Advantage" to crush the Americans. (EU people too!)

I find it most amaizing that Americans always think that this ethical issue in not so. Frankly it is the reason Asia does not absolutely SWAMP the US out of consideration. It hobbles them economically. If they corrected this problem their native natural resources plus massive population would make the USA assume a 2.5% share of the world market and power rather than its much higher station. I for one would love for them to finally get this together because I know that it would be good for all if they did. It would for example end the war problems there.

Re:it's true

[Freultwah]

Just out of curiosity, what were you grepping for when you found this? And why?

Re:it's true

[nineoneone]

Well, I for one just cannot resist it. But I'm gonna follow the example of our great leader, Tony Blair and lie my arse off about it.

Re:it's true

[niller]

A quick peek on Kazaa on my friend's box pulled up around 3600+ matches. Granted... lots of them were .exe, and even more were waaaaaay to small.

Still... there are a good number that are more then a GB in size.

Of course... it's Kazaa...so who knows.

Re:it's true

[Marillion]

Developed editions of NT4, and I presume more recent versions, ship with debug symbols, device driver headers and a wealth of information that can be used to facilitate the reverse engineering process.

Also, I don't know if you've ever looked at the reversed engineered code the the 1988 Morris Internet Worm source code. Sure it's small compared to an operating system, but it's an amazing testament to the power of good reverse engineers.

Re:it's true

[TheGrayArea]

>>Ohh, and who on their right mind would actually accept hungarian as something useful?
Try the Excel team. I had an opportunity to see some of the Excel source as part of a debug session. Total Hungarian hell!! The variable names were huge and looked like alphabet soup!

Re:it's true

[Shinobi]

Improvements tend to come from working on other peoples projects. Innovation has that annoying tendency to come from the people who actually choose to work from scratch.

Case in point: Marketing aside, Xerox, Apple, MS etc etc has done far more innovation than the Open Source/Free Software Movement has done(Hell, the GNU project started because they made their own implementations of already existing tools). There's nothing in *BSD, Linux, XFree86, Mozilla, KDE, Gnome, GIMP etc that can be considered innovative, just implementations of what has been done in earlier research projects or commercial offerings.

Re:it's true

[myg]

Ugh. I work on a hungarian piece of shit code every day. The original author had no discipline and the names are now meaningless since the types have changed. Oh, and he was inconsistent to begin with.

I just had to vent.

Re:it's true

[Deadplant]

i trimmed the output a bit.
slashdot's stupid lameness filter kept telling me I was using too many "bizaar characters" or something like that.
there were also a few lines that matched but didnt' actually contain the naughty words.

Re:it's true

[alienw]

I grepped for "fuck". Then I saw "pussy" in the same line and thought "WTF". Then I found that little gem.

By the way, this is the Mandrake kernel, version 2.4.22-10mdk. So it may not be in the vanilla kernel.

Re:it's true

[cspring007]

How about a worm that spreads copies of the source code around the internet. call it the 'my source' virus.

Re:it's true

[meme_police]

OS X sucks less.

Re:it's true

[GlassHeart]

Keep the context in mind. The article I'm responding to said copyright "slows down the whole developement process to a virtual standstill", because code cannot be reused.

I'm pointing out that throwing money at the problem has been an effective way to get code written for decades now. In fact, plenty of software projects progress slowly despite publishing their source code. This means that copyright, closed source, and reinvention do not mean progress has to be slow.

I did not say all free software projects progress slowly. I did not say throwing money produces the best results. I'm afraid you're barking up the wrong tree.

I said that copyright is not an insurmountable problem when you have money to throw at it.

Re:it's true

[gordyf]

Google doesn't keep an up-to-the-second db of the 'net, it takes time to crawl.

Re:it's true

[GlassHeart]

You might want to read Eric Sink on how this happened:

I didn't say Microsoft played fair. In fact, I even pointed out they resorted to illegal actions. The point is that throwing money at the problem quickly overcame the fact that Microsoft didn't have Netscape's source code. The fact was that IE was not at a "virtual standstill" once Microsoft decided to enter the game.

Well you're making the other guy's point, since KHTML was, precisely, (open source and) being reused.

No, I'm not. Apple picked KHTML over Gecko, even though Gecko is more mature. Why? Because they know they can make up the difference quickly once they get to work on it. The portion that makes Gecko superior to KHTML at the time was not significant enough to Apple.

Reinvention is simply a fact of life in commercial software development. Look at how quickly the proprietary portions of MacOS X were put together relative to KDE or Gnome for another example. Yes, there was significant reuse from NeXTStep, BSD, and other sources, but the parts that were entirely new did not come about so slowly.

I'm not putting down reuse. I'm just saying that companies don't really have to think hard before deciding to code something themselves.

Re:it's true

[booch]

I would tend to agree with that.

Re:it's true

[This is outrageous!]

I will agree with you that the great-granparent overreached with that "virtual standstill" comment. But still I think you're stretching those examples quite a bit. Maybe you can find better ones :-)

As you admit OS X makes significant (I'd say huge) reuse of (Mach,) BSD and NeXTstep. Didn't previous attempts to do it from scratch almost kill Apple? (I forget the projects' names... Taligent? Copland?)

As to KHTML vs. Gecko, they seem to simply not have found the latter so "superior"...

Re:it's true

[GlassHeart]

I will agree with you that the great-granparent overreached with that "virtual standstill" comment. But still I think you're stretching those examples quite a bit. Maybe you can find better ones :-)

Picky, picky. :) Netscape had 70% of the market, and Microsoft caught up within a few years, including bug-for-bug compatibility in some areas. Isn't that dramatic enough an example to prove that closed source development isn't really slow?

As you admit OS X makes significant (I'd say huge) reuse of (Mach,) BSD and NeXTstep. Didn't previous attempts to do it from scratch almost kill Apple? (I forget the projects' names... Taligent? Copland?)

Note that Apple went cherry picking with MacOS X. The conventional wisdom would be to just adopt BSD in its entirety, which maximizes the number of lines reused. It's difficult to say, especially from an outsider's view, whether the problems with Copeland is really technical.

As I said, suitable reuse does speed up improvement. MacOS X has progressed much more quickly than Windows in the past three years or so, and a part of that success must be credited to their liberal adoption of free software.

As to KHTML vs. Gecko, they seem to simply not have found the latter so "superior"...

The relevant passage from the article you cited is: "The size of your code and ease of development within that code made it a better choice for us than other open source projects. Your clean design was also a plus."

In other words, it was better for Apple that KHTML was smaller. It was big enough to save them considerable time, but small enough to easily understand and extend. Put another way, you don't try to reuse the maximum number of lines of code possible, which matches my point exactly. New lines of code are simply not that hard to write, compared to the effort required in understanding a larger body of code.

Re:it's true

[This is outrageous!]

The relevant passage from the article you cited is: (...)

Well, that and (my emphasis):

"Gecko does not fit in well with Objective C and Cocoa (...) Gecko is a thick cross-platform codebase that doesn't reuse components that have already been implemented by the OS."

So yeah, it looks to me like they did go for maximal reuse. It's just that, with all cross-platform requirements gone, the choice was not between Gecko and KHTML but between Gecko and KHTML + Cocoa...

Re:it's true

[GlassHeart]

it looks to me like they did go for maximal reuse. It's just that, with all cross-platform requirements gone, the choice was not between Gecko and KHTML but between Gecko and KHTML + Cocoa...

Ahh, good point. This brings up another point, which is that reuse and commercially developed code aren't mutually exclusive. Microsoft bought some code to jumpstart IE, and Apple bought NeXTStep to jumpstart MacOS X. In my original rebuttal I simply forgot to mention the obvious: that you can buy the copyright of the code you want.

Re:it's true

[SkunkPussy]

> A quick peek around indeed shows something named Windows.Source.Code.w2k.nt4.wxp.tar

no in this case some joker has tar'd up what appears to be a gentoo distribution. the implication that this is Microsoft's crown jewels is funny, but not what you're looking for.

Open Source

[The_Rippa]

Now will everyone stop bitching about Windows not being open source?!

Re:Open Source

[jps3]

I could not have said it better myself! :-)

Re:Open Source

[eyegor]

Actually, now Microsoft can pull a SCO and sue anyone who produces an OS with lots of security holes and cruft.

Re:Open Source

[Rosco P. Coltrane]

I'm surprised nobody has sent them patches to fix security issues yet...

Re:Open Source

[Anonymous Coward]

I would see the opposite being more likely...now the open source community can examine w2k for evidence of GPL'd code being used.

Imagine the shitstorm if someone found linux code in the w2k kernel...and people thought slashdot posted a lot of SCO stories...

Re:Open Source

[swordboy]

http://heim.ifi.uio.no/~mortehu/files.txt

The list of files has none other than:

win2k/private/inet/mshtml/tools/include/errno.h

Re:Open Source

[Dreadlord]

WRONG, SCO as they can see Windows source code, will surely find lines of code copied verbatim from their UNIX and sue MS.

Re:Open Source

[DarkBlackFox]

No, but how long will it be until Microsoft pulls an SCO and accuses open source of integrating MS code? If it is indeed true, and the code is floating around out there, and within a few weeks a miracle version of Wine is released which suddenly has 100% compatibility, what would MS's reaction be?

Re:Open Source

[KJACK98]

There is a file in there called gnumake, you mean to tell me they are using GCC, I HIGHLY doubt that, something doesn't sound right, fake perhaps?

Re:Open Source

[macshune]

>>what the hell does a curriculum vitae email link make in the Windows source tree??!

Evidence.

Re:Open Source

[Ungrounded Lightning]

I'm surprised nobody has sent them patches to fix security issues yet.

I'm not. (Though I WON'T be surprised if somebody sends 'em a patch anonymously. B-) )

Anybody who sends a fix in a tracable way - and lets the rest of us know they did it - is likely to be sued, or prosecuted, for having a copy of the source. So why risk it?

Re:Open Source

[bersl2]

We're not dumb. Any sudden OSS magic bullet is suspicious, simply because it will have come from nowhere; we do not develop in isolation.

Re:Open Source

[SirTalon42]

unless it crashed every few seconds and could only run a few programs properly then i would be suspicious

Re:Open Source

[jonadab]

If (and this is the sort of "if" that places us well more than a mere one leap
away from reality) the WINE team had full legal access to the Windows source
code granted them by Microsoft, the miracle version of WINE would definitely
not come out "within a few weeks". The job of ingesting all that info and
getting a feel for the organisational peculiarities of a codebase that large
would impose a multi-month overhead before you could really even start to do
meaningful work.

Re:Open Source

[SQLz]

Errr...ummm...no.

Re:Open Source

[snipersock]

We can only hope :) I'd sure love some of my games to work under wine alot better. Also some of the other random win32 programs that havn't been converted to *nix clones yet. I can just imagine running some of the cool and obscure win32 toys under wine or winex.

Re:Open Source

[Prof.Phreak]

Actually, I just installed the latest update from windowsupdate, and one of them included something called "Error Reporting Service" update or something, and in the comments it said you could send them a problem, cause, and fix if you wanted. (ie: a FIX!).

Server problems ALREADY...

[momerath2003]

"The server is too busy at the moment. Please try again later."

Later isn't going to work, since the server was down even before it hit the Slashdot front page. I empathize with their server.

I did, however, managed to grab the news blurb (but not the, at that point, 214 comments) from the intermittent front page:

Neowin has learned of shocking and potentially devastating news. It would appear that two packages are circulating on the internet, one being the source code to Windows 2000, and the other being the source code to Windows NT. At this time, it is hard to establish whether or not full code has leaked, and this will undoubtedly remain the situation until an attempt is made to compile them. Microsoft are currently unavailable for comment surrounding this leak so we have no official response from them at the time of writing.

This leak is a shock not only to Neowin, but to the wider IT industry. The ramifications of this leak are far reaching and devastating. This reporter does not wish to be sensationalist, but the number of industries and critical systems that are based around these technologies that could be damaged by new exploits found in this source code is something that doesn't bare thinking about.

We ask that for the wider benefit of the IT community that members and readers support Microsoft by forwarding anything they know about the leak to the Microsoft's Anti-Piracy department.

Please do not post any links/screenshots/hints or anything to do with the source code outbreak. Discussion is allowed but we will not condone people spreading this source code.

Torrent, anyone? ;) (not like I would have any reason to want to have several lines of bug-infested code, as who knows to where the bugs might spread in my system)

Re:Server problems ALREADY...

[momerath2003]

Also, someone on the comments posted an alleged 2.3 MB list of the files leaked as well (contains no source).

It's allegedly from the file "windows_2000_source_code.zip."

(Who knows if it's real, as it's too early to tell, probably)

Re:Server problems ALREADY...

[Trix]

What the line says...

Discussion is allowed but we will not condone people spreading this source code.

What I saw on first glance...

Discussion is allowed but we will not condone people upgrading this source code.

Re:Server problems ALREADY...

[1010011010]

I hope some bright I.T. reporter will write a story about how "Linux source code leaks" are not a security issue, but part of the development process, making Linux safer than Windows. I mean, if the Windows source is so full of bad code and bad design that releasing it represents a threat to national security (Jim Allchin's words), while Linux has always had its source code freely published -- it standsto reason that Open Source software is of higher quality.

Re:Server problems ALREADY...

[Docrates]

but the number of industries and critical systems that are based around these technologies that could be damaged by new exploits found in this source code is something that doesn't bare thinking about.

I disagree with the reporter. Because of the added scrutinity a widespread access to the sourcecoude will generate, it's more likely that we'll finally see a tight, secure Windows 2000 and NT. That is, if Microsoft accepts fixes, tips and advices from the hacker community as they should. If they don't, I can already see the unofficial Service Packs doing a much better job than Microsoft's.

Re:Server problems ALREADY...

[Zork the Almighty]

This reporter does not wish to be sensationalist, but the number of industries and critical systems that are based around these technologies that could be damaged by new exploits found in this source code is something that doesn't bare thinking about.

Hmm, my computing platform doesn't seem to have that problem.

Re:Server problems ALREADY...

[Mr. Piddle]

At this time, it is hard to establish whether or not full code has leaked, and this will undoubtedly remain the situation until an attempt is made to compile them.

How big are these files? I would expect the size of these tarballs to be comparable to Linux Kernel + GNOME + Mozilla + misc userland/bundled equivilents. If they are unexpectedly small (like less than a gig for W2K), then they are probably a hoax.

Re:Server problems ALREADY...

[Mr. Piddle]

who the hell would run a critical system with Microsoft rubbish ?

You overestimate the average IT customer. Whevever I hear someone say proudly that they have a big-ass server running Windows 2000 that controls things like parts of our insurance or finance industry, I cringe. I've also seen little camoflaged portable computers running Windows for the military (cringe again). You know, some people have even put Windows on a United States Navy ship (after Billy G. bought stock in the shipyard, I hear). We have all heard the story of it being towed back to port.

Re:Server problems ALREADY...

[scambaiter]

uhm, no. If it were true it would probably be more the source of the nt kernel alone, not the whole windows source tree including explorer and mine sweeper. I suppose that should be quite a bit smaller than 1 gig.

Re:Server problems ALREADY...

[Rosco P. Coltrane]

God, this latest karma-whoring technique on Slashdot consisting in posting "I thought I had read first!" or "I could have sworn it said " pisses me off to high heaven : if people can't find funny lines in the article to exploit in a witty post, they just make up their own, and moderators mod up funny for a reason that escapes me.

MOD PARENT DOWN, IT'S NOT FUNNY...

Re:Server problems ALREADY...

[say]

It's not like it is the entire sourcecode for everything in win2k. it's some of it. judging by the filelist, i would guess.. 30MB or so.

Re:Server problems ALREADY...

[LuxFX]

... that could be damaged by new exploits found in this source code is something that doesn't bare thinking about.

Argh! Trying to get rid of images of naked NeoWin people thinking about ramifications....

Re:Server problems ALREADY...

[bonch]

I'm seeing filesizes of 245.37MB.

I think this might be a hoax.

Re:Server problems ALREADY...

[plj]

Searching the file for "ppc", "mips" and "alpha" it is interesting to realize how much references to these architectures is still lingering there. And hell, even "ppcmac"! I wonder if MS is still maintaining these other architectures internally the same way as Apple is rumoured to have running Mac OS X/x86 installations internally.

OTOH, most of the OS X code (without Quartz etc.) is OSS-maintained on x86 anyway, so it is probably much smaller pain for them.

Re:Server problems ALREADY...

[TwistedSpring]

Yeah yeah and the rest. "My OS is open source! Isn't that great!" grow up. If you think MS should open source the whole of windows you're crazy. Too late now, will never happen, and how would they make any capital out of a move like that.

Re:Server problems ALREADY...

[Pakaran2]

By the way, the only times "NSA" occurs in the filenames is "scrnsave" and "transact". "DRM" occurs only once, in a filename "addrm.c".

So a lot of what we've been hearing is apparently quite false.

Re:Server problems ALREADY...

[smoking2000]

According to the filesizes on the webpage the total bytesize = 1974344667 (1255.2545337677 MB)

And has 4411 files of 0 bytes long ...

Maybe it's real, maybe it's not

Russian gov. gets full src windows http://amo.net/NT/01-20-03MSFT.html

Re:Server problems ALREADY...

[TwistedSpring]

Pretty much most people who make Automated Teller Machines these days. I frequently see win2k error dialogs on the ones around where I work. That doesnt mean that windows is shit, it just means that the software written for it to run on ATMs is shit, and people should realise that the NT kernel is actually an extremely sensibly structured and well written system, it's just most of the peripheral junk like IE that's bundled on top that leaves something to be desired.

I've been using my machine for 4 years with Win2k, and never got a virus and never got exploited. This is because I know how to use a computer and am not a fucking retard. If people who run porn sites had any interest in exploiting Linux they would have researched it and done it long ago, plus unix has had its fair share of serious breaches (read SSH, OpenBSD holes) just recently, but because the media doesn't care everyone thinks its super-secure.

If Windows has Security through Obscurity, then unix is Security through Lack of Publicity.

Like it or not, Windows is the most popular home OS, so if you're writing malicious code, hit Windows and sod the rest. You'll get the most exposure and pldages from your spotty cracker buddies that way.

Re:Server problems ALREADY...

[Anonymous Coward]

The files.txt that was posted everywhere reads a sum of 658,114,889 bytes.

Re:Server problems ALREADY...

[AHumbleOpinion]

Actually in-flight software does that sort of thing all the time. Pilots have been resetting subsystems long before Windows or Linux, the OS is typically not the culprit. My vague recollections are that the subsystem that happened to be running Windows had something to do with weapons inventory. Flight control and weapons launch being done by other subsystems. Just a recollection, can't be sure.

Re:Server problems ALREADY...

[Scott Hale]

What, you think finding a backdoor is as simple as locating "nsabackdoorhax0r.c?"

Re:Server problems ALREADY...

[Chainsaw Messiah]

MOD PARENT DOWN, IT'S NOT FUNNY

Wow! That's weird, at first I thought that said "MOD PARE NT DOWN, IT SNOT, FUNNY

Re:Server problems ALREADY...

[PFAK]

I wonder if http://lists.suse.com/archive/suse-linux-e/2000-Ju n/1725.html is relavent to this, could it just be one big hoax?

I hope its real.. heh.

Re:Server problems ALREADY...

[chevelleSS]

I found a link to the source on E-MULE, it looks to be around a gig if it is the real thing.

Brandon

Re:Server problems ALREADY...

[benna]

This is exactly what people mean when they say there should be software deversity just like there must be diversity in a species for it to survive. Now what M$ should do is just opensource it so they can fix all the bugs that will be found (if anyone is willing to help them fix them)

Re:Server problems ALREADY...

[Kethinov]

Yeah yeah and the rest. "My OS is open source! Isn't that great!" grow up. If you think MS should open source the whole of windows you're crazy. Too late now, will never happen, and how would they make any capital out of a move like that.

If all this is true and the full source code to Win2k has been leaked, if I were MS I'd go ahead an open the source to WinXP and all prior. Continuing to develop using fully leaked insecure code is corporate suicide, so then I'd rebuild Longhorn from scratch so that not a single trace of the original code was in it. They could even go the Apple way and build a new OS off some open source kernel, though I doubt they'd swallow that much pride.

Re:Server problems ALREADY...

[VariableQ]

NTFS.org has an update from neowin.net regarding a statement from Microsoft. It can be found here Here the updated text too. "Microsoft Corp. is investigating rumors that the secret underlying programming code of its Windows NT and Windows 2000 software has leaked and is available on the Internet, a company spokeswoman said Thursday "The rumor regarding the availability of Microsoft source code is based on the speculation of an individual who saw a small section of unidentified code and thought it looked like Windows source code. Microsoft is looking into this as a matter of due diligence," the spokeswoman said."

Re:Server problems ALREADY...

[orthogonal]

By the way, the only times "NSA" occurs in the filenames is "scrnsave" and "transact"

Sure is does, "Pakaran2".

That's what you want us to believe, isn't it?

Well, I'm not fooled, and neither is my friend Timmy the Tinfoil hat!

No, we're not fooled, are we, Timmy?

Re:Server problems ALREADY...

[BitwizeGHC]

Building longhorn from scratch would require re-hiring Dave Cutler, the VMS architect who developed the first NT codebase.

Word is that Cutler and MS had something of a falling out due to the marketroids getting hold of his little OS project and turning it into the shining example of security and reliability that it is today.

Don't expect Microsoft to rebuild anything from scratch. The best they could come up with without someone like Cutler is probably Windows Me.

Re:Server problems ALREADY...

[jonadab]

> people should realise that the NT kernel is actually an extremely sensibly
> structured and well written system, it's just most of the peripheral junk
> like IE that's bundled on top that leaves something to be desired.

I don't know exactly how sensibly-written the NT kernel is (other than that
it's obviously *way* better than the Win9x kernel; that much is clear). I
do know that certain apps bundled with it (most notably Outlook Express) are
much worse than the mere waste that you mention[1] but more akin to poison, as
they *actively* compromise security. (OE (or something) also actively takes
measures to prevent you from removing it and/or restore it if you do, which
as far as I'm concerned qualifies it as a virus.) So the kernel is certainly
not the major problem with current NT systems. As near as I can tell, the
kernel's not half bad, but some of the other components of the system are
much worse than half bad. If you want to call Outlook Express "peripheral
junk", sure, then I can agree with what you say, but it'd sure be nice to
have a way to get rid of the peripheral junk. (And don't say "just don't
use it"; I have to deploy to users who don't know the difference between
My Computer and their ISP; they're sure not going to know whether they're
using Outlook Express or not; I want it *removed* from the system, GONE.)

> I've been using my machine for 4 years with Win2k, and never got a virus
> and never got exploited.

Yeah, I've been maintaining a network since 2000 April (not quite 4 years
yet) that's currently got nine (about to be ten) Windows systems on it of
one flavour or another (plus several macs, a couple of Mandrake systems,
and one OpenVMS), and the last time we had anything that resembled a virus
running on our systems was Bonzi Buddy which was already there when I was
hired, and I cleaned it off sometime in 2000. (I say "running" because we
did have a situation where a virus file got deposited on an exposed network
share, but it never got executed on our systems and I got rid of it and
moved the network share behind a NAT gateway (specifically, a headless
Mandrake box doing IP Masquerade).) But I've accomplished this by making
darn sure there are no MSIE shortcuts on the desktop or start menu, making
sure MSOE (and in some cases Outlook -- we have a couple of systems with
Office) is non-functional (which is much harder on XP than on Win98, I
might note), having no working removable-media drives on certain systems
(ones that are accessible to random persons and connected to the network),
and other measures that really ought not to be necessary. Sure, it's
*possible* to secure Windows systems, but it's entirely too much work.
I've put almost no time into keeping the Mac systems secure and for the
Linux systems I only had to upgrade server-type apps a handful of times;
if they hadn't been running any server stuff (the Windows systems aren't),
then they wouldn't have needed any maintenance at all (unless there were
new features available in the new versions that I wanted, like Emacs 21,
browser upgrades, ... but that's not security maintenance).

My hatred is particularly strong for Outlook Express. I want it removed
from the universe, sooner rather than later. (Today would be good.
Yesterday would be better. Five years ago would be wonderful.) I don't
even want people to remember it. *I* certainly won't want to remember it.

[1] You used a less-kind word for it. You know the stuff I mean.

Re:Server problems ALREADY...

[jonadab]

> it'd sure be nice to have a way to get rid of [Outlook Express]

An easier way, I mean. What one has to go through to do it the way I know
how is rediculous. Every new WinXP system we get I have to devote at least
an hour to hunting down and removing all the MSOE components; it's a pain, but
I'm not willing to support a network that has OE on it; that would be worse.

Re:Server problems ALREADY...

[adrianbaugh]

> what's wrong with Kerry following the party line? After all, he is hoping to represent that party...

Modded as flamebait but not intended as such - I'm genuinely curious (as an outsider) why it's thought to be a bad thing that someone who wishes to be a Democrat president actually adheres to Democratic policies. If anyone could post a more helpful response than negative moderation (which doesn't really explain anything) I'd be grateful.

Re:Server problems ALREADY...

[fatboy]

God, this latest karma-whoring technique on Slashdot consisting in posting "I thought I had read first!" or "I could have sworn it said " pisses me off to high heaven : if people can't find funny lines in the article to exploit in a witty post, they just make up their own, and moderators mod up funny for a reason that escapes me.

MOD PARENT DOWN, IT'S NOT FUNNY...

Trix has the Karma to burn. If you don't like how a post is moderated, start meta-moderating and quit bitching, Karma Whore.

site was /.ed before story went live

[mpost4]

so here is the story

Neowin has learned of shocking and potentially devastating news. It would appear that two packages are circulating on the internet, one being the source code to Windows 2000, and the other being the source code to Windows NT. At this time, it is hard to establish whether or not full code has leaked, and this will undoubtedly remain the situation until an attempt is made to compile them. Microsoft are currently unavailable for comment surrounding this leak so we have no official response from them at the time of writing.

This leak is a shock not only to Neowin, but to the wider IT industry. The ramifications of this leak are far reaching and devastating. This reporter does not wish to be sensationalist, but the number of industries and critical systems that are based around these technologies that could be damaged by new exploits found in this source code is something that doesn't bare thinking about.

We ask that for the wider benefit of the IT community that members and readers support Microsoft by forwarding anything they know about the leak to the Microsoft's Anti-Piracy department.

Please do not post any links/screenshots/hints or anything to do with the source code outbreak. Discussion is allowed but we will not condone people spreading this source code.

Re:site was /.ed before story went live

[norculf]

We ask that for the wider benefit of the IT community that members and readers support Microsoft by forwarding anything they know about the leak to the Microsoft's Anti-Piracy department.

How is this to the benefit of the IT community?

Re:site was /.ed before story went live

[glop]

Along the same lines. The sources to the Linux operating system have been widely exposed for the last ten years or so. I do not wish to be sensationalist but the number of industries and critical systems that are based around these Linux Technologies and could be damages by new exploits found int this Linux source code is something that doesn't bear thinking about.

P.S. This is my first attempt at writing a funny comment on Slashdot, so please don't be too harsh ;-)

What now?

[Rosyna]

Are people deeply involved with OSS going to start fixing bugs in Win 2k? Might be fun and a dagger in MS's heart.

"We fix bugs in 24 to 40 hours, much faster than OSS."

Re:What now?

[MikeXpop]

I have no idea what and how much of windows' code is leaked, but I imagine if it's the right amount, there might be some illegal forks in the WINE project formulating.

Re:What now?

[MenTaLguY]

Are people deeply involved with OSS going to start fixing bugs in Win 2k? Might be fun and a dagger in MS's heart.

More like a dagger in OSS's heart, due to IP contamination.

Re:What now?

[74nova]

haha, i sure hope so. then microsoft/wine can be the next SCO/linux. oh wait, i spose it would be different since code woudl actually be stolen...

Re:What now?

[smelroy]

Don't stab MS Hearts, that is a good game!

Re:What now?

[Jim_Maryland]

Just to throw this out, what's the possibility that MS saw some similar routines in WINE and figured to shutdown the project by releasing some portions of the MS code that overlaps? They could essentially say that WINE must be based on MS proprietary code. Even with the code only publicly being leaked now, they could argue that copies may have been floating around for a while. Maybe they are taking some ideas from SCO on how to profit from the OSS community.

Re:What now?

[Loie]

rofl! seriously folks, that would be hilarious if the OSS movement releases a vastly improved version of Win2K by April 1.

Re:What now?

[0mni]

It is more likely that the illegal works will be created by an individual user, or seperate body to the wine project.

Re:What now?

[hendridm]

> there might be some illegal forks in the WINE project formulating.

Only to be sued into oblivion faster because it's open source!

Re:What now?

[Rufus211]

Except you forget microsoft has never sued anyone AFAIK, and certainly not any OSS project. They could have probably sued about NTFS being pantented or shit like that a long time ago.

Re:What now?

[Bagels]

Not likely - the WINE folks could just show some code from before the leak with the "similar routines" included. That said, they'd have to find a way to *prove* that it came from before.

Re:What now?

[jonadab]

> Maybe they are taking some ideas from SCO on how to profit from the OSS
> community.

SCO is profitting from investors (mainly two large ones), not from the OSS
community. The OSS community is only involved as a way of generating some
publicity. (It's a remarkably complex way to generate publicity, but that's
what they're doing (quite successfully, I might add). The process is really
too involved to classify as a "stunt", though, as that would imply a
terminating sequence of simple events; SCO's publicity engine seems to be
more of an ongoing thing.)

Microsoft doesn't *need* the OSS community to generate publicity; they can
get media attention as easily as the President of the United States. And
over the medium or long term they seem to be much better than SCO at making
profit. So no, I don't think Microsoft is planning to pull a SCO for the
purpose of generating revenue.

If they *were* planning a lawsuit (which seems unlikely; not that I'd put
it past them, but the leak is more easily explained elsewise; various things
seem to leak out of MS regularly, not all of which Microsoft wants released,
I'm pretty sure; there's no reason to believe this is different) it would be
for the purpose of squelching competition, not generating revenue directly.

Re:What now?

[jo42]

Submit code fixes here:

bling.microsoft.com/cvs
Account: bgatus
Password: G0D!

Hmmm...

[TheSpoom]

Do I have to sign an NDA?

Seriously, this should be pretty interesting. I wonder how many bugs are ACTUALLY in the NT kernels...

Re:Hmmm...

[Anonymous Coward]

I wonder how many bugs are ACTUALLY in the NT kernels...

Based on these windows screenshots, I would say - A Lot.

Re:Hmmm...

[frodo from middle ea]

I can name atleast one.

Install Adobe acrobat reader 4. (any version pre 5). Open a large PDF file. (say more than 30 pages).

Click on the scroll bar very quickly 3-4 times..

KA..BOOM

Re:Hmmm...

[ThogScully]

And what does this have to do with Windows?
-N

Re:Hmmm...

[Orne]

Yea, you go over to support.microsoft.com and fill out an HTML form telling them that you downloa... wait a minute...

Re:Hmmm...

[frodo from middle ea]

Yes, a simple document reader, crashing an entire OS, by just some mouse clicks, speaks volumes about the quality of OS.

Re:Hmmm...

[ThogScully]

My mistake then. I wasn't aware that KA-BOOM means the OS crashes.
-N

Re:Hmmm...

[BandwidthHog]

I wonder how many bugs are ACTUALLY in the NT kernels...

I'd say pretty much all of 'em.

I'll believe it when I see it.

[American AC in Paris]

Zeroeth point: Who? Neowin.net? ...now where have I heard that name before...oh--that's right! Nowhere! It's one of umpteen-dozen Slashdot wannabe sites, your basic news feed/PHP comment page model. I can't imagine they have that much of an investigative team...

First point: The tagline for Neowin.net is "Where unprofessional journalism looks better" I'll take what they say with a block of salt.

Second point: The odds of getting one's hands on the full source to NT4/2K are slim to none--even most Microsoft folks couldn't do that. The code is probably scattered across multiple servers in Redmond, for starters, and you'd only be given access to the parts you needed to work with.

Third point: The article has absolutely no detail to it whatsoever. For all we know, they've released a trojan masquerading as the source code and are trying to sucker geeks and 14m2rZ into downloading it.

...as the site is probably going to crash hard very quickly, here's the article text:

Neowin has learned of shocking and potentially devastating news. It would appear that two packages are circulating on the internet, one being the source code to Windows 2000, and the other being the source code to Windows NT. At this time, it is hard to establish whether or not full code has leaked, and this will undoubtedly remain the situation until an attempt is made to compile them. Microsoft are currently unavailable for comment surrounding this leak so we have no official response from them at the time of writing.

This leak is a shock not only to Neowin, but to the wider IT industry. The ramifications of this leak are far reaching and devastating. This reporter does not wish to be sensationalist, but the number of industries and critical systems that are based around these technologies that could be damaged by new exploits found in this source code is something that doesn't bare thinking about.

We ask that for the wider benefit of the IT community that members and readers support Microsoft by forwarding anything they know about the leak to the Microsoft's Anti-Piracy department.

Re:I'll believe it when I see it.

[rritterson]

While you may not have heard of Neowin before, they are actually quite well known and are often placed in those '100 essential sites' lists.

They focus primarily on windows tech, and have a knack for breaking stories about Windows- leaked builds of future versions, beta builds of service packs, etc. Whoever runs the site is well connected in Microsoft.

Re:I'll believe it when I see it.

[y0bhgu0d]

Neowin is one of the pillars of the beta scene... they normally have news on leaked betas/previews/etc...

Re:I'll believe it when I see it.

[scambaiter]

Hm, when looking at google for sites linking i get... 86! Maybe it _is_ some trustworthy elite windows site, but i would really love to see confirmation by at least 2 major tech sites.

Re:I'll believe it when I see it.

[Dachannien]

For all we know, they've released a trojan masquerading as the source code and are trying to sucker geeks and 14m2rZ into downloading it.

That would require actually making the executable from the source. And if somebody manages to pull that off, that's a good sign that you probably *shouldn't* try running it ;)

Re:I'll believe it when I see it.

[Salsaman]

The code is probably scattered across multiple servers in Redmond, for starters, and you'd only be given access to the parts you needed to work with.

So, how do they build binaries then ? Gather all the parts together and hope they work ? Sounds about right to me !

Re:I'll believe it when I see it.

[BrianCarlstrom]

Second point: The odds of getting one's hands on the full source to NT4/2K are slim to none--even most Microsoft folks couldn't do that. The code is probably scattered across multiple servers in Redmond, for starters, and you'd only be given access to the parts you needed to work with.

Microsoft gave a talk at usenix: Windows A Software Engineering Odyssey

This slide indicates the full source is 50gb and took a week to setup and 2 hours a day to update.

That implies to me that people could have the whole source but it would huge.

Slide 24 talks about their new perforce based system that only takes 3 hours to setup and 5 minutes to update.

Re:I'll believe it when I see it.

[Chiron Taltos]

While you may not have heard of Neowin before

Thank you! People love to use that as their first arguement ... "well, I've never heard of it before".

So freakin' what?!? The internet is a big place. I'm sure there are exponentially more sites in existence, than I've visited. This doesn't, by itself, make them irrelevant.

Re:I'll believe it when I see it.

[domipheus]

if you had bothered to open your eyes before showing your stupidity you would see that neowin is actually a very popular site for windows info, and has infact won awards for its popularity.

even if this is false (as _they_ say, if it is out, its deffo not the full thing) neowin will always be the place to be for windows info.

maybe you should do your homework before making youself look like such a twat. Get your finger out your arse and post some constructive comments.

Re:I'll believe it when I see it.

[sql*kitten]

took a week to setup and 2 hours a day to update

No wonder, with half a meg of memory :-)

Re:I'll believe it when I see it.

[trentblase]

well, I've never use that as my first argument before

Re:I'll believe it when I see it.

[justsomebody]

Agreed, but you forget one thing about size. Source code has very good compression ration. Almost every time ratio is 10:1 or more which would mean 1-5 GB, and considering Fedora dvd image i'm downloading right now 3.7GB, well nothing special about the size.

Re:I'll believe it when I see it.

[trentblase]

I think this could be accomplished with dlls. And who said anything about "work" anyways?

Re:I'll believe it when I see it.

[justsomebody]

Damn, I just invented COMPRESSION RATION by mistake, can I patent that???:) If I don't SCO might sue me.

Re:I'll believe it when I see it.

[Chiron Taltos]

True ... it was point number zero.

Re:I'll believe it when I see it.

[Via_Patrino]

The index that's around says:
658114889 30915 files
that's 658MB, the size of a CD-ROM ?

Re:I'll believe it when I see it.

[highspl]

If you look at that 2.3MB file listing all the files in the distribution (along with the sizes), all the files add up to only about 660MB. I highly doubt that's the entire source.

Re:I'll believe it when I see it.

[Pentagram]

Hey, it's on /. - what more could you want? ;)

Re:I'll believe it when I see it.

[Duckman5]

It's just a guess, but from taking a look at that slide and a few others, I think that he is saying that the build environment requires 50GB. Which makes sense (OO.o requires like 2.4). I'm just having a hard time believing that the source alone could possibly consume that much disk space.

Re:I'll believe it when I see it.

[BeBoxer]

This slide indicates the full source is 50gb and took a week to setup and 2 hours a day to update.

The weird thing about that slide is that it indicates that the project is "29M LOC". Now, by my math, that indicates about 1,700 bytes of storage used per line of code. There has to be something artificially inflating the size, or decreasing the LOC. I mean, even assuming 170 character lines, that works out to 10 lines of comments for every line of code. I wonder if the 50GB refers to the size of the multi-version repository, or to just a single check out?

Either way, if the LOC is 6M for NT and 29M for 2K (numbers taken from the slides you linked), I can easily imagine it all fitting into a net-friendly sized zip file. Hell, my 2.4.23 tarball is about 29MB and has 3.6M lines (including comments) in the .c files. Multiply that by 10x and it's not even half an ISO image.

Re:I'll believe it when I see it.

[lantius]

Second point: The odds of getting one's hands on the full source to NT4/2K are slim to none--even most Microsoft folks couldn't do that. The code is probably scattered across multiple servers in Redmond, for starters, and you'd only be given access to the parts you needed to work with.

Actually, in my senior operating systems course (taught by Gary Kimura) we spent a quarter doing Win2k kernel development. The source we had wasn't anywhere on the order of magnitude of 50gb, as I recall, probably more like 6gb or so. We did plenty of grepping about for interesting things and making small tweaks in addition to our assigned projects. We certainly had enough to build a full system, but we mostly limited ourselves to the kernel, which is plenty of code in and of itself.

Of course, we signed fairly immense documents for Our Friends at Microsoft that gave them things like full and unhindered ownership of anything we created while having access to the source code. We also had to have the room with our workstations disconnected from the internet, and had to go outside to check our email.

Unfortunately, with all that access and opportunity, my group's project was to implement sparse clusters for FAT after completing the introductory assignment of logging file handles - which was harder than the same project I'd already done in Linux. It was hard to be excited about FAT hacking, but at least better than the folks who had to make modifications to the memory manager that had apparently already been made since garyk had come to the University from Microsoft.

Interesting anecdote from our adventures: when grepping the Linux source for swear words you'll find quite a plethora, and WinNT was once the same. When they submitted the source for government certification, however, they had to go through and clean it up! (We of course had assumed that the developers were all prudes.)

Mysterious future...

[avalys]

I clicked on this while it was in the Mysterious Future. After the site loaded, I saw a "this server is too busy to service your request" notice. When I checked back on the Slashdot main page (mere seconds after clicking the link the first time), the story had been posted publicly.

Give a whole new meaning to the phrase: "Slashdotted already!?"

There is no evidence listed

[PickyH3D]

Other than files being named stuff, there is no evidence.

I could easily name files "windowsxp.source.tar," but that means nothing.

Re:There is no evidence listed

[RealityMogul]

Breaking News:

A member of the Slashdot cult has admitted he has stolen the source code to Microsoft's Windows XP operating system. PickyH3D is the handle the low-karma hacker used when bragging of his accomplishment to the world. He has also issued a challenge to Microsoft's legal team with the statement that "there is no evidence". More on this as we hear it.

Re:There is no evidence listed

[PacoTaco]

That lucky bastard! I've had the OS/2 source code for months and the editors won't even post a link.

What's the big deal?

[Fluk3]

There's plenty of worthless spam on the internet already.

Re:What's the big deal?

[imbaczek]

If you're into kernel architecture, it might be interesting, but otherwise, so what?

The bugs.

Re:What's the big deal?

[myg]

Because I'm into kernel architecture. I wouldn't mind a peek... but man am I scared to do it just for the legal reasons (I've seen portions of the code for NT at an employer); but the whole thing would be interesting.

Alas, NTFS is the one area I would like to see and it doesn't look like its there.

The truth is in there

[Anonymous Coward]

OK lets see how much THEY'VE nicked from Linux.........

Instead of the sky falling...

[clifgriffin]

Maybe peer review will send a flurry of discovered holes to Microsoft for them to patch.

Maybe this will be positive for all of mankind!

Or maybe I'm crazy.

Torrent?

[Richard_at_work]

Anyone got a torrent yet?

Re:Torrent?

[thelasttemptation]

I want a ebuild!

emerge win2000

Re:Torrent?

[Falshrmjgr]

ROFL!!!!

chroot /mnt/win2k /windows/system32/ntkernel.exe

Re:Torrent?

[thelasttemptation]

Just wait till office leaks

USE="-clippy" emerge msoffice :)

Re:Torrent?

[Anonymous Coward]

You must either be new to Gentoo or new to Windows. It would most definately be:

ACCEPT_KEYWORDS="~x86" emerge win2000

Re:Torrent?

[entrager]

This right after an interview with Bram is posted in which he says BitTorrent is not anonymous....

Re:Torrent?

[ScriptFanix]

Destroy-your-gentoo-HOWTO :)

Re:Torrent?

[Pakaran2]

Shouldn't that be -x86?

Ok, probably wasting three karma here, but ++parent

Re:Torrent?

[Njovich]

And I thought compiling KDE's few million lines of code took long

Re:Torrent?

[Anonymous Coward]

Don't worry... We're safe. MS can't prove what you're downloading, because no one there can open a tar.bz2!

TAR!? BZ2?! What the hell? That's not ZIP!!!!

Re:Torrent?

[Sivar]

For those who haven't used Gentoo (why?), ACCEPT_KEYWORDS="~x86" means "emerge unstable software, even if it is known to be poorly tested."

Therefore, the parent was correct.

Re:Torrent?

[R4p70r]

TAR!? BZ2?! What the hell? That's not ZIP!!!!

Should be a CAB

For those that need more proof

[timdorr]

Full file listing with sizes: http://heim.ifi.uio.no/~mortehu/files.txt I suggest mirroring ;)

Re:For those that need more proof

[ps_inkling]

From the list of files...

0 11-18-01 14:25 win2k/private/security/msv1_0/subauth/words of wisdom from dennis.eml

0 11-18-01 14:26 win2k/private/windows/media/avi/msvideo.16/res/wor ds of wisdom from dennis.

0 11-18-01 14:27 win2k/private/windows/shell/security/rshx32/deadco de/words of wisdom from dennis.eml

I'm curious who dennis is, and what the words of wisdom were. Too bad the file is zero size in the list. It also appears several times in the file listing, always at zero size.

Maybe... nah, that's too cruel.

Re:For those that need more proof

[Anonymous Coward]

http://blogzine.net/~justinxb/files.txt Mirror

Re:For those that need more proof

[BaronAaron]

Well that doesn't really look like the entire code listing for Windows 2000... Even if it's legit....

This was interesting...

win2k/private/shell/shdocvw/

If it's real.. then someone has a good portion of the rendering engine behind IE....

Hmmmm.....

Also

win2k/private/shell/explorer/

Looks like there is the shell for windows also...

I don't see any kernel level stuff though...

Just a quick analysis though..

Re:For those that need more proof

[cethiesus]

Partial mirror if you just want to see the general idea of it (still 950k worth of text):

files.txt

Re:For those that need more proof

[say]

What is this:

win2k/private/inet/urlmon/iapp/gnumakefile
win2 k/private/inet/urlmon/mon/gnumakefile
win2k/priva te/inet/xml/xml/tokenizer/parser/gnumak efile

(and so on - many, many instances)

on the other hand, a few funny files:
win2k/private/inet/xml/xml/tokenizer/dll/w ords of wisdom from dennis.eml
win2k/private/inet/xml/xml/dso/letter to children - 2.eml

and VERY interesting:
win2k/private/ntos/w32/ntuser/kernel /

Re:For those that need more proof

[Morten Hustveit]

http://folk.uio.no/mortehu/files.txt is a much faster server.

Re:For those that need more proof

[scambaiter]

Well, Dennis Ritchie would make some sense, wouldnt it?;)

Re:For those that need more proof

[Thud457]

I guess that means this Dennis isn't very wise -- or doesn't have much to say. You make the call.

Re:For those that need more proof

[Zork the Almighty]

Another Mirror, gzipped this time.

Re:For those that need more proof

[PipianJ]

20475 07-26-00 03:06 win2k/private/windows/shell/games/sol/sol.c

AT LAST! The secret to beating Solitaire... This could perhaps be the most significant event of our times!

Re:For those that need more proof

[Soul-Burn666]

hmmm... these files seem familiar...

61072 07-26-00 02:12 win2k/private/inet/mshtml/build/scripts/tools/alph a/awk.exe
112672 07-26-00 02:12 win2k/private/inet/mshtml/build/scripts/tools/alph a/chmod.exe
65536 07-26-00 02:12 win2k/private/inet/mshtml/build/scripts/tools/alph a/grep.exe
58640 07-26-00 02:12 win2k/private/inet/mshtml/build/scripts/tools/alph a/kill.exe

Re:For those that need more proof

[Turmio]

Hmm...

$ cat files.txt | perl -e'while(<>){/^\s+(\d+)/ or next;$a+=$1}print"$a\n"'
658114889

Only some 600+ megabytes of stuff. Someone said there should be like 50 gigs of it. Who's right or is everyone wrong? Go figure.

Re:For those that need more proof

[panaceaa]

It's interesting to note that Internet Explorer (win2k/private/shell/iexplore/iexplore.rc) really is just a small sized shell application for Windows win2k/private/ntos/ based ActiveX controls. This means that IE's core functionality really is in the kernel and not an application with minimal ties to the OS.

It's also interesting that Windows Media Player isn't in the OS, though it's still bundled with Windows. I wonder if Real could use this to argue a monopoly case? But I've heard that Longhorn is going to have kernel-level 3D rendering and multimedia playback, so maybe that's going to change.

Re:For those that need more proof

[I confirm I'm not a]

Not quite as entertaining, but I spotted this:
0 11-19-01 00:31 win2k/private/windows/shell/accesory/

acce_s_ory? It's late here (GMT) but that looks odd? The whole thing smelt fishy...

Re:For those that need more proof

[Chester K]

What is this:

win2k/private/inet/urlmon/iapp/gnumakefile

win2k/private/inet/urlmon/mon/gnumakefile

win2k/private/inet/xml/xml/tokenizer/parser/gnum ak efile

What about it? It's not a violation of the GPL for them to use GNU Make to build commercial software.

Re:For those that need more proof

[Luke-Jr]

Looks like a remnant from the old 8.3 filename limitations...

Re:For those that need more proof

[shift1978]

For the gnumakefile, it is pobably because Internet Explorer existed in Unix few years ago.

Re:For those that need more proof

[damiam]

Consider the size of the Linux kernel + X + Mozilla + KDE/GNOME. 600 megs sounds a little small, but I wouldn't expect it to be much over a gig.

Re:For those that need more proof

[plaa]

A few more interesting ones:

win2k/bsc/.glimpse_filenames_index
etc.

Huh? What's with the "."? Are they using Unix?

win2k/private/inet/mshtml/src/site/download/pngl ib /
win2k/private/inet/mshtml/src/site/download/zli b/
win2k/private/inet/mshtml/src/site/download/jp glib 6a/
win2k/private/inet/urlmon/compress/gzip/

(AFAIK nothing illegal in using these, but interesting to know. Maybe the gnumakefiles are for these and similar?)

win2k/private/ntos/rtl/boot/i386/cv - vered mazafi.eml
win2k/private/shell/wontfix.txt
win2k /private/shell/docs/leak.txt
win2k/private/shell/ shdocvw/ofbugs.txt
win2k/private/shell/cpls/appwi z/todo

Interesting...

win2k/private/shell/ext/viruschk/
win2k/private /shell/ext/viruschk/mcafee/

Wha?

At least that list looks pretty damn convincing... If that list is a hoax its a pretty damn well made one.

Re:For those that need more proof

[Procyon101]

Yea. In fact, install IE 6 or so, then go get iexplore.exe from IE 3 or so. It will still run, and be a really funky hybrid.

Re:For those that need more proof

[RPoet]

And then there were those words of wisdom from mysterious Dennis. He must be a smart guy because there are *many* files with his words.

I'm guessing it's this guy. Washed-out 70's reggae artist goes to work for Microsoft, sounds credible to me.

Re:For those that need more proof

[sglane81]

AT LAST! The secret to beating Solitaire... This could perhaps be the most significant event of our times!

You must not know about CTRL+SHIFT+Click when you are playing in 3-card mode. That sequence will give you ... wait for it ... ONE card and will go through the deck three times like it does in 3 card mode.

I know I know... it IS sad that I know that.

Re:For those that need more proof

[antime]

Take a look at the bottom line. The files add up to about 650MB. Wanna bet this is just one from a set of backup CDs?

Another thing I found interesting (considering the age of the snapshot) is the presence of ia64 support.

Re:For those that need more proof

[the_mad_poster]

Seems about right. The compressed Win2k fits on a single CD-ROM. LinKernel + X + GNU Tools + Peripherals == 3 discs at about 1.7 gigs IIRC (it's been awhile since I dl'ed a full distro). Plus, bear in mind, this is the source code. You won't have graphics and sounds files and vid clips and all that tripe in it.

Re:For those that need more proof

[Dalcius]

No, just amusing, being that it's anti-American and all...

Re:For those that need more proof

[robhancock]

IE functionality is deeper in the OS, but it definitely is not present in the kernel. Things like shdocvw and mshtml are core components of the OS, but do not run in kernel mode.

Re:For those that need more proof

[ncr53c8xx]

win2k/bsc/.glimpse_filenames_index etc. Huh? What's with the "."? Are they using Unix?

Possibly. glimpse is a program that will create a database so that you can quickly search through all of your files, in UN*X.

Re:For those that need more proof

[eddy]

win2k/private/inet/mshtml/src/site/download/pnglib

If they're using pnglib, then how come png alpha supports is so fucked in IE? Deliberate?

Re:For those that need more proof

[TwistedSpring]

on the other hand, a few funny files:
win2k/private/inet/xml/xml/tokenizer/dll/words of wisdom from dennis.eml
win2k/private/inet/xml/xml/dso/letter to children - 2.eml

These look like a virus infection to me. They're spread all over the tree and they're all 0 bytes in size (just from looking at this listing). Seems as though whatever machine this code was ripped from has Nimda or something. I'm now uncertain as to whether this stuff is genuine. Looks like some guy burned it onto CD, then took it home to work on where he got infected with Nimda and didnt bother to scan for and delete the random .eml files it spreads. I can't believe any virus would be able to actually penetrate into Microsofts development tree without being killed off.

Re:For those that need more proof

[Mixel]

win2k/private/windows/shell/games/reversi/document ation of problems in stress.eml

O_o

About bloody time.

[noc007]

Looks like the server is ./ed

Re:About bloody time.

[funkhauser]

Well yeah, running ed as an HTTP server is bound to fail.

Or perhaps you meant /.ed?

New Licensing Model

[MADCOWbeserk]

GLL - General Leaked-Souce license

Simpsons mode equals one

[defile]

Ha ha!

Re:Simpsons mode equals one

[geschild]

I was going to say: "So that's what it takes to get an 'old-timer' to make a post!"

Then I decided to check your profile first and found out you've posted roughly three times as much as I have... Ayee, what have I done with my time! :-)

Must've not 'recognized' you for lack of .sig.

Great

[Gr8Apes]

Now we'll have all sorts of new viruses and worms....

Re:Great

[JabberWokky]

I was going to make a smart aleck remark about "no, only Windows users will get worms", but then I checked my mail, sorted by size, and deleted the hundred or so emails between 31k and 35k, all with the same five subjects. They may not replicate on Linux, but they are a pain in the ass anyway.

--
Evan

Re:Great

[Lovepump]

From http://itvibe.com/default.aspx?NewsID=1283
UPDATE @ 22:46:

Steve Ballmer, Chief Executive and President of Microsoft has said in a statement,

"I can assure you that we know there has been no compromise of the integrity of the source code; that it has not been modified or tampered with in any way."

It is probably the aquamark/watermark

[Srividya]

Among the programmers I know who use the Microsoft source code, if you the "diff", there are many very small changes between the source files. It is a question, are these changes intentional, and signed, and in a database. I would think yes, there is no other reason for it.

The leaking company will soon be identified unless the code was first changed in a very strong way.

Close you eyes!

[exhilaration]

...LEST YOU ARE CORRUPTED!!!

Seriously, don't look at it, you will no longer be considered "clean" and might become a liability to any project you work on.

Re:Close you eyes!

[djh101010]

This is actually very good advice. There's probably not a lot of "Wow, that's a great way to do things" in there, and you certainly don't want to be in the position someday of sitting in a courtroom with a bunch of MS lawyers, explaining how even though you downloaded a copy of it, the work you produced since isn't derived from their IP.

It wouldn't be the first company to pull someting silly like that, after all...

Re:Close you eyes!

[cuiousyellow]

Funny, I guess we both had the same thing come to mind...

Raider's of the Lost Ark

Eww.. melty eye balls.

Re:Close you eyes!

[AndroidCat]

Yeah, it's sort of like a touch of the Bog of Eternal Stench [Labyrinth]: "One touch and you'll stink forever!"

Re:Close you eyes!

[Anonymous Coward]

does it really matter? i mean maybe Microsoft wanted the source to leak so they can shutdown projects like wine(X), Samba and others in the same style as SCO is trying to with linux/IBM

anyway, i wouldn't even want to see the source code if it was strapped to a hot chick..

Re:Close you eyes!

[Bendebecker]

Funny, that's what my parent's said about porn. Only you need to replace company with 'nice girl' and 'liability to any' with 'impossible to get in pants of any'

Re:Close you eyes!

[anno1a]

I wonder... Does this go for GPL code as well? If I glance at a bit of GPL code and then at a later time write something that uses a smart trick used in that code, or something which resembles a piece of that code, then my whole project should be GPL? Or is it just that Windows is Evil and everyone who gets near their code becomes tainted and must now work for them?

Re:Close you eyes!

[exhilaration]

Good point. It's not that Microsoft is evil, it's that it has an army of lawyers ready to enforce its intellectual property rights.

So while "accidentally" borrowing GPL code might get you a bunch of angry e-mails from slashdotters leading you to apologize, borrowing MS code might have more painful consequences.

Wow

[1000101]

That was fast. //you know what I'm talking about

Leaky

[Earl The Squirrel]

Of course their source code leaks...they don't properly clean up their pointers....

Oh wait a sec...8-)

Just don't use the code

[Midnight Thunder]

What ever you do, don't let the code influence your projects. The last thing we want is Microsoft joining in with SCO and accusing the open source community of using MS code in an open source project such as Linux. Sure you probably wouldn't want to with its reputation, but I am sure there would be those who would be tempted.

Re:Just don't use the code

[aoteoroa]

What ever you do, don't let the code influence your projects

You beat me to the punch. This code leak could be a very good thing for Microsoft, and a trap for the open source community. I doubt that Microsoft intentionally planted this snare but if any future open source project even vaguely resembles this leaked code I have no doubt that Microsoft will open their full arsenal of lawyers.

Re:Just don't use the code

[SkArcher]

Exactly

In fact if you are involved with an Open Source project (especially Kernel and Window Manager projects) I suggest you do everything possible to avoid seeing this code.

Accusations of Taint are undoubtedly going to spring up from this, and you would be better to be well clear.

I will confess to a certain curiosity as to what the results of a comparator test would be though.

Re:Just don't use the code

[acousticiris]

Yeah... I can see it now.
"Microsoft is suing end-users of Linux due to the discovery that the latest version of the kernel incorporated Windows 2000 code. The discovery of the code theft was made after someone at Microsoft plugged a USB scanner into a system running the latest Linux kernel and received the Blue Screen of Death."

Re:Just don't use the code

[Boing]

don't let the code influence your projects

And to clarify, this means DO NOT LOOK AT THE CODE. A court can say that anyone who has seen the code has let it influence their future works, even if that influence was unintentional.

Re:Just don't use the code

[cybermace5]

*** CONSPIRACY THEORY BEGIN ***

I remember someone on here, a while back during one of the SCO stories, wondered what would happen if Microsoft released the source code, but under such a devious license that contamination would be fatal to an open-source project.

Maybe someone at Microsoft thought that was a neat idea.

*** CONSPIRACY THEORY END ***

As far as looking at the code: the only real reason to examine it is to find new exploits. No developer is going to slave over that source in order to find bugs and repair them, since there is no legal way to do it.

Re:Just don't use the code

[happyfrogcow]

[sarcasm]Yes, and I will not let my 12th grade math influence my understanding of cryptography either...[/sarcasm] You had it right in your subject, but wrong in your body. Don't use the code. But if you learn something from it, some technique to modify bits a little different, why not let that influence you? It's all math eventually anyway.

If this stuff was "trade secret" it's not anymore, and there's nothing they can do about it.

Re:Just don't use the code

[erobertstad]

Allthough this could go both ways. I wonder how many lines of code under the GPL is in MS's software. It'd think it's more likly that MS has used code that was GPLed then people using buggy MS code in their open source projects, now we just need to find it. :)

Re:Just don't use the code

[Anonymous Coward]

After reading the code, if the influence
proves rather negative, can we sue them ?

Re:Just don't use the code

[Keitero-sama]

".. I have no doubt that Microsoft will open their full arsenal of lawyers." Those wouldn't be those "lawyers" from that episode of the Simpsons with Bill Gates now would it? Cause I fear them more than the former. >_

Re:Just don't use the code

[zurab]

if any future open source project even vaguely resembles this leaked code I have no doubt that Microsoft will open their full arsenal of lawyers.

Like a significant part of BSD code that many systems share? Maybe MS is/was just testing waters with SCO.

Re:Just don't use the code

[prockcore]

And to clarify, this means DO NOT LOOK AT THE CODE. A court can say that anyone who has seen the code has let it influence their future works, even if that influence was unintentional.

What? What court would say that? That's like saying that anyone who has seen Gone with the Wind has let it influence their future works.

Re:Just don't use the code

[grumpygrodyguy]

What ever you do, don't let the code influence your projects. The last thing we want is Microsoft joining in with SCO and accusing the open source community of using MS code in an open source project such as Linux. Sure you probably wouldn't want to with its reputation, but I am sure there would be those who would be tempted.

Look isn't it time we built an encrypted, untraceable P2P based infrastructure(like freenet) so we don't all piss our pants every time we hear the word lawyer?

Let's cut the "fair use" bullshit and get on with the program.

Re:Just don't use the code

[77Punker]

Don't even mention the KDE BSOD screensaver!

Re:Just don't use the code

[whittrash]

Who will they sue? Who can they sue?

Re:Just don't use the code

[ab_iron]

The worst that could happen is that someone would do a code review and fix it.

Re:Just don't use the code

[statusbar]

How can you prove that you DID NOT see the source code? What's keeping you from being accused anyways?

--jeff++

Re:Just don't use the code

[kjd]

Accusations of Taint are undoubtedly going to spring up from this

Yeah. I got a 4-inch taint.

(Fuck yeah that wide!)

Error message

[Rosco P. Coltrane]

Neowin Message
The server is too busy at the moment. Please try again later.

Yep, looks like an error. Must be real Windows code then...

Maybe they will rethink Open Source...

[viper21]

Microsoft just needed a push in the right direction, right?

-S

Re:Maybe they will rethink Open Source...

[garcia]

forcing everyone to now use Longhorn because the security holes in NT/2k based OSs (XP) will be sky high?

Not only will they be able to claim that any Samba project is tainted they will be able to claim that everyone must upgrade to their latest OS not based on NT/2k code.

Sounds like a money-maker.

Mirror?

[Dark Paladin]

Anybody seen a mirror yet? I tried looking at the article before Slashdot even posted it, but I'm guessing there was some sort of n-dimensional Internet traffic, since the article was unavailble before slashdot readers should slashdot it.

Good lord - we have the ability to impact sites in all possible times and places - the clicks so numorous is overwhelms the very fabric of space and time and overwhelms a server before a link is posted.

Oh darn...

[Supp0rtLinux]

Well, looks like the server that got linked couldn't handle all the /. traffic. But just based on the post, did we not all think this would happen sooner or later? Knowing M$, they'll probably use this is proof as to why they shouldn't show their code. After all... governments use it. What if it gets out? Heaven forbid some Linux guys take it apart and make it better. :)

Damn....

[robpoe]

Now, we can see how tightly integrated Internet Exploder is into the OS...

Oh, say...If the code to IE is REALLY in there, can we have some smart, talented hacker PLEASE fix all those stupid security holes (and .. possibly some of the broken bugs too)?

Oh yeah..That's right..It's called Firefox, eh?

One a related note

[ackthpt]

On a related note, Microsoft is reporting the number of bugs in Linux to have surged in recent weeks, thus proving Intellectual Property theft.

Seriously, the previous article lambasting open source for being vulnerable is nothing when compared to eyes backed with malicious intent poring over Windows source code for new exploits. So much for security through ignorance.

Re:One a related note

[4of12]

It's a trick for getting a free security audit.

Recall a recent story where the code security auding project for Linux shutdown due to lack of activity.

This kind of code release from MS is going to get orders of magnitude more auditing than Linux did. WinNT/2K will get up into the big leagues with OpenBSD as far as having been through a code security audit.

But I wonder how patches will be handled?

Re:One a related note

[ackthpt]

This kind of code release from MS is going to get orders of magnitude more auditing than Linux did. WinNT/2K will get up into the big leagues with OpenBSD as far as having been through a code security audit.

Sure, but who will audit the auditors? Where's their accountability? I certain some well meaning Microsoft supporters will tell the company of bugs (best be sure they don't reward you with some jail time), but I expect most won't be publicly revealed. This is the kind of thing, if it's backed up, and it looks like it is, which will get big press and do billions of dollars damage to Microsoft stock. How do you suppose they will handle damage control?

But I wonder how patches will be handled?

Oh, the usual way, as attachements to email with forged addresses sent from zombies.

Oh boy...

[BrianGa]

From the site: Please try again by pressing the refresh button in your browser.
Oh boy...

Fortune

[Tom Rothamel]

The funny thing is the fortune that appeared in the appropriate slashbox when I first saw this article.

"Never trust an operating system you don't have sources for. ;-)
-- Unknown source"

Re:Fortune

[Alsee]

Never trust a fortune with unknown source.

-

Re:Fortune

[ahaning]

Also,

Never use a preposition to end a sentance with.

Re:The shit will hit the fan + Mirror

[Dr Reducto]

My formatting was fucked up, but Ill repost without the Mirror, since everyone else posted the mirror:

The server is already slashdotted, but I think this is major if it is true. Microsoft's legal dept is probably planning an all-nighter tonight, and will be working in shifts to frantically sue people who are connected in any way with this.

If this is true, the shit will definitely hit the fan. I wonder how this was done. The IP contained in Win2k/NT is worth BILLIONS(arguably). They obviously would have some serious security on it.

On a lighter note: When will we see some tricked out Windows 2000 "Distros"? ,Could this potentially help the WINE Project?, Is anyone working on replacing IE with Konquerer?, Will this be able to help the effort to make driver "wrappers"?

Mirror With Comments

[RPoet]

Mirror with comments.

Hope it's all just a bluff.

Re:Mirror With Comments

[RichMan]

You have commented all that Microsoft code already. Holy Crap that is fast.

Re:Mirror With Comments

[pjrc]

Link "litigious bastards" to www.sco.com on your webpage!

Or better yet, update your link and sig to www.thescogroup.com, the litigious bastards.

Re:Mirror With Comments

[__aafutm5472]

You have commented all that Microsoft code already. Holy Crap that is fast.

Well, it's not that hard when you think about it. His comments are largely thus:

(some code here) /* This is crap. Just taking up memory */
(more code) /* Again, more crap. */
(yet more code) /* Oh here's something new -- crap */

Fertile Ground for Foul Play

[vijayiyer]

I guess Windows is now "Fertile Ground for Foul Play" too, like W. Russell Jones claims (from the last article)

Re:Fertile Ground for Foul Play

[thelasttemptation]

NOPE! The hackers already had the code, hence all the problems. Hence releasing it doesn't hurt cause they already had the code! :P

Code

[daeley]

...Windows 2000 and Windows NT source code has been leaked to the internet.

The Internet, however, being a polite sort of fellow and completely undesirous of the undoubtedly horrible ramifications of having such a beastie running around loose, gently replaced the source code and gave Windows a friendly pat on the head.

Nothing new ...

[Mr. Mai]

Great! this will now confirm what we all know ... How insecure it really is!

Do NOT read that code!

[AuMatar]

Do NOT read that code if you ever wish to program for an open source OS, ever. Doing so will make you tainted- you open the project up to allegations of copyright infringement. Unless you never want to contribute a single line to Linux, *BSD, etc, checking out that code is a bad idea. Its almost a surprise MS didn't "leak" Win 95 or 3.1 years ago to catch open source developers like this.

Re:Do NOT read that code!

[Samari711]

oh take off the tinfoil hat already.

that's like saying the beatles can sue every musician who ever listened to them for copyright infringement

Re:Do NOT read that code!

[TekPolitik]

Do NOT read that code if you ever wish to program for an open source OS, ever...

Of course those of us who are also lawyers can safely read other peoples' code, because we know exactly what to do to avoid infringing. It is possible to extract knowledge from the code without breaching copyright, but...

Getting a copy of the code at all is a breach of copyright.

Re:Do NOT read that code!

[geekoid]

gee thanks. Of course, you could also refrain from putting "studied leaked Microsoft code" on ones resume.

If MS intentionally let there code into the wild, the run a very high risk of loosing there rights to it.

Re:Do NOT read that code!

[GoofyBoy]

>Its almost a surprise MS didn't "leak" Win 95 or 3.1 years ago to catch open source developers like this.

Please, you are talking about sacrificing the source code for NT and 2000 just to hold off OpenSource projects, which WILL happen eventually regardless of what lawyers say. They can't stop every comptuer science student out there from writing and giving away programs.

The number of virus created and holes which will be found (now and years in the future), IF this is true, will almost destroy any IT administrator to a weaping mound of tears and make them seriously consider moving to Linux/BSD/Mac.

Moving to XP won't help because this could happen with that code also.

So, IF this is true, this MIGHT be more damaging to MS than the Dept of Justice thingy from years ago. Not something MS would want to do on purpose no matter what they think about OpenSource.

Re:Do NOT read that code!

[cmowire]

That's not entirely in the tinfoil zone.

The basic problem is that if it's clear that you have viewed the source code and make substantial contributions to a project that competes with Windows, MS will be able to, without being laughed out of court, at least file a lawsuit against you and ruin your day.

The correct analogy is sampling large portions of a beatles song or performing your own rendition of it. If you try to record a beatles song and sell it, you had better pay the proper song royalties or you will get sued.

I'm really fascinated about, if this turns out to not be a lie, the long-term ramifications of this. It's a can of worms that you can't undo. Its impact on the number of security holes, any commentary by third party sources, etc. will be most interesting. Especailly given that it's probably reached areas already where it doesn't have the sort of protections that it has under US laws. ;)

Re:Do NOT read that code!

[AuMatar]

This isn't a tinfoil hat, its copyright law. This is a common situation in law where people switch to work at competitors. There's lawsuits over this all the time.

Re:Do NOT read that code!

[TioHoltzman]

plus 5 Insightful???? WTF? Take off the tinfoil cap first.

Re:Do NOT read that code!

[Planesdragon]

you open the project up to allegations of copyright infringement.

Correct, in a way. But all that means is that if MS wants to argue and scream, it takes a little bit longer to have the court shut them up.

Copyright ISN'T absolute. There's a reason why, for example, so many movies follow the same formula.

Re:Do NOT read that code!

[aoteoroa]

It is possible to extract knowledge from the code without breaching copyright, but...Getting a copy of the code at all is a breach of copyright.

Sorry for sounding like an idiot but could you clarify that for me. On one hand you say it is safe to read copyrighted code, on the other hand it isn't.

It sounds like you are saying that there are some instances where you can read copyrighted source code and still write your own code for a similar project and be legally safe. But in this instance simply having a copy of microsoft's code without signing their NDA first is a breach of copyright and would put a person at risk. Is this correct?

I must admit that I am curious to see the Windows source, and since I write network apps in java & delphi, not operating systems in C my software is not likely to be tainted by it.

Re:Do NOT read that code!

[Kilobug]

Copyright is NOT patent. It protects code, not idea or structure.

You can read GPLed source code and then use the knowledge you gained from this to create a non-free alternative. The same way, if you have legal access to Windows source code, you can read it and then later write by yourself something similar. The same way you're allowed to read Lord of the Rings and then write a fantasy story of two small guys sneaking into the territory of the Ennemy to destroy His weapon. You're not allowed to copy/paste or clone copyrighted work unless you follow the license, but you're allowed to read it and then do something similar.

Since reading Windows souce code is illegal, you can be sued if you do it. But not the code you'll write after. Copyright protects source code, not ideas, not data formats, not algorithms.

Re:Do NOT read that code!

[Samari711]

i think my analogy in context of its parent makes sense. the parent sound like the mere act of viewing the code forever infects you with microsoft code and you can never make any contributions to any open source project ever again (talk about viral). obviously copying code from windows into linux would be a big no no, but to just looking at it does nothing.

to further my analogy a little bit, say a beatles song uses a C G D chord progression and i've written a song using the same progression i'm still safe even if i know that i'm using the same chord progression so long as i didn't take it from the beatles. i could either have come up with it on my own messing around or been shown it elsewhere.

Re:Do NOT read that code!

[MenTaLguY]

that's like saying the beatles can sue every musician who ever listened to them for copyright infringement

I personally think it's a bad analogy, but even that isn't as far-fetched as you might think.

George Harrison (of Beatles fame) was succesfully sued for _subconsciously_ ripping off the song "He's So Fine" (in "My Sweet Lord"). See here for more details.

So, no, I don't think worrying about IP contamination from looking at Windows source code is paranoid at all.

Re:Do NOT read that code!

[happyfrogcow]

The correct analogy is sampling large portions of a beatles song or performing your own rendition of it. If you try to record a beatles song and sell it, you had better pay the proper song royalties or you will get sued.

Yet if I learn to play guitar by among other things, listening to all of the Beatles songs and playing along, do the Beatles own the rights to any future song I write? Goddamn hell freakin no! How is that any different from learning things from viewing MS, or any other persons code?

I've learned to code by doing all sorts of things over the years. Among them, learning from coworkers code. Applying that knowledge at my current job doesn't make the propoerty of my current employer a derivitive work of my employer from 5 years ago, even though I had access to the source code of that previous job.

Re:Do NOT read that code!

[mangu]

The correct analogy is sampling large portions of a beatles song or performing your own rendition of it.

Right. In order to do a copyright infringement you would have to copy large portions of source code. Just looking at the code and writing int n; isn't enough.

Re:Do NOT read that code!

[G27 Radio]

It's one thing if there's an NDA involved. But if there isn't, then I don't see how Microsoft could tell people what they can and can't write.

Re:Do NOT read that code!

[AuMatar]

But the act of reading the code is illegal. If you read it, and then produce code that they can claim resemble their code, they can get you as a derivative work of their source code. Derivative works are covered by copyright law.

Re:Do NOT read that code!

[cmowire]

True. And I'm not saying that I entirely disagree with you here because these sort of arguments degenerate into absurd statements no matter how you slice and dice them. ;)

However, a good way to differentiate between inspiration and copying, especially given a bunch of relatively dumb existing laws and precedents, is one of the biggest, most obnoxious issues that needs to be dealt with.

It gets sticky even for music when they try to determine where a fair-use sample begins and where a blatant rip ends.

Re:Do NOT read that code!

[rewt66]

... and not trade secrets. Whatever trade secrets Microsoft claims in its code (at least before XP and 2003), they're gone now.

The patents thing is interesting, though - Microsoft does have some patents, and implementing similar code could get you into patent infringement.

But, as someone noted earlier, it's illegal (copyright infringement) to grab this code in the first place.

Re:Do NOT read that code!

[prockcore]

George Harrison (of Beatles fame) was succesfully sued for _subconsciously_ ripping off the song "He's So Fine" (in "My Sweet Lord"). See here for more details.

So, no, I don't think worrying about IP contamination from looking at Windows source code is paranoid at all.

That's because He's So Fine is a catchy tune and it got stuck in George's head. There's nothing catchy sounding in the windows source. Looking at it won't make you subconciously overflow buffers.

Re:Do NOT read that code!

[grumpygrodyguy]

Do NOT read that code if you ever wish to program for an open source OS, ever. Doing so will make you tainted- you open the project up to allegations of copyright infringement

Look isn't it time we built an encrypted, untraceable P2P based infrastructure(like freenet) so we don't all piss our pants every time we hear the word lawyer?

Let's cut the "fair use" bullshit and get on with the program.

Re:Do NOT read that code!

[poot_rootbeer]

Getting a copy of the code at all is a breach of copyright.

IANAL, but don't copyright breaches involve distribution of materials, and not mere possession of them?

Remember, the RIAA didn't nail those children and old people for DOWNLOADING music, but rather for SHARING music they had downloaded previously.

Re:Do NOT read that code!

[ManxStef]

Hehe, you think that's worrying? How about the case of Mike Batt (of the UK childrens' TV animation "the Wombles" fame) being sued for alledgedly plagiarising John Cage's composition "4'33" - which consisted of four minutes and thirty three seconds of... silence! His track was one minute of silence and, presumably as a joke, was credited to Batt/Cage, which is probably what the frenzied lawyers jumped on to kick off the lawsuit.

Mike paid out an alledged six figure sum in an out of court settlement to the John Cage Trust, shocking stuff! You can read the CNN coverage here and also at ChartAttack. Sometimes the truth really is stranger than fiction ;)

Re:Do NOT read that code!

[Aneurysm9]

Read 17 U.S.C. 106. Copyright holders are granted six exclusive rights: reproduction, making derivative works, distribution, public performance, public display, and digital audio transmission. Obviously, some of those only apply to certain media (more fully detailed in 106) but it is clear that to even obtain a copy via the internet you must make a copy. Now, if someone were to hand you a CD with the code, you might not be infringing, but you would as soon as you stuck the CD in your computer and did anything with it since the courts have this stupid view that copying an executable into RAM to run it is a reproduction and copyright infringment if you are not properly licensed to do so. See MAI Systems Corp. v. Peak Computer, Inc., 991 F.2d 511 (9th Cir. 1993).

And, just as a point of clarification, the RIAA could have nailed people for downloading music or for uploading. The only thing we know from their press releases is that they were targeting people who were sharing, but since things haven't proceeded to trial in any case we don't know what was really going on.

Re:Do NOT read that code!

[peksik]

Yet if I learn to play guitar by among other things, listening to all of the Beatles songs and playing along, do the Beatles own the rights to any future song I write? Goddamn hell freakin no! How is that any different from learning things from viewing MS, or any other persons code?

How about if you happen to get yourself a copy of the sheet music (that has not been officially released) ? I think this is a more accurate analogy.

Re:Do NOT read that code!

[cheekyboy]

yeah right, like reading about directx source will be usefull for apache.

Re:Do NOT read that code!

[AuMatar]

Is Apache an open source OS? No? Then maybe you should reread my post.

Re:Do NOT read that code!

[glk572]

Read it, just don't tell anyone you did.

Re:Do NOT read that code!

[whittrash]

How do you explain Oasis!

Re:Do NOT read that code!

[TekPolitik]

It sounds like you are saying that there are some instances where you can read copyrighted source code and still write your own code for a similar project and be legally safe. But in this instance simply having a copy of microsoft's code without signing their NDA first is a breach of copyright and would put a person at risk. Is this correct?

This is correct, but they're different risks.

If you look at code, and make use of the knowledge you find it, then if you have sufficiently strong knowledge of copyright law you can avoid your new code being subjected to copyright problems.

However, if you don't have a license to the source code, then making a copy is itself an infringement. That includes downloading it. The consequences aren't normally as serious as putting somebody else's stuff in your code, but you can still get sued. You might also be required to disgorge any profit you make that flows from the infringement.

Now a third scenario - say you know somebody who has a copy. They've breached copyright by doing that. But say they have loaded it in any one of the many editors that retains the source code in memory. If you peruse the file in that editor, you will not be doing anything illegal. If you have sufficient knowledge of copyright law you can make use of knowledge discovered by this means. And then Microsoft couldn't touch you (they could try a trade secret claim, but if the story is true then the trade secret would basically be gone).

Re:Do NOT read that code!

[freeze128]

The number of virus created and holes which will be found (now and years in the future), IF this is true, will almost destroy any IT administrator to a weaping mound of tears and make them seriously consider moving to Linux/BSD/Mac.

I'm already a weeping mound of tears and I am seriously considering becoming a BOTANIST!

Re:Do NOT read that code!

[wolf-]

Man A reads code.
Man A documents ideas, processes.

Man B reads ideas, processes.
Man B writes new code.

However, throw tainted code for Man A to read into the mix, and you need to hire an army of attorneys.

Re:Do NOT read that code!

[Tom]

Oh, please. Stop posting such bullshit.

If reading something would "taint" you and prevent you from ever writing something similiar again, then there would be no books because no author could write something without considering the potential lawsuits from every book he ever read.

Copyright specifically refers to the act of copying, not to applying skills and knowledge no matter where you gathered them.

Re:hmm seems a bit buggy

[fishbowl]

It *amazes* me that it hasn't been routine.

Windows source code is not some deep dark secret that is locked in a vault, only let out during builds for the product releases.

*MANY* people have access to the Windows source code. A number of people in my own university have it. There are strict licensing considerations, but when has that ever worked before? Surprisingly, none of the people with source access has ever pulled off the stunt where it's broadcasted. I have always wondered why.

error.h

[sarice]

We all know the real valuable stuff is in error.h.
So, what does it say?

Re:error.h

[gohai]

ahahaha, mod parent up!

Re:error.h

[fredrikj]

Apparently that's where they put main()

Re:error.h

[SamSim]

I couldn't read it. There was some kind of error.

Re:error.h

[dmeranda]

/* Copyright FSF^H^H^H SCO Group */
#define EABORT 1
#define ERETRY EABORT
#define ECANCEL EABORT
#define EADMIRAL_PROTECTION 4
#define EGENERAL_PROTECTION EADMIRAL_PROTECTION
#define EBLUE_SCREEN 5
#define ELOCKUP 6
#define EPIRACY_DETECTED 7
#define EEND_OF_LIFE_TIME_BOMB 8
#define EINVOKE_CLIPPY 9
#define EI_WISH_I_WERE_LINUX 10

Article +1 Ironic

[Samari711]

right after a story that was about open vs. closed source

Re:Article +1 Ironic

[Samari711]

you know if you're going to be a grammar nazi, you should at least know what you're talking about

an article about how wonderful open source security is following one about how superior closed source security is wouldn't be ironic because one could see it as a reasonable next occurance and could possibly be expected. the last thing most people would expect would be to see that the world's most well known piece of closed source software had a code leak and is now less closed; situational irony.

So is this the beginning of something...

[freerecords]

as this source code is now out, can we expect people in the wine project to start using it as a basis for their coding. I'm sure it would provoke a legal battle of the SCO type (but with reason this time) but surely with a bit of clever coding and a bit of reference to this code wine could be advanced very far. Sure it's illegal, but so have many things Microsoft has done. I haven't been able to get through to that link (/.ed). This source code could, theoretically, be a big step for ReactOS and the WineX and Wine projects particularly as it is 2000 which has support for a lot of the stuff that NT does.. very exciting!

Re:So is this the beginning of something...

[webroach]

Sure it's illegal, but so have many things Microsoft has done.

I'm not sure that kind of justification really works. It also doesn't help the open source community, IMHO. I can't agree with the "let's sink to their level" philosophy.

Re:So is this the beginning of something...

[thelasttemptation]

Hell no! NO wine/winex/reactos/programmer should even click on any link anywhere near where tehy might find the source code. THEY CAN NOT LET THIS EFFECT THE WORK!

Talk about killing the programs, who's gonna pay the legal bills when MS sues the shit out of the projects and everyone who's a dev? Esp when it's a clear cut case that they ripped it? You?

No, no dev will go near this ever...

Re:So is this the beginning of something...

[damiam]

Anyone who looks at that source is pretty much legally prohibited from ever writing a line of remotely related code for any project. If Wine attempted to make any use of this leak, it would immediately become illegal in the US, EU, and most other copyright-enforcing countries. Probably no one would bother the users, but anyone redistributing it (or developing it) in the US would be cracked down on.

Who

[read-only]

It will be very interesting to follow this and see who was responsible for the leak, if that is even possible. I'm guessing that Microsoft will blame someone rather than remain silent.

Could it be someone who had access to the code under NDA?

Thoughts?

So much for security through obscurity

[Anonymous Coward]

This pretty much destroy's any argument that Windows is more secure because "the bad guys" can't look at the source code. And yet it won't get the positive aspect of "the good guys" reviewing the source code for bugs as it is illegal to make a copy of the code without a license to do so.

Re:So much for security through obscurity

[Anonymous Coward]

Just remember, eEye doesn't have access to the code and they have been sitting on exploits for months.

Source helps, but it isn't everything.

Does anyone else just get a tingly feeling seeing this article sitting on top of an article on Open Source being less secure because of it's openness?

Re:So much for security through obscurity

[Monkelectric]

Could this be a ploy to spur Win2k+3 updates? Blame the hackers for making win2k insecure. Oops you gotta upgrade now, sorry,

Re:So much for security through obscurity

[Dr Caleb]

So, when do you figure SCO will find their intellectual property in it?

Re:So much for security through obscurity

[CaptBubba]

Windows XP is based on the Win2k kernel IIRC. Assuming that code is part of what got leaked everything after Windows ME could be in for a world of hurt.

Re:So much for security through obscurity

[Pakaran2]

In all seriousness, they wouldn't dare. If they turn MS against them, they're asking to get reamed completely, and not just in the courts.

MS could buy them up with a month's revenue.

Re:So much for security through obscurity

[Eraser_]

Never. Remember Microsoft is currently their big supporter, a long with Sun Microsystems? They both took out large contracts with SCO at the beginning of the whole lawsuit business. Both companies know they could sue for damages later (against who? I don't know.) since the contracts could be seen as invalid. "You sold us this product under the guise we were required to buy it, but that's not true".

Re:So much for security through obscurity

[mwheeler01]

win2k+3? wow that's much easier that typing win2003...I don't care mod me down, abreviations and acronyms have gotten out of control!

Re:So much for security through obscurity

[r_j_howell]

If I remember correctly, They've already done that one. Back when they were caldera.

Re:So much for security through obscurity

[RancidBeef]

MS could buy them up with a month's revenue

Oh goody, then MicroShaft would own UNIX

When this is all over and everyone is picking over the bones of SCO's corpse, I hope IBM or Novell or someone who might open source most of UNIX will wind up with it.

(Sorry for the OT post. [-- no I'm not!])

Re:So much for security through obscurity

[mattdm]

Could this be a ploy to spur Win2k+3 updates?

Not likely -- it's not like they rewrite everything from scratch. Or very much of *anything*. There's probably DOS 1.0 code in there somewhere still. There's a good chance that flaws in the old versions will exist for a long time.

Re:So much for security through obscurity

[gotem]

but the bad guys WROTE the code.

Re:So much for security through obscurity

[The Lynxpro]

Never. Remember Microsoft is currently their big supporter, a long with Sun Microsystems? They both took out large contracts with SCO at the beginning of the whole lawsuit business. Both companies know they could sue for damages later (against who? I don't know.) since the contracts could be seen as invalid. "You sold us this product under the guise we were required to buy it, but that's not true".

So, all we need is an over-ambitious green-thumb attorney straight out of lawschool to discover this and bring it out in the open and force the hands of Microsoft and Sun to sue SCO out of existence over it so neither company "appears" guilty in the eyes of the SEC and class action lawsuit specialists. It could be the IT adaptation of the book/movie "The Firm."

Re:So much for security through obscurity

[rsmith-mac]

2000 is still well supported, so that idea is at best +1 Conspiracy.

Re:So much for security through obscurity

[MrChuck]

Um, MS used to own a large chunk (1/3?) of SCO in the the late 80's/90s.

When I was cursing it (Xenix) my friend at MS says "Well of course it sucks. It's MS's way of demoing to our customers why they want Microsoft OS/2"

Re:So much for security through obscurity

[Anonymous Coward]

I prefer win3*23*29+2

Re:So much for security through obscurity

[diersing]

If its true (conspiracy theorists) that MS was behind the 50M cash investment into SCO a while back, then its possible MS is trying to provoke the playgournd wimp into picking a fight with the Big Blue bully for the sole purpose of being there first after getting his ass kicked. Its not out of the realm of possibility that the MS world domination plans include purchasing UNIX IP just to burn it in some pagan ritual.

Re:So much for security through obscurity

[Ralph Wiggam]

No way. If they say "You have to upgrade right now because we screwed up...that'll be 100 bucks per machine". Big companies would tell them to shove it and then sue.

-B

Re:So much for security through obscurity

[anactofgod]

Maybe the source was "leaked" because MS is so tired of people claiming it's OSs are inherently insecure, when in reality the exact opposite is true. With the proof floating out there for all to see, this silly argument against WinOS can finally be put to rest.

Naaaaa....

--anactofgod---

Re:So much for security through obscurity

[Jeremi]

MS could buy them up with a month's revenue.

I thought getting bought out was SCO's goal?

Re:So much for security through obscurity

[zangdesign]

Could this be a ploy to spur Win2k+3 updates? Blame the hackers for making win2k insecure. Oops you gotta upgrade now, sorry,

Not a very effective one, then. The key component - Windows Update - still fetches from the same place each time, and unless someone manages to fool that program into downloading from some other source, it's not a big problem.

The bigger issue here is the release of code that Microsoft may have licensed from third parties that they were not supposed to reveal, as well as the release of their own IP. I imagine someone's or some institution is going to be in a world of hurt if MS ever finds out who did it. Not terribly likely, but possible.

If it were me who did it, accidentally or on purpose, I'd be on a jet to some foreign country right now.

Re:So much for security through obscurity

[homer_ca]

No, it's the same codebase. Big parts of it are rewritten for every release and new parts are written from scratch to support new features, but a lot of it is the same. How else do you explain that most of the security bugs affect every Windows NT version from 4.0 to Server 2003? They were rewritten from scratch with the same mistakes?

Re:So much for security through obscurity

[banzai51]

Actually, this would prove it. It would debunk the OSS arguement that you are more secure when you're code is available.

So who are you rooting for now?

Re:So much for security through obscurity

[Cryptnotic]

I prefer Windows 666*3+5.

Re:So much for security through obscurity

[RoLi]

Actually when you look at the security track record, WinNT/2K/XP is already in a world of hurt compared to Win9x.

Blaster was the biggest worm - ever. And it worked only on NT, not on 9x...

That Windows 2000 (or NT or XP) is "more secure" than Windows 98 has been repeated so often that most people started to believe it, even though the security track record shows the reversed situation.

Re:So much for security through obscurity

[Pharmboy]

Actually, I think it would be funny to see the open source community release a security patch for win2k before Windows does, proving that open source is more secure since it can be patched faster with more eyes looking at it.

Of course, MS would flip out, call it an exploit, and have the next patch uninstall it, since any patch for MS products that do not come from MS "can't be trusted". Another reason I like Linux more and more every day, not having to rely on a single company for patches.

Re:So much for security through obscurity

[Fizzog]

Adding Microsoft to the SCO mix would make no difference whatsoever.

IBM's legal team make Microsoft's look like first year law students. IBM's lawyers held the DoJ at bay for DECADES. Not even Microsoft are prepared to mess with IBM. The moment IBM called SCO's bluff SCO knew they were dead.

And if Microsoft could buy them with a month's revenue imagine what IBM could do. They are a little bit bigger than Microsoft you know...

I just think it's funny that IBM were everybody's worst enemy in the 70's and 80's, and now they are usually the ones doing the right thing by the industry.

Re:So much for security through obscurity

[Pharmboy]

If that was the case, they could have just made a hostile bid for the stock back when it was a buck or two per share. Besides, they used to own a big chuck of sco and sold it.

Re:So much for security through obscurity

[PetiePooo]

Catch up.. The $50M investment was a venture capital offering funded largely by RBC Centura. That's old news.

Re:So much for security through obscurity

[SabrStryk]

While it might be true that WinNT and its descendants aren't really more secure, you really should keep in mind that there are more "serious" machines that run WinNT-based product than Win9x. Without accounting for that, you can't really assume that WinNT is less secure.

The other thing to keep in mind is that XP has been on the market for 2 years. If it hasn't done so already, it probably will outnumber functioning machines running the older code. Therefore, any virus/worm authors wanting to do more damage should target WinNT systems.

Re:So much for security through obscurity

[puck71]

I'd say that's misleading at best. The reason there have been more worms/virii/etc. that attack 2000/XP than 9x is purely numbers. There's so many more computers running than 2000/XP than 9x, why bother writing any kind of worm that targets 9x?

Coincidently, this is also one of the key reasons that there are more worms/virii released that target Windows than Mac or Linux - why target Mac or Linux when you can target Windows, with many, many times more users?

Re:So much for security through obscurity

[cps42]

Windows Update clients are hardly secure if you happen to modify the registry of the client system to use a differenet "WindowsUpdate" server...

Re:So much for security through obscurity

[benna]

You know its very interesting. This has just gotten released into the regular warez scene. Some group pred it on a bunch of sites. its called Windows.2000.Source.Code-iND. But anyway, i requested it be sent to a site im on. Imediatly one of the siteops said, "if that request is filled, i'll seriously leave." many others agreed with him. It seems at the very top of the scene, in the irc channel im in, curries and siteops are making a moral arguement NOT to move the source. When I asked what the big deal was, the siteop responded, "think about it, by downloading that you think its okay for people to search through it to hunt down ways to fuck people over." So anyway i was just facsinated by the sudden display of morals in the warez scene.

Re:So much for security through obscurity

[TopShelf]

Heck, you could make the argument that just sending this source code around should be considered "distributing a malicious virus"...

Re:So much for security through obscurity

[RancidBeef]

Yeah, I remember back during the Microsoft vs. Apple "Look-and-feel" lawsuit, I was rooting for Microsoft. 'Course, I guess I still would today because Microsoft was in the right on that argument.

Re:So much for security through obscurity

[nullard]

There's so many more computers running than 2000/XP than 9x, why bother writing any kind of worm that targets 9x?

Is that true? Can you prove it?

For years after Windows 95 came out, there were more Windows 3.1 systems than there were Windows 95 systems. Why is this?

It's probably for the same reason that there are more dead people than live people.

Re:So much for security through obscurity

[LittleBigLui]

why target Mac or Linux when you can target Windows, with many, many times more users?

what my first thought was:

Because every idiot skr1pt k1dd13 and their lam0r grandmother can code winDOZE viriii, but only 1337 H4XX0rZ can ownzor teh LiNuX and MaC BoXxEn!!!1!!

how it should be phrased:

Successfully designing, implementing and deploying a worm/virus targetting the aforementioned "alternative" platforms Linux and/or Apple would - although being a much more complex undertaking and promising less quantifiable success (for example, infected hosts) than targetting the Microsoft Windows platform - could strengthen the Programmer's social status amongst his peers.

how it should be phrased on slashdot:

Frist psot!

Re:So much for security through obscurity

[harmonica]

Thanks for pointing that out. I first read it as Windows 2000 with service pack 3, and that didn't make a lot of sense in the context.

Re:So much for security through obscurity

[yandros]

Actually, there have been numerous studies/surveys by roughly every major `business market analyst' company (Gartner, Jupiter, et al) that show that Win9x variants are more widely used than all other Windows OS's combined, by a decent margin.

Perhaps your personal experience in server rooms has misled you about the HUGE number of Win9x installations on user desktops?

Re:So much for security through obscurity

[Bedouin X]

Maybe the fact that there weren't 300 million people on an Earth Area Network called the Internet back then.

Re:So much for security through obscurity

[Anonymous Coward]

Windows 1337+666 seemed to always do it for me...

Re:So much for security through obscurity

[MasterSLATE]

Due to the source code leak, Microsoft has delayed the release of the highly anticipated Windows 2000 till the summer of 2004.
*time passes*
Due to the source code leak, Microsoft has delayed the release of the highly anticipated Windows 2000 till the fall of 2004.
*time passes*
Due to the source code leak, Microsoft has delayed the release of the highly anticipated Windows 2000 till the release of Half-life 2.
*time passes*
Duke Nukem Forever released...

Re:So much for security through obscurity

[LurkerXXX]

If you look back at past slashdot stories, you'll find exactly that was done several months ago. An opensource patch was released for a windows exploid before MS could release one. Everyone raved about it that day.

The next day it was discovered the patch was very badly coded, and included a backdoor...

I think I'll stay away from 'opensource' MS patches, thank you very much.

Re:So much for security through obscurity

[JWSmythe]

It's easier to set a macro to current Windows version.

perl -e '@t=localtime(time());$yr=($t[5]+1900)-1;$sr=int(( $t[4]/4)+1);$v = int("$t[7]$t[2]$t[1]$t[0]"*((rand(rand(10)+1)+1))) ;print "Win$yr\SR$sr.$v\n";'

(take out the line break, and it will work better)

Re:So much for security through obscurity

[RoLi]

Blaster doesn't care about how "serious" the machine is it infects.

Also, Win9x was once the big mainstream OS, too.

And finally, as Nimda and the Code Reds show, you don't have to run the majority to attract a worm.

Re:So much for security through obscurity

[jonathan_ingram]

That's Windows 1561 in the base of our overlords (base 11).

Re:So much for security through obscurity

[soramimicake]

Sorry for pointing out the obvious, but you really don't want to end up being as a scapegoat in a high profile case this one has the potential of turning into. Getting blamed for distributing a million copies of Windows and ending up in jail for years is not fun.

It is wise to keep a low profile from a company that offers bounties to hunt people down.

Re:So much for security through obscurity

[mwheeler01]

actually it's m. w. h. eeler, sorry about the confusion

Re:So much for security through obscurity

[mwheeler01]

meh, I make no appologies, I had a good point and I was wiling to take the hit, I was actually expected to be modded down (actually the post was a +5 and now it's a +4)

Re:So much for security through obscurity

[Trolling4Dollars]

It would be quite interesting if Microsoft decided to enlist the help of the open source crowd to fix the problems as quickly and as securely as possible by encouraging them to download the source if they find it. They could then submit patches to MS which could be tested both by peer review in the OSS camp AND MS's own developers. This would be a truly fascinating and powerful partnership that no black hat would standa chace against. Of course... that's never happen because there are some things that are more important than computer security. Namely profit. [ahem]

Re:So much for security through obscurity

[EngrBohn]

I've got an email inbox filled with "The Latest Security Update for Windows". I'd be careful before installing a patch from an unknown source.

Re:So much for security through obscurity

[Anonymous Coward]

There's so many more computers running than 2000/XP than 9x, why bother writing any kind of worm that targets 9x?

Rubbish! It's more likely that there are one helluva lot more machines running some pre-2000 version of windows than the latest version. Why there would be a disproportionate number of security issues with 2000/xp is beyond my knowledge ...unless it's because Microsoft only recently began seriously investigating security lapses and most XP users are logged in as Administrator (which wouldn't give you much of an advantage security-wise over win9x).

Re:So much for security through obscurity

[Grr]

No a K is 1024 so it's about W1.9560546875K

Re:So much for security through obscurity

[kasuga]

When I asked what the big deal was, the siteop responded, "think about it, by downloading that you think its okay for people to search through it to hunt down ways to fuck people over." So anyway i was just facsinated by the sudden display of morals in the warez scene.

The warez scene is a lot more moral than the business 'scene'.

Re:So much for security through obscurity

[knigitz]

The format command for Linux is not that much different than Windows.

Re:So much for security through obscurity

[rixstep]

No, it's the same codebase.

Yes and no - especially between these two.

I think you're forgetting the settlement between MS and DEC over Prism.

Re:So much for security through obscurity

[Anonymous Coward]

I think you're confusing two different things. Windows NT/2000/XP is a more secure design in that it supports multiple users (like UNIX), allowing individual users to have restricted permissions, as opposed to being a single-user system like Win3/Win9x/MacOS1-9, where the single user has full control of the system. This means that, for example, a corporate desktop running Win9x is completely at the mercy of the user using it, while an NT/2000/XP desktop can be managed by corporate administrators, with the actual users limited in terms of what they can do.

As for the track record of NT/2000/XP, it's arguably been more vulnerable to Internet attacks than Win9x, but that's simply because it offers more network services. It's the same reason the major Linux distributions have had so many more vulnerabilities than UNIX or BSD (which typically include fewer services), which in turn have had more than, say, Win9x or MacOS9 (which typically include even fewer).

BSD (I know) and Linux (I think) learnt the Internet lesson pretty quickly, so these days typical distributions don't have many (if any) network services enabled by default, but that was a relatively recent change (within the last few years). If you enable tons of network services on a BSD or Linux system, you'll still be vulnerable to the numerous security holes repeatedly found in them.

For reaons known only to MS, Windows still runs all sorts of network services by default, and that's the key difference. It doesn't run the really obnoxious ones like IIS, but it still runs RPC, etc. If those are turned off or blocked, it will be safe from network attacks by default (i.e. only vulnerable to user ignorance). Even today, Windows users who know what they're doing typically turn on the inbuilt firewall (or use an external one), thereby protecting their systems from Internet attacks. The non-technical ones, on the other hand, don't even know what a firewall is.

At any rate, the main problem today is user ignorance, not vulnerabilities in OSes. Users have all the privileges necessary to propagate email worms, mount DoS attacks and so on, so all you have to do is trick a user into running your executable, and it's over. There are solutions to that too, but no mainstream OSes include any (yet). It will be interesting to see which major OS family (e.g. Windows, Linux, BSD, UNIX) is the first to include the necessary safeguards by default.

Re:So much for security through obscurity

[althalus]

Looks like they are already pointing some fingers according to this article it's the open-source hackers who want this.

Didio said. "With the open source community, there are a large percentage of tinkers and 'ankle biters' who are trying their hand at hacking. Some are even communicating with each other. So it only takes one or two of these groups sharing information to be able to pull something off. When you have this type of passion, it's hard to fight because these people are like virtual suicide car bombers."

Re:So much for security through obscurity

[Corbin Dallas]

"think about it, by downloading that you think its okay for people to search through it to hunt down ways to fuck people over."

Though if I spend years developing a game to feed my family, they don't seem to mind fucking me over by pirating it. Morals indeed.

Re:So much for security through obscurity

[bogie]

Distributing illegal software is moral? That's the dumbiest thing I've read here in ages. You must still be in school or something because no rational adult would think that taking property you don't own is the right thing to do. I could see not caring that warez exists, but thinking its a moral practice shows you have a lot of growing up to do.

Re:So much for security through obscurity

[Anonymous Coward]

Maybe it also has to do with the fact NT based machines are made to be administered remotely. If you've ever tried to hack any Windows computers, you would know that a 9x machine isn't going to do much without you tricking the end-looser into doing it for you. I seriously doubt the punks that write this crap are sitting down and discussing their target demographic.

Seriously, why is this insightful? Isn't it also possible that the punks I mentioned before don't know how to write code that would work on any other platform? The end result is the same, but you're making a big jump on the motivation.

The crap being released today is pathetic. The idiots writing this stuff probably can't even spell their own names. They probably wouldn't recognize a boot-sector virus if you beat them over the head with the monitor it was displayed on.

Whew, I feel better now.

Re:So much for security through obscurity

[lommer]

The statement that either company might be able to buy SCO with a months revenue is dubious, but in any case, Microsoft would actually be in a better position to buy them than IBM. I say this because I just went and compared the financial reports of the two companies (1, 2). Notice that while IBM has more assets than Microsoft (96B vs. 79B), Microsoft has an astounding 50 Billion dollars in cash reserves. Seeing as this is a full order of magnitude larger than IBM's 5B in cash I think Microsoft would be in a better position to make a surprise hostile takeover bid on SCO.

Re:So much for security through obscurity

[rixstep]

any patch for MS products that do not come from MS "can't be trusted"

Interesting! For most sysadmins I know say it's the other way around!

Re:So much for security through obscurity

[adrianbaugh]

It's not morals, it's pride. It's not as l33t if you need the code to write a virus, I guess.

Re:So much for security through obscurity

[Anonymous Coward]

Wonder if that will be MS in the 2020s and 2030s?

Re:So much for security through obscurity

[antiMStroll]

I'm curious. Any references?

Re:So much for security through obscurity

[cshark]

I hate to be the nay sayer here, but everyone is talking about this story like it's the real deal, yet no one seems to have come up with a single solitary download URL. If this was the real thing, you would think that such a thing would exist in at least one spot on the web. Otherwise, I wouldn't worry. If the code doesn't exist, it probably wasn't leaked.

Re:So much for security through obscurity

[Magic5Ball]

There are levels.

Trading in warez may not be moral, but there are actions that are less moral. Find out why child molesters don't last long in prison.

Re:So much for security through obscurity

[pantycrickets]

Because every idiot skr1pt k1dd13 and their lam0r grandmother can code winDOZE viriii, but only 1337 H4XX0rZ can ownzor teh LiNuX and MaC BoXxEn!!!1!!

Nothing says "peer approval" like millions of hosts infected. There really aren't enough macs and linux machines to accomplish that. Period.

Re:So much for security through obscurity

[andy55]

Windows source code posted!!

Re:So much for security through obscurity

[Kirth]

Yes, the warez-scene, which consists mostly of microsoft-zealots (why else would they distribute MS software and thus advertise for MS?) simply is afraid someone else might "administrator" their Windows-boxen.
--

Re:So much for security through obscurity

[pantycrickets]

There's so many more computers running than 2000/XP than 9x, why bother writing any kind of worm that targets 9x?

Is that true? Can you prove it?

Are you a troll, or just ignorant? Here is just one of many sites that list up to the date web statistics from a large sampling of web surfers. Windows NT, Windows 95, Windows 98, Linux & Mac combined don't equal how many users have XP.

Re:So much for security through obscurity

[glitch23]

If it were me who did it, accidentally or on purpose, I'd be on a jet to some foreign country right now.

Two things, 1) You aren't too smart posting as yourself (not AC), and 2) you are using your laptop right now with a aircraft phone attached right? :)

Re:So much for security through obscurity

[MalleusEBHC]

Google Zeitgeist

That's one of the best ways to gauge marketshare, so I guess that's as close as you anyone is going to come to "proving" it. With 66% of the people being on NT/2000/XP, even if there is a large margin of error they still are the most prevalent by a landslide.

Re:So much for security through obscurity

[what the dumple is]

Coincidently, this is also one of the key reasons that there are more worms/virii released that target Windows than Mac or Linux - why target Mac or Linux when you can target Windows, with many, many times more users?

I have noticed some viruses for linux. One was just a script and it recommended that the indivdual chmod a+x and then run it. The other one you had to type gcc -o virus virus.c and then run the resulting binary in order to get it to work. And then there was that one where it wanted to load a module but it couldn't because modules weren't supported on that kernel, although it did try for /dev/kmem.

Then there was that one that installed an irc backdoor:

:Portland.OR.Us.Aolirc.us 372 lamer :- Network Admins:
:Portland.OR.Us.Aolirc.us 372 lamer :- Paul
:Portland.OR.Us.Aolirc.us 372 lamer :- MrSteve
:Portland.OR.Us.Aolirc.us 372 lamer :-
:Portland.OR.Us.Aolirc.us 376 lamer :End of /MOTD command.
:lamer MODE lamer :+wx
JOIN #ddos# vrfx
MODE lamer +i
:lamer!lamer@aolirc-1FCCF050.client.attbi.com JOIN :#ddos#
:Portland.OR.Us.Aolirc.us 332 lamer #ddos# :
:Portland.OR.Us.Aolirc.us 333 lamer #ddos# smash` 1068679664
:Portland.OR.Us.Aolirc.us 353 lamer @ #ddos# :lamer
:Portland.OR.Us.Aolirc.us 366 lamer #ddos# :End of /NAMES list.
:lamer MODE lamer :+i
MODE #ddos# +nts


23:14 < lamer HTTP server listining on poort: 999 root dir: c:\ Address http://X.X.X.X:999/

Oh, wait. that last one was a Windows thing. But those other ones. Look out. They'll do some nasty things. I mean, it takes a bit of work to get them running. But once you do. Look out. They're dangerous!

/* address size */
/* 0x00417001 0 */ /* unknown */ void __entry_point__;

Re:So much for security through obscurity

[LordKazan]

so far this month on my site (OS, Visits thus far this month, %)

• Windows XP -- 40972 -- 53.8
• Windows 2000 -- 12055 -- 15.8
• Windows 98 -- 10602 -- 13.9
• Windows Me -- 6461 -- 8.4
• Linux -- 1469 -- 1.9
• Unknown -- 1213 -- 1.5
• Mac OS -- 1161 -- 1.5
• Windows NT -- 1149 -- 1.5
• Mac OS X -- 619 -- 0.8
• Windows 95 -- 166 -- 0.2
• WebTV -- 165 -- 0.2
• NetBSD -- 3 -- 0
• Sun Solaris -- 3 -- 0
• Windows CE -- 1 -- 0

Re:So much for security through obscurity

[ImpTech]

No, bah, way off...

The reason there are more worms on win2k/XP than the 9x series is because the 9x series doesn't DO anything. Win98 doesn't have "UPNP" or "Remote registry", or "windows messaging" or any other fancy services to speak of. Usually its all that crap (which is on by default!) that becomes the portal for worms. 2k/XP are a more powerful OS than 9x, which makes them inherently more dangerous. And now that more and more people are moving that way, of *course* chaos was going to break out, just as countless people predicted 4 years ago.

Re:So much for security through obscurity

[Ironica]

If you look back at past slashdot stories, you'll find exactly that was done several months ago. An opensource patch was released for a windows exploid before MS could release one. Everyone raved about it that day.

The next day it was discovered the patch was very badly coded, and included a backdoor...

It wasn't a patch, it was a browser plug-in to deal with the truncated URL exploit.

First people were celebrating. Then people were saying "Wait! This is redirecting all web traffic through a proxy... it's a hack!" Then people were saying "No, wait... it's just redirecting malformed URLs that are subject to this exploit, so that it can give a specific error page and track who is trying this crap."

There were some coding errors apparently, but nothing terrible.

Re:So much for security through obscurity

[Ironica]

IBM's legal team make Microsoft's look like first year law students. IBM's lawyers held the DoJ at bay for DECADES.

Well, yes. But that was because that's how long it took to get through a case like that, back then.

Because of that experience, federal laws have been rewritten to "fast-track" technology antitrust cases, since the development cycle is so short relative to traditional products. Microsoft can thank IBM for getting them through the DOJ in only a few years. ;-)

Re:So much for security through obscurity

[lastninja]

Actually there are now more living people than have ever died. No I can`t prove it you have to take my word for it. Being a slashdot reader it is worth alot ;) .

Re:So much for security through obscurity

[gnudutch]

Let me offer up a simple analogy. Today's OS market is like a parking lot with 99 Toyotas parked with engines running and doors wide open (WINDOWS), and 1 Porsche locked up with Viper (MAC OS). What does the car thief take? A vulnerable Toyota obviously.

Ok, lets switch it up. What if 99 cars were Porsches with Viper, and 1 car was a Toyota with the doors open and engine running. What does the car thief take? There are more Porsches, why doesn't he take the Porsche??

Re:So much for security through obscurity

[efextra]

if you happen to modify the registry of the client system to use a differenet "WindowsUpdate" server...

Hmmm, thats a feature of Windows update that allows you you to set the update server (Search for SUS for info on this). This is to create local update servers and actually works pretty well (we use it on out network). It makes getting the updates so much faster.

Windows update client installs *only* signed content from Microsoft whatever be the source.

Re:So much for security through obscurity

[proffit]

umm.. about so many more people using windos 2000/xp than 9x I just read a copy of computer source magazine saying that "According to AssetMetrix research Labs, one of the biggest examples of perspiring property comes in the form of old win98 machines. A recent survey performed by the firm found that of the 670 companies questioned, more than 80% were still using Windows 98 or 95" it then goes on to say that 27% of the PC's surveyed still ran 98 and 95 and only 7% ran xp

Re:So much for security through obscurity

[Andypoo]

... or you could just look at the source, given that it's an Open Source patch :-)

Makes me wonder why you trust MS patches so much </conspiracy> :)

Andrew.

Re:So much for security through obscurity

[1u3hr]

Distributing illegal software is moral? That's the dumbiest thing I've read here in ages. You must still be in school or something because no rational adult would think that taking property you don't own is the right thing to do.

There's no logical connection between "distributing illegal software" and "taking property". No one is stealing boxes out of shops. No "property" is involved at all. That's the reason the legal concepts of "intellectual property" (copyright, trademarks, patents, etc) were invented, because trying to apply rules derived from "real property" lead to ridiculous results. (All these statements that start with "stealing software is like stealing..." for a start.)

Re:So much for security through obscurity

[Gary Destruction]

I completely agree. It was DCOM on port 135 that was exploited by the Blaster worm. DCOM is an insecure and unnecessary service to run. The same goes for Windows Messenger. Then there's issues like NetBIOS being transmitted over the IP stack and file and printer sharing being bound to WAN links by default. And many home users aren't aware of the server service not being necessary unless you're actually networking locally. The IPC$, ADMIN$, C$ and other DEFAULT shares can leave you open to big problems as well. Overall, it takes some real effort to really a secure a Windows 2000/XP workstation for home use.

Re:So much for security through obscurity

[Matrix2110]

Ahh, You might have hit the nail on the head. Remember that it is Win98 that Microsoft is trying to snuff. ME has very few users because it sucks. most people have XP due to Microsofts dominance, however there are still a lot of "Anti-bloatware" minded people (Mostly gamers) that run 98 because it is quick and fast and does not require a lot of overhead on a modern machine. Win 2K is a lot more overhead but feed it a modern machine and it performs decent.

XP is something I will resist using as long as I can.

Back to my point. If I were Microsoft, The most damaging thing I could think of to wipe out internal competition would be to leak the old code, Blame any security issues on the "Hackers" Then lobby the Government and everybody else to "Upgrade" to a "Trusted" operating system.

Once Microsoft washes its hands of the 98/2k code, perhaps this leak will prove useful to open source.

Re:So much for security through obscurity

[Matrix2110]

One thing does trouble me is the fact that the NT kernal might be sitting out there.

There are a lot of NT machines sitting out there.

Re:So much for security through obscurity

[ameoba]

...and we all know how easy IE makes registry modifications. On an otherwise completely locked-down system, short of diabling IE, any user can install crap from IE that affects everyone.

Re:So much for security through obscurity

[LordK2002]

It's probably for the same reason that there are more dead people than live people.

Actually, if populations are assumed to increase exponentially, it can be shown that the number of people currently living is greater than the number of people who have ever died.

K

Re:So much for security through obscurity

[Brendan Byrd]

Oh, really. Where's the leaked Doom3 alpha or Half-Life 2 code? No idiot in his right (or wrong) mind is going to risk putting up illegal source code for an insanely popular product! Even if the copyright doesn't kill him, his monthly bandwidth bill will.

Get it on Kazaa or some other file-sharing client.

Re:So much for security through obscurity

[cshark]

Doesn't seem to be on Kazaa... Good point though. I'll check the netwroks. Thanks.

Re:So much for security through obscurity

[nineoneone]

I think we passed the point recently - 2/3 years ago maybe - where there are now actually more live people than dead.

Can't say for sure, but I am sure that someone will correct this if its wrong.

Re:So much for security through obscurity

[andcal]

IBM's lawyers held the DoJ at bay for DECADES
If you think that IBMs success relative to Microsoft's troubles with anti-trust is attributable only to the prowess of IBM's legal team, then you are as politically naiive as Microsoft was when its anti-trust troubles began. I need not say that Microsoft somewhat more politically connected these days than it was before the schooling it received at the hands of the DOJ of the 90s. Today, MSFT may be nearly as well connected as its enemies were back then.

Re:So much for security through obscurity

[LurkerXXX]

Well, unlike the vast majority of the general population, I *can* read code... a little. I'm a biologist, not a CS trained person. I can do a little bit of coding, but not that much. An exploit others might see as obvious would slip right by me 99 out of 100 times. A subtle elegant exploit? I don't have a snowball's chance in hell of catching it. "You can just look at the source" is meaningless to the vast vast majority of the population. They could look, but it would do them zero good. That's why we buy programs from people paid to do that.

Yes, eventually people who can read code well might look at it (surely they will in a high-profile case like this, but what about some more obscure piece of code we found to work with?) but a lot of damage may be done if it's used before they have thoroughly investigated it.

Re:So much for security through obscurity

[ArmpitMan]

And this problem doesn't exist with non-open source code how?

A hax0r who wants to r3wt your b4wx has got his priorities seriously fucked up if he open-sources his trojan. Who is going to release the source of something which acts maliciously? Eventually someone is going to read that code and figure out what's going on. Then slashdot gets alerted, and the entire open source community starts yelling at them, no matter how obscure the piece of code may be. Who would take that kind of risk?

Solution? Don't run untrusted binaries, or compile untrusted code. Ever. The end.

Re:So much for security through obscurity

[ealar dlanvuli]

Where the hell are your 9x vs 2k numbers coming from?

Last I checked, 2k just barely took the lead in the past year or two.

Re:So much for security through obscurity

[zangdesign]

Aw, crap. Now my secret's out. OK, well, I'll post another message from Ibiza while my laptop is resting on the back of some half-naked euroteen while her girlfriend slowly feeds me individually peeled grapes to the exotic rhythms of an undiscovered techno artist.

</fantasy>

Damn. if I had enough money to make an airphone call, I certainly wouldn't spend it posting on /.

Re:So much for security through obscurity

[LittleBigLui]

yeah, but "/dev/hda1" is much more difficult to type corretcly than "c:" ;)

Re:So much for security through obscurity

[nullard]

That's one of the best ways to gauge marketshare

No. That is the best way to guage "Operating Systems Used to Access Google." There is a difference. I doubt that many of the thousands of Windows 3.1 installations out there have been used to access google lately. Many people never upgrade their OS. They might buy a new computer instead. That old computer does not vanish. In fact, many computers are still running today performing the particular task that they were purchased for. For example, I have seen computers running very old operating systems yet still handling payroll, receiving faxes, storing doctor's appointments, or making ID cards.

I've never visited google using my old Perfoma 6200. That doesn't mean that it is not still in existance.

Who knows how many old computers running whatever OS they came with are still quietly chugging away on someone's desk, but not visiting Google. Those machines may be on networks that have nodees infected with worms. If the worm does not target them, they won't be infected.

I'm not trying to say thet there are definately more Win 9x and Win 3.1 computers than Win NT computers out there. What I am saying is that, lacking real evidence, it is foolish to assume that the oposite is true. What happened to all of those old computers?

Re:So much for security through obscurity

[Bob Davis, Retired]

It's easy to figure out why IBM is playing nice now - their scary Big Brother persona was costing them marketshare, but more importantly, MINDSHARE. Playing nice costs them little, but earns them much.

HAHAHA!!!

[adamofgreyskull]

Especially after this little doozy.

Re:Small server they've got there

[Dave2 Wickham]

It was slashdotted before it was posted to slashdot.

Not good

[savagedome]

This is not good. Windows is designed primarily with 'security by obscurity' in mind. The security holes indeed show up every often and we have worms making it to the gazillion windows boxes before the patch does. Get ready for a deluge of worms/virri. Another bad week/month for sysadmins.

Re:Not good

[Anonymous Coward]

It's suspected that whoever wrote "Blaster" had access to Windows source code. Given that thousands of people do have legal access, this isn't really all that unexpected.

BTW, wasn't Windows source leaked once before? -- around when W2K went gold? I seem to remember that MS had accidentially posted it on MSDN or something.

Re:Not good

[Salsaman]

Didn't you read the last article, closed source software is much more secure than open source. You have nothing to fear.

Re:Not good

[strider3700]

I think this is great. We've been told security though obscurity is safer then open source. It's also been argued that open source is safer because we can spot and close the holes. It's always been impossible to test. Now that the windows source is out there we'll know once and for all which method is superior.

Re:Not good

[enosys]

It's incredibly ironic to have this happen so soon after that article!

Re:Not good

[fredrikj]

Windows is designed primarily with 'security by obscurity' in mind.

Pure MS stab. Sure, the security in Windows gets some help by the obscurity, but that doesn't mean the OS was "designed" with obscurity "primarily" in mind.

Re:Not good

[lightspawn]

Windows is designed primarily with 'security by obscurity' in mind. The security holes indeed show up every often and we have worms making it to the gazillion windows boxes before the patch does. Get ready for a deluge of worms/virri. Another bad week/month for sysadmins.

No, just on sysadmins relying on 'security by obscurity'.

Didn't microsoft claim somewhere that publishing the source code would undermine national security?

(And didn't they also give the source to foreign governments about to switch to Linux?)

Re:Not good

[Nintendork]

"This is not good. Windows is designed primarily with 'security by obscurity' in mind. The security holes indeed show up every often and we have worms making it to the gazillion windows boxes before the patch does. Get ready for a deluge of worms/virri. Another bad week/month for sysadmins."

Thanks for that pathetic attempt at reverse FUD. Since when is it Microsoft's responsibility to make sure people aren't ignoring the critical update notification that their system presents them with by default? Where the hell do you get the idea that they centralize security around obscurity? That's just one aspect to security. Would you rather they paint a huge ass bullseye on themselves? As a comparison, let me ask if the DNS root servers should be on display at a central location in Disneyland instead of being stored in an inconspicuous building in an unspecified location? Give me a freaking break. Until you actually learn about the security mechanisms behind the NT family (kerberos, encryption mechanisms, active directory, certificates, NTFS, NTLM v2, etc.), you should just STFU.

Thank you.

-Lucas

Re:Not good

[Salsaman]

Hmmm...are you suggesting the Slashdot authors...no surely not ;-)

Re:Not good

[poot_rootbeer]

Windows is designed primarily with 'security by obscurity' in mind.

That's a pretty strong statement to be making, considering that you've probably never seen any of Microsoft's internal project documentation... do you have any evidence, besides anecdotal, that the Windows project team ever decided to or even considered 'security by obscurity' to be a primary design goal?

Unfounded statements bother me, especially when they get modded up to +5.

Re:Not good

[archivis]

You'd have to prove to me that either of these Windows was designed with security of any form on the list at anything higher than #6...

Re:Not good

[caipira]

Great!! We now have more jobs! :)

Re:Not good

[Tony-A]

For a site that ostensibly relays stale news, Slashdot seems to have a lot of influence. I would be greatly surprised if the Slashdot editors didn't put some planning and foresight into the placement and timing of the articles. I do know that Slashdot does seem to be the best available early warning system for Microsoft wormage. I know its saved my skin a couple of times. Reading Slashdot at work? That's a lot of what they're paying me for. (Posting inane comments? Maybe a different matter;)

Re:Not good

[XO]

For all you know, maybe one of the rides at Disneyland IS hiding one of the root DNS servers.

Well, considering the Win* calls can be pretty much hijacked from any point as long as you can get yourself access to the system, the only safe Windows box is one that's not able to run anything.

Because once someone DOES get ANY kind of access to run anything, then they can hijack the machine. yay!

So Windows is now fertile ground for foul play?

[Serious Simon]

See previous article

Re:So Windows is now fertile ground for foul play?

[damiena]

Hasn't it always?

Security Implications?

[Curare]

Considering Microsoft's record with keeping its source closed, and the amount of recycling of code they do from system to system, I wonder what security implications the source will have. Hackers might find it even easier to discover holes. Of course, it's not as though Microsoft worries that much about security in the first place...down with security through obscurity!

Slashdotted?

[mehlvogel]

neowin.net is down - don't know if it is because of slashdot, or various other news site reporting this.

For german readers, or people understanding german here is a link
german article
reporting about the contents of the article on neowin.net

Source TREE, looking more legit now

[City_Idiot]

http://heim.ifi.uio.no/~mortehu/files.txt I'll wait till i can download it into a lab

Question is..

[DaLiNKz]

I'm sure many of us want to pick at the code, but is it really worth it at the moment? Now that so many news orgs have made it well known, wouldn't it be fairly dangerous to try to grab a copy in the next comming hours? I mean, this must piss both MS and the US Gov off. ...with that said.. cant some troll be useful and..

Open Source is Dangerous??!?

[!3ren]

Open Source is Dangerous?
How about Forcibly Opened source? ;)

How...surprising! Look! A really good reason to move from previous versions to MS's new DRM enforced versions.

We Know Who To Blame

[danaan]

This is obviously a plot by SCO to further discredit the Linux and Open Source community. Does their evil know no end?!

If this is true...

[thesolo]

I haven't been able to even get to Neowin, it's been slashdotted since before this story even made it to "The Mysterious Future" here on /., but think about what this means if this is actually true. The potential vulnerabilities. All the trade secrets Microsoft put in there. Hell, IE 5 was released with Windows 2000, so if this is full source, it means IE 5 and the trident engine are in there as well.

If this is true, today may be the day that everything changes.

Re:If this is true...

[Bendebecker]

I could hear duke nukem voice in my head the moment I read the headline "Let's rock!". If this is true it is going to be so f***ing cool. Post apocalyptic/Post digital Pearl Harbor fanatasies unite!

Re:If this is true...

[bonch]

Companies and universities have had access to Windows source for decades.

No, this "won't be the day that changes everything." Don't be so melodramatic...

Re:If this is true...

[cheekyboy]

I wondered why the whole internet slowed down.

Security by obscurity is a fools game...

[Yaa 101]

Need i say more?

Is the code that bad

[jhoger]

Is the code that bad such that this news story considers this so dangerous to Microsoft? Seems a bit hysterical to me.

I don't know how useful it is to WINE, etc... OSS developers not wanting to be "contaminated" by looking at the source code won't look at this stuff anyway.

Re:Is the code that bad

[pjrc]

Is the code that bad such that this news story considers this so dangerous to Microsoft?

Well, that's what Microsoft claimed in court, in response to the notion of requiring them to provide the source. Microsoft claimed releasing the source could compromise (USA) national security, because the malicious individuals could find and exploit all the holes. Yes, they really did say that, more or less.

But only a couple months later, faced with China adopting Linux over concerns of hidden backdoors, Microsoft provided a copy of the source to the Chineese. So much for national security (or was that honest under oath?)

Download it HERE

[dark-br]

Here in the Download section...

Re:Download it HERE

[say]

The front page there reads: "SLASHDOTTED TO HELL" in a nice, bold font.

Re:Download it HERE

[caluml]

Are you having a laugh? Posting a link on Slashdot that contains Windows source code? Not even some starving vultures that haven't eaten for a month, and are really weak, and skinny, and can't even fly, because they need food so much, and their feathers are all falling out, and they can't stand up properly, and they're almost blind, from some strange lack of protein - erm - they couldn't eat a mouse faster, not even if it was sauteed in a nice bacon sauce by a top Parisian chef, in a nice restaurant in, well, I guess it would most likely be Paris. And there would be vetinarians around, to make the birds well enough to be able to eat.
I think you get my picture.

Re:Download it HERE

[darkmeridian]

What the hell are the mods doing? The parent should have been modded "Informative".

And hell, let's Slashdot the front page anyway!

Re:Download it HERE

[Rassendyll]

The /.ed to hell comment sounds an awful lot like those source comments that were cited above ;)

XP??

[BionicTowed]

I'm guess'in this will leave XP open to attack (in some ways) as well???

Re:Mirror of article

[thelasttemptation]

better remove your sig... theif... :P

In other news...

[zellyn]

ReactOS have announced they have hit all upcoming milestones and consider their project "feature complete".

Re:In other news...

[isolation]

This is not funny. I have been working on ReactOS and WINE for quite a few years and do not want to see my work put at risk. Or have my project become the target of of a Microsoft Sco-like case because some twit puts Microsoft code in to ReactOS.

- Steven

Re:In other news...

[JudgeFurious]

Dude, go ahead and smile. It WAS funny. Now if it really happened then no, it wouldn't be funny. I can agree with that. On the other hand I laughed outloud at the post.

Re:In other news...

[zellyn]

Yeah. I think all of us are perfectly aware of the problems of reading proprietary code and then working on open source efforts. Everything from GNU Classpath to ScummVM has these issues, and our favourite lawsuit is keeping in the spotlight too. I have great respect for you guys working on WINE and ReactOS, and I don't expect you to suddenly start losing your heads and appropriating copyrighted code willy nilly. It was just a joke.

Lots of sploits.

[caluml]

They'll be a sudden flurry of exploits coming soon. After that, if Microsoft move to leave Windows open, it should start benefitting from the multiple eyeballs approach. I wonder (if it's true) what nasty tricks will be found in the code to prevent interoperability?

The comparator

[fava]

I wonder how long it will be until someone runs the comparator in it?

Re:The comparator

[menscher]

M$ would pay off a judge, and the GPL would be declared to violate the Constitution. :(

#1 news item reported after analysis:

[Slime-dogg]

Microsoft Windows 2000 was written with GNU/Emacs!

There goes another web site...

[Vexler]

...shredded and ripped apart by the well-known, full-contact sport known as "slashdotting".

Seriously, if this news proves to be true, it would actually do Windows some good in the long run. Maybe Bill actually *wanted* it leaked out, just so that he could reap some of the supposed benefits of open-source development.

Lookout for Backdoors

[bstadil]

Here is a chance to not only check for backdoors but to compare with the stuff that has been given to foreign governments.

Strangely enough this Leak will make Windows more secure in the long run as the code can be studied and possible exploits be "published"

Re:Lookout for Backdoors

[tuggy]

Here is a chance to not only check for backdoors but to compare with the stuff that has been given to foreign governments.

There is no difference at all IMHO. The leaked code is probably one of those given to foreign governments.. that is where the leaks come from...

Re:Lookout for Backdoors

[shaitand]

No kidding, it's called open source, it's a proven method.

Half-Life 2 bandit strikes again?

[dtolman]

Or was that just a preview of the fun and chaos that source code leaking on the internet can bring?

2003 - year of the worm
2004 - year of the leaked source code

Re:Half-Life 2 bandit strikes again?

[Dreadlord]

yeah, and now MS have a good excuse to delay longhorn and force all windows users to upgrade.

Here's the source

[FattMattP]

I found the source code here.

Re:Here's the source

[Dreadlord]

Looks like there is a more optimized version here.

Re:Here's the source

[neuronaut]

The sad thing is, I read the comments of this story just because I knew a link to this would be here, and I wanted to see it again.

Case for stronger DRM.

[GoofyBoy]

Actually this will push them towards DRM and other content management lock-down.

"If we had DRM, we could have prevented the source code from being transmitted freely."

If this is true and there are serious IT wide consequences from this, then it will be the best case to pass laws implementing DRM.

Re:Case for stronger DRM.

[TheFlamingoKing]

Sounds kinda like Valenti and the MPAA.

Both problems are a case of someone on the inside, someone trusted, releasing copywritten information. Then M$ or MPAA goes after the individual downloaders, wins the case and 4. Profit!!!

Nevermind who leaked it, let's arrest them all!!!

Re:Case for stronger DRM.

[aled]

What if the DRM source code leaks ;-)

Uh oh

[bdaehlie]

And you thought there were a lot of viruses and known security problems around already... just wait (if this is true).

now that site

[hyperstation]

is truly history...

tin foil hat

[wildcard023]

Ok so here's MS's plan.

Step 1) Leak their source
Step 2) Sue Onen Source developers down the road because obviously they have studied the MS leaked source.
Step 3) ... Ya, I'm sure you know what goes here.

Ok but seriously, I'm not touching it. The last thing I need is Microsoft saying that I somehow owe something to them.

Jerks.

--
Mike

Re:tin foil hat

[jasontheking]

Why wasn't the code to XP leaked as well? Surely if someone had access to the
NT4 and NT2K source (regardless of whether they were an M$ employee or not),
they had access to the XP source.

Re:tin foil hat

[Skyshadow]

Actually, I think it would be easier to refute any claims that portions of the code were lifted now. Unlike with SCO, a full source tree exists for us to compare the potential offending code to.

As a side note, I actually feel bad for MS on this one. Seriously: This was *their* code. They paid for it, they kept it going over the last 20 years, they should be able to decide how it gets distributed.

We here at /. should all be as PO'ed by this as when we catch some asshat corp. using our code without regard to the licensing (in our case, the GPL).

I won't mirror this code any more than I'd steal my neighbor's lawn mower because someone else opened his garage door. It's not right.

Re:tin foil hat

[master0ne]

all your code are belong to us!

Re:tin foil hat

[poot_rootbeer]

Step 2) Sue Onen Source developers down the road because obviously they have studied the MS leaked source.

Onan Source developers are ALREADY in trouble for their leaks.

They need to be taught that just because a tool is available, does not make it right to use it however they see fit.

Re:tin foil hat

[serfx]

buti mean in all seriousness wouldn't it be nice to go over and take a look at yoru neighbor's lawn mower, when it has 20 years worth of self engineering and what may appear to be random appendages of contex attached to it?

Re:tin foil hat

[UFNinja]

Step 3? Why it's ??? of course! And you forgot Step 4: PROFIT!

Re:tin foil hat

[loconet]

but what _if_ the lawn mower was yours in the first place?

Re:tin foil hat

[nathanh]

Ok so here's MS's plan.

Step 1) Leak their source
Step 2) Sue Onen Source developers down the road because obviously they have studied the MS leaked source.
Step 3) ... Ya, I'm sure you know what goes here.

Ok but seriously, I'm not touching it. The last thing I need is Microsoft saying that I somehow owe something to them.

I see a lot of people saying this - even PJ@Groklaw - but I don't think it's realistic.

If I read the FreeBSD source code then I'm not obligated to make my contributions to Linux under the BSD license.

If I work for Sun writing Solaris drivers then I'm not "tainted" for life from working on Linux. And yes, all Solaris developers receive a full copy of the source code.

Merely seeing code doesn't mean you can't work on other software. Though it does make it more difficult to prove your innocence, if the issue of code theft ever comes up. But if your code is obviously different from the Microsoft code then what is the problem? I can't imagine that merely viewing Microsoft code would mean that Microsoft owns you for the rest of your programming life. Otherwise noone could ever move between software companies, and that happens all the time!

For example, Digital doesn't own Windows just because Dave Cutler jumped ship. Borland doesn't own Microsoft Visual C++ just because Microsoft stole half the Borland developers. If seeing code was such a big deal then the entire industry is already corrupted. Why does it suddenly matter if Microsoft's code is involved?

Admittedly, as I said earlier, it's harder to prove innocence if you have looked at the code. But surely it's not cut-and-dry "you looked, you forfeit all your own code". Surely not.

Here it is at

[Crasoum]

Albino Black sheep

Re:Here it is at

[Rufus211]

Above is a bad copy/update of this file.

Re:The shit will hit the fan + Mirror

[milgr]

Could this potentially help the WINE Project?

IANAL but I would avoid looking at the leaked code - especially if I was working on a project like wine. You wouldn't want wine to sued out of existence because it contains code derived from a proprietary, copywritten system.

Field Day

[EZmagz]

Granted, there's already lots of schools and whatnot that have access to the source, but if this is for real, then expect all hell to break lose. Should be interesting to see how many vulns get discovered in the first month alone from this. Regardless, whoever leaked the source better hope they're in a far, far away country immune to teams of sharks-dressed-as-US-lawyers.

Re:Field Day

[blowdart]

Not just schools, didn't India and China get it as well?

It's obviously a Chinese economic attack :)

On purpose?

[spicyjeff]

*dons tinfoil hat*

What are the chances Microsoft did this on purpose? Note that its older versions of the OS that are leaked. Next up Redmond will probably urge everyone to upgrade away from such insecure OSes and thus also give them an excuse to stop supporting them.

Re:On purpose?

[lowe0]

It wasn't an older version. The NT 5.0 codebase (which started with Win2000) is currently in use in their newest products (XP is NT 5.1; not sure what 2003 is).

So no, until Longhorn ships, this is the latest major NT rev. It's not old code.

If I was big into conspiracy theories...

[PythonCodr]

... I might think Microsoft leaked it on purpose, so the OSS community would find the bugs, point them out publically, and even describe how to fix the problems.

Of course, I'm not the suspicious type ... :-)

J

An open source of Windows... of sorts?

[NitroWolf]

What would be the legal ramifications of:

1) Someone taking the W2K source and making an Out of the Country host of a tweaked (and improved?) W2K source? Would this be illegal to use? I realize it would be illegal to distribute in the US, but would it be illegal to *use*. Especially if you owned a valid copy of W2K?

2) If you own a valid copy of W2K, could you legally look at/use the leaked W2K source?

3) If there were any derivative works off the W2K source, I'd think the W2K license would allow you to use any subsequent O/S created with that source by independent developers. I realize the EULA may forbid this, but I seriously doubt that would hold up in court. You probably couldn't do this from a commercial standpoint, but as a private citizen, I can't see there being any legal recourse MS could take against using what would effectively be an OSS version of W2K.

Anyway, something to think about.

Re:An open source of Windows... of sorts?

[nearlygod]

I would love to use Windows XP Lite K++ edition without all of the... nevermind.

nearlygod

Re:An open source of Windows... of sorts?

[DaHat]

No, no and no.

Unless this source 'leak' was officially sanctioned (which we know it wasn't), possession, use, distribution, etc of said source would be illegal, regardless of if you have a legitimate copy of windows 2000 sitting on your home pc.

Also, the EULA covers the final product, not the original source. There are separate license agreements for that source.

Re:An open source of Windows... of sorts?

[canajin56]

Wrong. Only distribution would be illegal. Copyright only protects from making COPIES. Just like MP3's. Having 10GB of MP3's on your hard-drive is only illegal if you distribute them. It doesn't even matter whether or not you have the original CD's, either. (But if you don't, it was probably illegal to GET them. But not to possess or use them)

Re:An open source of Windows... of sorts?

[DaHat]

Partially true, however as the corny line goes "possession is 9/10ths of the law". You are incorrect however, possession of a large collection of MP3's which you do not have the rights to is still copyright infringement.

If I were to install a piece of pirated software on my mothers computer with out her knowing, she is still liable for any damages for said infringement because even though I carried out the actual copying, she was in possession of it.

As this code is copyrighted, and which copyright is owned by Microsoft, you are right that any unauthorized distribution is copyright infringement, however, by simply possessing said code, you are diluting the value of Microsoft's copyright on it, causing a loss (indirect granted) to them and still in violation under the same laws.

Wow

[Moth7]

$ ndisasm kernel32.dll > Win2k-i386a.src
$ gzip Win2k-i386a.src

It took us that long to work it out? :p

This is a very interesting design problem...

[gelfling]

What do you do if you are a company who's most basic money generating product is predicated on secrecy? What value do you bring to the table if that secrecy is compromised?

Microsoft's plan to increase security

[bartjan]

Release source code, to have more developers working on Windows security.

Re:omg

[Dreadlord]

Mr Bill isn't the only one in a bad situation here, with the source code available to all those crackers/virus writers, there will be lots of new worms and exploits, millions of Windows users will be in a much worse situation too.

Worms and exploits will start to appear quicker, and more frequently than ever.

SCO going after Microsoft?

[CaptCanuk]

Sco should verify that their source isn't found in Microsoft sources. Heck, they might find those lines that they reported in the Linux Kernel probably in Win2000 kernel.

Imagine that!

Now we just have to wait for SCO to have a leak and everyone's dirty laundry is out in the open.

I have to wonder...

[lordbry]

...If this is a ploy by M$ to say source is out there, they are insecure, upgrade (read, tithe to them) for "good" security. Just a thought...

Re:The shit will hit the fan + Mirror

[lcde]

Allthough driver 'wrappers' and the like would be awesome for the linux community. think of the lawsuits that would start if linux 2.7.0 had much much better support for NTFS and the like.

this actually can hurt us more than help.

windows has buggy code, thats unpossible!

[highwaytohell]

This reporter does not wish to be sensationalist, but the number of industries and critical systems that are based around these technologies that could be damaged by new exploits so now maybe we will finally have an independant auditor review the code and we can finally see just how buggy this code actually is. Needless to say if this story is true it is not good news for lots of companies who put faith in Bill and his minions

this is some powerful stuff going on

[Savatte]

hell, I bet Medusa would turn to stone if she saw the code.

Re:this is some powerful stuff going on

[Bernie Fsckinner]

Of course she would. It's on mirrors all over the place.

Re:this is some powerful stuff going on

[PrimeNumber]

Yeah she looked at the source in the mirror.

Marketing Genius!

[Neck_of_the_Woods]

"You will need to upgrade to windows 2003 to be more secure now that the source code has been leaked for NT and 2000.", said marketing expect Haywood Jablowme.

Now W. Russell Jones can put his story to the test

[ThogScully]

In the last article on the /. home page, we have W. Russell Jones talking about all the insecurity of having source available in open source projects.

I'm afraid we've reach a massive failure here in security by obscurity, but time will tell. If this is true and if there are lots of security holes discovered, I find it hard to believe even a company of Microsoft's size can respond quickly enough to keep the outbreaks down. This threat is why open source is better than what W. Russell Jones made it out to be. The threat of security failing because of leaking source just isn't there with open source.
-N

Its'nt it supposed be something like 40million ...

[big-giant-head]

lines of code?? Thats gonna take a while to download... I'll wait for the 4 DVD set.....

The danger of tainting

[12dec0de]

Now I guess those of us who write code for free project have to be double carefull what code we read and who tracks us doing so.

I can allready forsee the seize-and-desist letters to free projects, claiming that one or more developers are have been tainted by knowledge of 'proprietory information' from microsoft, and the enclosed clicktrail on www.w2k-source.com provides the nessecary evidence. And you thought you were just checking out driver support info on a community site.

mfg lutz

Just goes to show...

[SushiFugu]

Just goes to show Open Source isn't the only fertile ground for foul play. :)

What's the big deal?

[Animats]

What the NT kernel does is well understood. The object code is widely available, and key parts, like file system formats, have been reverse engineered. There's plenty of documentation. A few major development shops have access to the source anyway. If you're into kernel architecture, it might be interesting, but otherwise, so what?

What service pack?

[sremick]

I wonder what service pack these are of?

No point in someone trying to exploit a bug in the source if it's of the original release and the hole has already been closed by a service pack. And since the service packs are binaries and not source diffs, it'd be pretty hard to bring the source current to find out what will really work currently.

obviously

[bmac]

this is either

an attempt to get the open source community to debug their crappy code

an SCO-style trojan, trying to get their code into oss

shaa, like we're going to fall for that one!

Peace & Blessings,
bmac

MS Upgrade Strategy??

[BookRead]

Perhaps this is to encourage people to upgrade to XP and 2003?? They don't seem to have leaked?

In other news

[jmv]

Microsoft is rumored to prepare a lawsuit regarding misappropriation of Win2k source code in Linux kernel version 2.0.

Good thing for users in the long run?

[CuteAlien]

If the story is true, i'm not so convinced about that yet.

Probably some more worms will come out within the first weeks. But in the long run MS might finally learn the value of bugs getting shallow by lots of eyes looking at the source. I don't think companies will suddenly start to copy the source and using it themself - the fear of getting caught will be too high. As much as MS will dislike this, i think the users will have more advantages in the long run (and maybe this is even not soo bad as MS will think it is).

Internet Explorer

[CeleronXL]

So will we finally find out exactly what kind of information that IE is keeping on us?

Re:Internet Explorer

[helmutjd]

Not that I'm advocating the use of IE (bleh!), but the author of that page appears to be talking out of his ass right from the start.

The magical "hidden folder" that's "segregated from the main filesystem" and "doesn't seem to exist" (C:\DOCUME~1\YourName\Local Settings\History\History.IE5\) is really just a plain ol' system folder.

Go to a command prompt and run:
attrib -s C:\DOCUME~1\YourName\Local Settings\History\History.IE5\

Wow, now the folder appears just like any other folder.

As for the deeply mysterious "encrypted" file inside it, index.dat... it's just a plain ol' binary file. Open it up in any hex editor and you can read all of the URLs stashed inside just fine.

The file "cannot be deleted by any normal means" because it's in use by Explorer (which is always running - it's your shell). If you've ever done any work with programming shell extensions, you'll have run into the same problem.

Put the following into your autoexec.bat (or any similar startup file - anything that runs before Explorer starts) and you can delete it just fine:
del C:\DOCUME~1\YourName\Local Settings\History\History.IE5\index.dat

Granted, IE may not be worth its weight in spit, but this guy appears to be a little bit off his nut.

Could be a good thing

[Spad]

Maybe this will be the event that helps people to realise just how dangerous it is to be so reliant on a single vendor.

While there are good and bad aspects to this, I think I'm going to put my windows boxes into lockdown if & when the rumour is confirmed.

Why ofcourse!

[Soul-Burn666]

It's only reasonable that software with so many holes will leak!

Re:Why ofcourse!

[MobyTurbo]

Well, that's why it's called "Windows", a window is easy to break.

Windows and Linux

[Grip3n]

What I look forward to is seeing if Microsoft has taken any components from Linux over to Windows. This is a HUGE day!

Re:Windows and Linux

[nolife]

My guess is a few years/months down the road, MS will be claiming that some GNU project uses code stolen from MS..

It only takes one rouge developer to willingly plant some MS code (it is possible that it could slip by other codevelopers), or simply just a group of lawyers to claim code was taken.

This is new???

[Supp0rtLinux]

My source code was *leaked* the day it was made. Of course, I use Linux.

Troubles ahead

[gmuslera]

the problem with trusting in Security by Obscurity is when someone puts a bit of ligth there. With sources open whatever they trusted in "this is safe because nobody sees the source" will be seen and checked to see how much safe are (even worse, mainly by the ones they don't want to see it).

The eventuality of code leaks should definately be put as one of the advantages of the security of open source software.

I don't think there will be any difference for open source software on the availability of this things, for license problems should be a forbidden reading, but virus/trojan/exploits authors will not have this kind of moral/legal problems.

Easy to spot packages

[Rosco P. Coltrane]

It would appear that two packages are circulating on the internet, one being the source code to Windows 2000, and the other being the source code to Windows NT

How to easily find the Windows source code packages in your daily P2P incoming directory:

rosco@dipstick:~/emule/incoming$ ls -l --sort=size -r .
total %@*@&^23462&^% bytes
-rw-r--r-- 1 rosco rosco 645124103 Feb 12 22:49 starwars.zip
-rw-r--r-- 1 rosco rosco 658124896 Feb 12 22:50 nt.zip
-rw-r--r-- 1 rosco rosco 660100457 Feb 12 22:49 goodbadugly.zip
-rw-r--r-- 1 rosco rosco 705012756 Feb 12 22:49 dasboot.zip
-rw-r--r-- 1 rosco rosco 706107014 Feb 12 22:56 daftpunk.zip
-rw-r--r-- 1 rosco rosco 710127685 Feb 12 22:58 chembros.zip
-rw-r--r-- 1 rosco rosco 9874520782^45 Feb 12 22:59 2ksrc.zip
-rw-r--r-- 1 rosco rosco 4578924574^37 Feb 12 23:12 ntsrc.zip
Segmentation fault. Core dumped.

Re:Easy to spot packages

[master0ne]

intresting files.... 0 11-18-01 14:23 win2k/private/genx/windows/inc/mobileq-apache.eml 1303 07-26-00 02:12 win2k/private/inet/mshtml/btools/nfparse/gnumakefi le 190 07-26-00 02:12 win2k/private/inet/mshtml/btools/nuke.bat 1231 07-26-00 02:12 win2k/private/inet/mshtml/btools/pdlparse/gnumakef ile 0 11-18-01 14:23 win2k/private/inet/mshtml/build/ppcmac/documentati on of problems in stress.eml 0 11-18-01 14:23 win2k/private/inet/mshtml/build/scripts/setup/apac he_install.eml 61072 07-26-00 02:12 win2k/private/inet/mshtml/build/scripts/tools/alph a/awk.exe 112672 07-26-00 02:12 win2k/private/inet/mshtml/build/scripts/tools/alph a/chmod.exe 65536 07-26-00 02:12 win2k/private/inet/mshtml/build/scripts/tools/alph a/choice.exe 9724 07-26-00 02:12 win2k/private/inet/mshtml/build/scripts/tools/alph a/delnode.exe 76800 07-26-00 02:12 win2k/private/inet/mshtml/build/scripts/tools/alph a/di.exe 143280 07-26-00 02:12 win2k/private/inet/mshtml/build/scripts/tools/alph a/grep.exe 58640 07-26-00 02:12 win2k/private/inet/mshtml/build/scripts/tools/alph a/kill.exe 70656 07-26-00 02:12 win2k/private/inet/mshtml/build/scripts/tools/alph a/now.exe 18432 07-26-00 02:12 win2k/private/inet/mshtml/build/scripts/tools/alph a/rcmd.exe 38912 07-26-00 02:12 win2k/private/inet/mshtml/build/scripts/tools/alph a/rcmdsvc.exe 258560 07-26-00 02:12 win2k/private/inet/mshtml/build/scripts/tools/alph a/robocopy.exe 29440 07-26-00 02:12 win2k/private/inet/mshtml/build/scripts/tools/alph a/robocopy.wri 50448 07-26-00 02:12 win2k/private/inet/mshtml/build/scripts/tools/alph a/sleep.exe 60176 07-26-00 02:12 win2k/private/inet/mshtml/build/scripts/tools/alph a/splitsym.exe 10240 07-26-00 02:12 win2k/private/inet/mshtml/build/scripts/tools/alph a/srvany.exe 9856 07-26-00 02:12 win2k/private/inet/mshtml/build/scripts/tools/alph a/srvany.wri 56592 07-26-00 02:12 win2k/private/inet/mshtml/build/scripts/tools/alph a/tlist.exe 88884 07-26-00 02:12 win2k/private/inet/mshtml/build/scripts/tools/alph a/touch.exe 102400 07-26-00 02:12 win2k/private/inet/mshtml/build/scripts/tools/alph a/winat.exe 134416 07-26-00 02:12 win2k/private/inet/mshtml/build/scripts/tools/alph a/windiff.exe 17357 07-26-00 02:12 win2k/private/inet/mshtml/build/scripts/tools/alph a/windiff.hlp 6460 07-26-00 02:12 win2k/private/inet/mshtml/build/scripts/tools/alph a/ync.exe 0 11-18-01 14:23 win2k/private/inet/mshtml/build/scripts/tools/alph a/desktop.eml 0 11-18-01 14:23 win2k/private/inet/mshtml/build/scripts/tools/alph a/apache_install.eml 61072 07-26-00 02:12 win2k/private/inet/mshtml/build/scripts/tools/x86/ awk.exe 0 11-18-01 14:23 win2k/private/inet/mshtml/build/unix.eml 0 11-18-01 14:23 win2k/private/inet/mshtml/dead/site/unix.eml 506 07-26-00 02:12 win2k/private/inet/mshtml/gnumakefile 5411 07-26-00 02:12 win2k/private/inet/mshtml/mshtmenv.bat 5331 07-26-00 02:12 win2k/private/inet/mshtml/mshtmenv2.bat 4455 07-26-00 02:12 win2k/private/inet/mshtml/nuke.bat 2497 07-26-00 02:12 win2k/private/inet/mshtml/nukeeach.bat 0 11-18-01 14:23 win2k/private/inet/mshtml/tools/mips/utils/persona l statement.eml 0 11-18-01 14:23 win2k/private/inet/mshtml/tools/ppc/utils/unix.eml 1248 07-26-00 02:12 win2k

Re:Easy to spot packages

[nolife]

I got burned, the ntsrc.zip I got was not the source, it was a video of Britney Spears nude.

Re:Ubiquitous /. ed Joke

[SonicBurst]

I know you're joking but according to netcraft:

The site www.neowin.net is running Apache/1.3.29 (Unix) mod_gzip/1.3.26.1a mod_auth_passthrough/1.8 mod_log_bytes/1.2 mod_bwlimited/1.4 PHP/4.3.3 FrontPage/5.0.2.2634 mod_ssl/2.8.16 OpenSSL/0.9.6b on Linux

Compilation and Windows source code

[CdBee]

Microsoft has always maintained that it takes a good 24 hours to compile a full version of Windows from the source, and that the increasing complexity of Windows has meant that modern computers don't compile modern windows any faster....

I'd be interested to know what the Windows source is compiled with though

Intel C compiler? I'm sure they couldn't stand the irony of using GCC. The NT codebase is supposed to be crossplatform do I doubt it's got any Assembler code in it - is it written in C or one of Microsofts own languages?

If so, what was it originally written in and when was the translation made? (Pls don't mod me informative - I may be way off the mark!)

Re:Compilation and Windows source code

[DR SoB]

It's in c (at least the core pieces). the older modules may contain assembler.

Re:Compilation and Windows source code

[Urban Garlic]

You really think it's C code? Haven't they been telling us for years you can do everything and then some in VB.net?

More seriously, I bet you need Visual C++ OS Edition, with the Secret Real Office API plug-in from MSDN.

Re:Compilation and Windows source code

[say]

It is some asm, in the kernel code.
Then there is a lot of c++.
Most of it is c.

Some other files exists, i dunno what they are.. .prf and .mib and friends.

Re:Compilation and Windows source code

[soulsteal]

Windows NT was written in C to be portable. NT4 alone was available for i386, Alpha and MIPS platforms, so I doubt any assembly was used.

Re:Compilation and Windows source code

[DR SoB]

Well then your WRONG. Don't'cha think they could include multiple binaries for different chips??

Re:Compilation and Windows source code

[poot_rootbeer]

Microsoft has always maintained that it takes a good 24 hours to compile a full version of Windows from the source

And Bob Barker always claimed it took a good 24 hours to restart the Plinko machine after a contestant stopped it, but that wasn't necessarily true either...

Re:Compilation and Windows source code

[KatieL]

.mib files are usually to do with describing network devices to SNMP servers.

Re:Compilation and Windows source code

[sICE]

If the files.txt that is linked from another post is real, you might be very right. I checked the .ext there: C(4675), CPP(2257), ASM(148). But only MIB(28), PRF(39).

Some more other interrestings extentions: BAT(123), CMD(65), JAVA(37), SED(29), PL(17), JS(16), M4(5), AWK(3), BAS(2), VBS(1).

Documentations? EML(2213), TXT(382), HTM(212), HLP(23), RTF(9), PPT(3), PDF(1).

Media: ICO(1304), BMP(803), GIF(165), AVI(141), ANI(34), MID(3), JPG(2).

TOP11: H(5611), NoExt/Dirs?(4708), C(4675), CPP(2257), EML(2213), CXX(1466), ICO(1304), HXX(972), BMP(803), RC(702).

Re:Compilation and Windows source code

[wideBlueSkies]

It's probably safe to assume that it's mostly C. Some newer stuff may be C++. Critical functions are most likely processor specific assembly language.

wbs.

Re:Compilation and Windows source code

[Anonymous Coward]

Um. Obviously you know nothing about systems programming. You can enlighten yourself with NetBSD or Linux. Look at Linux, a portable OS (moreso than Windows) or NetBSD. Look in the directory called arch (stands for architecture specific). You will find quite a bit of assembly for each of the supported platforms.

It is absolutely impossible to write an OS without some assembler. At the very least you have to set up memory and registers in order to execute C code, or set up the bootstrapping interpreter if you're using something like FORTH.

A lot of MMU and cache stuff is done in assembler because 1) you can't access special registers (in the case of x86) or coprocessors (RISC) from C code 2) even if you could it wouldn't be portable, you need some CPU specific code for each arch you're gonna support.

Go forth and learn before you sound more foolish.

Re:Compilation and Windows source code

[son_of_asdf]

Indeed. I've just now begun grepping this file, and the evidence that this is the real deal is beginning to add up.

<disclaimer>

I won't touch the actual source with a 10-foot pole, though.

</disclaimer>

Much as I like to see Wild Billy get the shaft, this leak, if true, has a number of disturbing implications; national, financial, and personal security being 3 that seem to top the list. I don't care how often the object code has been reverse engineered; there are likely to be plenty of dark, rank oubliettes built of code crufty beyond imagination lying about in the source just waiting to come to light.

Good luck Billy....you're gonna need it.

Re:Compilation and Windows source code

[myg]

It has to be compiled on a compiler with SEH (Structured Exception Handling). For the most part (the kernel) is portable C. In theory the SEH stuff can probably be implemented as macros.

Re:Compilation and Windows source code

[Kr4Ck3r]

I think windows ME is mostly QBasic.

Re:Compilation and Windows source code

[alexborges]

Yes, and obviously, thease machines/os's have been hugely successfull.

Big deal

[DrLZRDMN]

like any one who would bother to review the code would want windows on there computer. Besides its probobly all spagithi.

Oh and All (or at least some) your source are belong to us

Not going to help...

[Dimensio]

If microsoft decides to sue, they'll sue. There's no way to prove that you didn't read the source code.

Don't even LOOK at the code

[G3ckoG33k]

While Microsoft's code is as taboo for open source projects as is any other code, that code has a 700 pound gorilla behind it.

Re:Don't even LOOK at the code

[MrRTFM]

This is starting to sound like a Tolkien plot..

Beware the One tarball from the dark lord - it is highly corruptible and any OS coder who gazes at it is forever damned

Unfortunately...

[CmdrTHAC0]

The Internet interpreted the source code as damage and routed around it.

Authenticity Confirmed

[Eberlin]

Sure enough, the authenticity of the files has been confirmed as within a certain c file, it had the code:

// Don't forget to increment the Gates counter
if(errBlueScreen){
MS_Acct += .05;
}

Actually, that's the joke, it was more like:

9990 REM Don't forget to increment the Gates counter
1000 if $blueScreen = "Yes" then $MSAcct = $MSAcct + .05
1010 RETURN

Re:The shit will hit the fan + Mirror

[ctr2sprt]

Could this potentially help the WINE Project?

No. If the Wine folks look at the actual Windows source code, they aren't reverse engineering any more, they're copying, which is illegal. Even copying from memory and not wholesale code lifting can be against the law. If even one person were to do it, it might taint the entire project, undoing years of work. I very much hope that no MS-copyrighted code ever finds its way into an open source project, both for practical reasons like the above and for moral ones. The same copyright that keeps Windows secret keeps Microsoft (and others) from just stealing GPL'ed projects.

Re:I forsee a lawsuit

[dtfinch]

They'd only be sued by the FSF if they had put GPL'd code into Windows.

Re:hmm seems a bit buggy

[jmorris42]

> It *amazes* me that it hasn't been routine.

Because most people are paranoid enough to assume M$ watermarks each distributed copy to allow them to trace it back to the point of release. But now they are giving copies to governments like China and folks there just don't really give a damn about western notions of copyrights.

omg so THATS what the problem was!

[Loie]

change bool bugs = TRUE; to bool bugs = FALSE; recompile

Re:The shit will hit the fan + Mirror

[Anonymous Coward]

IANAL but I would avoid looking at the leaked code - especially if I was working on a project like wine. You wouldn't want wine to sued out of existence because it contains code derived from a proprietary, copywritten system.

What if we just use the parts that MS lifted from BSD?

Reverse engineering boon for NTFS

[Anonymous Coward]

How long will it be before someone fully documents NTFS by studying the source under the guise of having legally reverse engineered that information?

If whoever does this is careful and realistic, it seems very unlikely that Microsoft could ever prove they had done so with an illegal copy of Windows source code.

I predict that if this source is legitimate, that we will see full NTFS write support under Linux within a year.

And just think. What if there is 3rd party driver source in there too?

It's illegal, but I think it is bound to happen and we will benefit from it.

Re:Reverse engineering boon for NTFS

[sewagemaster]

unfortunately M$ has been changing NTFS in pretty much every release of windows.... NT3, NT4, Win2k, WinXP... We'll never really know what the new 'format' will be like in the upcoming Longhorn

It's not a problem.

[ggruschow]

I've seen a fair chunk of the NT kernel code, legally, under NDA. The NDA bars me from revealing any details, but it doesn't prevent me from saying that, if I were MS, I wouldn't worry about anything aside from sheer embarassment.. However, I have to admit that getting something of that hulking size operating solidly is pretty respectable.

On the plus side, some of the comments are fairly humorous, especially when you note who wrote them and look up where they are today.

Re:It's not a problem.

[Anonymous Coward]

On the plus side, some of the comments are fairly humorous, especially when you note who wrote them and look up where they are today.

OK, it just HAD to be said..

/* mem_routines.h */
success = malloc(655360); /* [billg] this should be enough for anybody */

How to Build?

[abrotman]

I dont have the source code and im really not interested, but how does one build the source for windows.. does it have Makefiles .. visual studio build files. I'm fairly curious how the build actually happens.

Re:How to Build?

[jdtanner]

Why not ask the Micro$oft Office Assistant...he *always* comes up with the correct answer :-)

this could be really bad

[G27 Radio]

The Windows code hasn't had nearly as much peer review as open source OS's so I won't be suprised if this leads to a ton of exploits. The big problem here is that this source will be available to any black-hat that wants it--they obviously aren't going to be concerned about the legalities of obtaining leaked source code. But the businesses that use Windows aren't going to be able to audit the code for security leaks unless they obtain it illegally (or sign some agreements with Microsoft and shell out bundles of cash.)

Re:this could be really bad

[cmowire]

That is exactly my thoughts.

The interesting part is the difference between Win2k and Linux. In both cases now, the black hats have access to the source code. However, there are more white hats who have access to the Linux codebase, which will make for some interesting long-term implications.

This also has the potential to solve the NSAKEY contriversy once and for all and provide some interesting insights into how Windows works. I'm wondering if, through the use of countries with more flexible copyright systems, it would be possible to document interesting attributes and then pass them back to WINE and other open-source folk.

Re:this could be really bad

[ianr44]

This also has the potential to solve the NSAKEY contriversy once and for all It only has the potential to show that there are backdoors. If there are no backdoors are in the source, the tinfoil hat crowd will just say that the leaked source isn't the version used to build windows binaries, and the controversy will continue.

Re:this could be really bad

[conteXXt]

"The Windows code hasn't had nearly as much peer review as open source OS's"

I think that might change soon.

Re:this could be really bad

[GauteL]

Or that the compiler Microsoft uses builds the backdoor in, and it is not in the source code of Windows itself.

This would actually make perfect sense, as it would be easier to hide when distributing Windows source code through the shared source program.

Re:Do NOT read that book!

[Anonymous Coward]

Do NOT read that book if you ever wish to write your own books, ever. Doing so will make you tainted- you open your book up to allegations of copyright infringement. Unless you never want to contribute a single idea to the world, etc, checking out that book is a bad idea. Its almost a surprise authors haven't published their books years ago to catch potential authors like this.

Effect on OSS code writers

[elwing]

In addition to the security implications this has, think about the implications this has on OSS writers? Previously, M$ tried to show the souce code to Windows to college students in the hope that they couldn't write OSS code because they'd have seen the Windows source.

This gives M$ a leg to stand on if they attempt to claim that any OSS has Windows code in it.

Any OSS writer that manages to get the code should proceed with caution.

OSS developers, don't be tempted to look

[jd142]

I think from a legal standpoint it might be very important that OSS developers not look at the code. Even though they didn't leak it, MS still has rights to the code. If an open source program took advantage of illegally leaked code, what would the legal ramifications be on the OSS project? I don't know the answer, but I'd be willing to be real money that MS would sue. I remember reading an article where the SAMBA developer said he was very careful not to look at any code because of this. Reverse engineering is fine, but you don't get any help to do it.

Re:OSS developers, don't be tempted to look

[Rosco P. Coltrane]

Even though they didn't leak it, MS still has rights to the code

Are you sure? How about the following scenario, just for the sake of imagining scenarios:

[tinfoil_mode]

MS lawyer: You honor, Mr. John McHacker stole pieces of Windows to use in his communistic Linux program

McHacker's lawyer: My client never saw a line of Windows code your honor.

MSL: Here for example, his code says "main(int argc, char **argv)" just like ours does! and he certainly could see our code, as it was rather unfortunately leaked (against our will!!) by a person unknown to us, and therefore was accessible to the entire Linux community at large. In fact, we're planning on suing more Linux developers who, we are certain, have seen our code.

[/tinfoil_mode]

Re:OSS developers, don't be tempted to look

[prockcore]

I think from a legal standpoint it might be very important that OSS developers not look at the code

Will people please stop saying this? If you truly believe that just looking at code taints you, then you believe MS when they call the GPL viral.

By all means, don't steal the code, but just looking at the code is harmless... at least no more harmful than MS looking at GPLed code.

Re:hmm seems a bit buggy

[geekoid]

because most people are, in fact, pretty honest.

MOD PARENT UP

[nickos]

For the same reasons that Microsoft warned its IE developers to stay clear of Mozilla, open source coders should avoid even seeing this.

That said, I'd love to get hold of the dll code that does the equivalent of a window manager in X. How cool would it be to swap out a dll on the Windows box at work and have a completely custom windowing environment?

Re:MOD PARENT UP

[jason0000042]

www.litestep.net, or litestep.com. Works pretty good too.

Re:MOD PARENT UP

[ArsonSmith]

google for litestep there are other explore.exe shell replacements that will change your windows desktop to other things. I haven't used them in years Win98 was the last time I used windows but give at a look.

Re:MOD PARENT UP

[Karamchand]

I heard about a guy really doing this. It's said he knows the insides of Windows better than the MS engineers.
Well, he's an autistic and doesn't really have anything else to do.

Re:MOD PARENT UP

[TioHoltzman]

have a completely custom windowing environment?

Try http://www.stardock.com/ - it does just this, and it has a *huge* collection of themes. Easier, safer, and legal to boot.

Re:MOD PARENT UP

[nickos]

I thought Litestep just replaces the shell (ie explorer.exe). Is there any way I can change the click-to-front behaviour of Windows to use the Amigas (or WindowLabs) click-to-focus but not click-to-front model.

Nope? - didn't think so.

The only way I can think of doing it is using hardcore hook stuff. Having the code would be *much* easier.

Re:MOD PARENT UP

[svallarian]

Doesn't tweakUI have an option in it that gives you X-style window options?

Steven V.

Re:MOD PARENT UP

[0racle]

Blackbox for Windows. Its very nice and well put together.

Re:MOD PARENT UP

[7x7]

The latest powertoys does, indeed. http://www.microsoft.com/windowsxp/pro/downloads/p owertoys.asp

Re:MOD PARENT UP

[bahamat]

No, but it does have an option to provide focus follows mouse (they call it X-Mouse) a-la X.

Re:MOD PARENT UP

[nickos]

Nope, that's focus-follows-mouse.

Basically, having the source code to the Windows equivalent of an X window manger would allow the sort of diversity of usability features that we see in the Linux world.

I've never seen any *fundamental* modifications to the Windows "window manager".

Re:MOD PARENT UP

[IamTheRealMike]

There is no such DLL, window management is done in kernel and the code for it is spread between USER, GDI and NTOSKRNL, I think.

Re:MOD PARENT UP

[nickos]

Oh - if you're right that's a shame. It's also pretty atrocious OS design (window management in the kernel? - shouldn't it be in userspace). Mind you, I remember when you could crash 2000 by echoing a file containing tabs and backspaces :)

Re:MOD PARENT UP

[phoenix_rizzen]

The Windows GUI shell (or window manager) is called explorer.exe. This program, and the associated libs, control the entire GUI environment.

There have been replacement shells since the release of Windows 95 and NT 4. Some are quite nice (darkstep / litestep), some are nifty (98Lite) some are just bizarre. But, there are still plenty out there to choose from.

The only interesting thing to be gleaned from the source of explorer.exe and libs would be how they get things like the RUN dialog, or system folder like My Documents to work. These are usually the bits you lose when you run a replacement shell.

Re:MOD PARENT UP

[orthogonal]

I thought Litestep just replaces the shell (ie explorer.exe). Is there any way I can change the click-to-front behavior of Windows to use the Amigas (or WindowLabs) click-to-focus but not click-to-front model.

TxMouse can almost do this. Its default settings are focus on hover but not bring to front; bring to front is accomplished by clicking on the window decoration (titlebar).

TxMouse can also be set to autoraise after a settable delay.

TxMouse can emulate an X-Windows mouse including copy-on-select and paste-with-third-button.

It works a bit better than the PowerToys version too; the PowerToys one regularly screwed up one app (Microspell) when that app was activated by hotkey. TxMouse doesn't screw it up.

On the assumption that a lot of you will want this, I'm going to go into some gory details not included in TxMouse's documentation now. If you have no desire to use TxMouse, you can skip the rest of this post in good conscience; I promise you won't be missing any anti-Ashcroft zingers.

TxMouse also changes the mouse cursor change when select is copying, and allows you to turn off copying by pressing the third button.

On my mouse, turning off copying doesn't work with the middle button, as the middle button gets physically trapped down until the left button is released. TxMouse allows you to set it up so that the right mouse button does all the work the middle would normally do, for people with two-button mice, but a better solution to my problem was to re-assign middle to right and right to middle in the Microsoft Intellimouse driver. So now the middle button drop down context menus, and the right button pastes, except in the browser, where the right works as a "back" button.

The TxMouse mouse cursor that indicates text is being copied does not show up if the "Link Select" cursor is the default (the pointing finger); in that case the copy indicator is the "Handwriting" cursor. So you can customize what shows up on copy if you don't customize "Link Select", and vice-versa.

TxMoue is free but not open source (which sucks, as I'd like to modify it -- any pointers to source for MS_Windows Mouse drivers is appreciated so I can replicate it), and can be found here. Get it while Ashcroft still lets you connect web sites in socialist Sweden.

Re:MOD PARENT UP

[monique]

I put an app called xmouse in my startup folder and never worry about it again. I can't remember where I got it, though.

Re:MOD PARENT UP

[cristofer8]

Actually, you can do both, without even replacing a dll, just modifying one. Get uxthemeutil from tgtsoft.com. It'll replace uxtheme.dll on your xp box, allowing you to use custom themes (essentially the same as windowblinds but without any program running).

Then get tweakui and enable mouse-brings-to-top. Done.

Re:MOD PARENT UP

[Myopic]

i'm always shocked at the weird windowing preferences people have.

Have you ever heard of gzip?

[Via_Patrino]

Have you ever heard of gzip?

How how long....

[Conspiracy_Of_Doves]

until it's available on kazaa?

uh oh

[hawkbug]

I see bad things happening here... 1) Microsoft "accidently" leaks Win2k source. 2) Microsoft pays some guy to "contribute" to the linux kernel in a small way. 3) Microsoft then files an SCOish lawsuit against IBM (or whoever) claiming ip infringement in the linux kernel. Don't laugh. Stranger things have happened.

Conspiracy Theory

[cloudship_tacitus]

Assuming this is indeed true, what's the chance that MS released this on purpose, with the intent of a)eliminating as many legacy win2k/nt 4 users as possible to ensure a move to longhorn or b)creating an environment where an extensive patching system would be necessary and thus sellable?

just some ideas; i'm not a zealous ms hater, but i've seen companies do conceptually-similar things before.

Interesting point: Is Microsoft's code GPL free...

[BiscuitTheCat]

I guess this will finally answer any lingering doubts as to whether Microsoft (or more accurately, an unscrupulous employee with an impossible deadline) ever incorporated any GPLd or LGPLd code in there.
Of course, if they did, that wouldn't necessarily be a good thing for the GPL, because then it Microsoft would have a *really* good reason to try and destroy it.

ReactOS

[jdtanner]

I wonder if the guys over at ReactOS (http://www.reactos.com/) are tempted by a look?

For those who don't know...

"ReactOS is an Open Source effort to develop a quality operating system that is compatible with Windows NT applications and drivers."

Re:ReactOS

[Anonymous Coward]

No, I think this is actually bad for us. We now have to be even more careful about who we accept code from.

Ge van Geldorp
ReactOS developer

Re:ReactOS

[jdtanner]

Woah...I never expected a reply from one of the ReactOS guys!

I understand what you are saying, it must be a bit of a headache :-(

Good luck anyway, I can't wait for v1.0!
John

Re:ReactOS

[stevens]

No, I think this is actually bad for us. We now have to be even more careful about who we accept code from.

If none of you have seen the Win2k source code, how could you judge whether a patch was from someone who had?

Re:ReactOS

[theCat]

I should think that the lawyers at M$ will wait a suitable period of time and then, once ReactOS looks good, swoop in with a C&D order. They will have a long list of "similarities" in source, and charts showing how development of ROS features and stability has become accelerated since the release (though ReactOS was picking up anyway, as has WINE, as does any project gaining mindshare) and even if it makes no sense M$ will be able to hold up everything for years in litigation and findings.

This whole thing has a really high suck factor.

Combined with SCO FUD and that fscking MyDoom nonsense, this is really bad.

The odds of getting the full source: experience.

[rufusdufus]

The odds of getting one's hands on the full source to NT4/2K are slim to none--even most Microsoft folks couldn't do that.

This is incorrect.

Its funny how people build up ideas in their heads about what its like in a large corporation, somehow like a hollywood movie with lots of people with dark shades and guns ala "The Net".

No, inside Microsoft is a lot more like "Office Space" and anybody with motivation could get the entire source with little trouble.

Re:GNU!

[Gabriele Capone]

It was probably used to compile things like the Solaris version of Internet Explorer.

Linux/GPL code in Windows

[Anonymous Coward]

Personally, I always wanted to know how the NT/2000 kernel got somewhat stable. I'll bet there's GPL code from the Linux tree in NT/2000!

That leads to a fascinating question

[way2trivial]

Are there any back doors showing in the source...

Re:That leads to a fascinating question

[Roofus]

Are there any back doors showing in the source...
I'm talking out of my ass here (This is Slashdot, what else is new), but I think that would depend on the source of the leak. If the source is from a Dept in the Government, or an educational institution, I would guess Microsoft would have removed any backdoors before shipping the code. Of course, maybe it's a leak from the NSA, with all backdoors intact ;-)

Re:That leads to a fascinating question

[canadiangoose]

That probably depends apon which version of the source this is, the "shared source" version, or the copy used in the MS build labs. I've heard that it's impossible to compile the verions of source provided to "shared source" partners, so there's no proof that it's the same source that was used to compile the binaries that get publicly disributed.

Re:That leads to a fascinating question

[abradsn]

It's damn near impossible to compile it in our own tweaked build environment. I'd like to shake the person's hand that figures out how to compile 15 gb of closed source code that was leaked onto the internet. Good Luck.

Burden of proof

[bstadil]

There's no way to prove that you didn't read the source code

That is why the concept of Burden of proof exist. It is MS' job to prove your read it AND used the knowledge.

Re:Burden of proof

[Dimensio]

Except that they'll make it a copyright cases where (thanks to the DMCA), even in criminal court, the burden of proof is upon whoever isn't a multibillion dollar corporation.

:: prediction ::

[macshune]

Just imagine the FUD/lawsuits/etc when, for some reason, Linux starts running on natively on NTFS.

Re::: prediction ::

[jonadab]

Actually, that's exactly what I was going to suggest, though not by copying.
I was going to say the first thing anyone competent in C/C++ who gets their
hands on the code ought to do (providing they don't need to take a hands-off
approach due to, say, the need to be able to legally write competing OS code)
would be to post English descriptions anonymously to usenet, describing the
way NTFS works, especially the parts that are not currently well-understood.
No source code snippets, just stuff like "it appears that such-and-such
information about each file is stored and updated whenever it changes in three
places: at offset blah in the file header info, and ...". (I don't know beans
about NTFS, so any fs jargon that leaked into that sentence may not be accurate.
But you get the idea of the kind of thing I mean.)

Then somebody else could take that information and implement a compatible
filesystem in a clean-room fashion.

IANAL, but from what I've read on slashdot, there's apparently at least a
vague possibility the resulting code might be legal. Though, one should
consult legal counsel before spending significant time on such a project.

Re::: prediction ::

[Rubbersoul]

You, my friend, win for best line I have ever read on slashdot ...

IANAL, but from what I've read on slashdot...

This is good stuff

Re::: prediction ::

[BroncoInCalifornia]

Imagine Microsoft's surprise when an Open Source developer sends them a copy of their source tree for Win2k and NTFS has been completely replaced by ext3

Or better yet-- ReiserFS!

Re::: prediction ::

[dnoyeb]

Ahhh, Samba!

Re::: prediction ::

[Anonymous Coward]

Big news: that's the way large corporations have reverse-engineered stuff from day one.

"Hey, we'd really like to know what our competitor is doing, could you take a look?"
"Sure, hold on" ..sometime later..
"Here's some specs how it works"
"Great. Hey, you coders: start implementing this"

It's legal since actual code isn't shown to the implementors, only specs.

Re::: prediction ::

[LittleBigLui]

case-sensitivity?
symbolic links?

oh my god, please, PLEASE, pretty pretty PLEASE someone do it and force them to include it. would make using windows a good deal less awkward and get it closer to being Ready for the Desktop TM.

Re::: prediction ::

[rixstep]

IANAL, but from what I've read on slashdot, there's apparently at least a vague possibility the resulting code might be legal.

This is in essence what Compaq did (the PC BIOS), but whether the controls would be good enough is of course another matter entirely.

Re::: prediction ::

[tverbeek]

The resulting source code would arguably be a "derivative work" and therefore a violation of Microsoft's copyrights. It'd be a tough case to make, but I bet it has enough merit to go to trial... which for the plaintiff is almost as good as winning.

Re::: prediction ::

[Anonymous Coward]

This is precisely what Pheonix (I think that was the company) did back in the 80's with the IBM BIOS. They had two teams physically separated in two different buildings. One team reverse-engineered the BIOS and documented how it all worked without writing a line of source code. Then, the descriptions were shipped over to the other building and that team wrote the source code for the first _legal_ IBM Compatible BIOS. Both teams, of course, documented everything for legal purposes, but the two teams weren't allowed to communicate both ways. Documentation on the reverse-engineered BIOS was the only thing to go on for development.

I have no idea how this would all play out under the DMCA (the only major law that I know of not existent in the early 80's). Let's suffice it to say that someone documenting the source code would have to be completely cut off from communication in the other direction and would exclusively analyze the source code as well as being willing to be denied access to any open source implementation (e.g. to check to see if it was done right). They'd also need to live on their own island without any real laws.

Re::: prediction ::

[Trepalium]

Not to mention lawsuits about trade secrets. Derrivative works might be a tricky case to prove, but misappropriation of trade secrets would seem to me to be much more clear cut. I'm certainly no lawyer, but it seems to me that this would be exactly what trade secret laws were designed for, unlike copyright law.

Re::: prediction ::

[myg]

Or you could just buy the NTFS internals book by Helen Custer. I'm not quite sure what part of NTFS (well, pre-NTFS v5 since there isn't a good book on v5) is so secretive?

And, FWIW, NTFS is pretty clever. The MFT (file which describes all the files) is recursively described by its self. It seems very elegant to me.

Re::: prediction ::

[Ewan]

It remains illegal if the first request of "take a look" was actually "look at this stolen property".

Reverse engineering is only legal when the original access the specs were built from was legal, e.g. decompiling a binary.

Ewan

Re::: prediction ::

[squaretorus]

i loved that phrase too - I hope the thinkgeek T-shirt / mousemat / mug are flying towards the presses right now!

Re::: prediction ::

[alecks]

No, he's right.... Remember the DVD Decoding hyku? That was legal

Re::: prediction ::

[Salvo]

Another option would be, using Descriptions of the Undocumented API's, to write an Extension for Windows which supports ReiserFS (or some other Open Source Filesystem).

This will allow Dual Boot Users to be able to access thier Windows Partition Read/Write from GNU/Linux without invoking MS's Wrath on the whole OSS Community, since it is software for Windows.

Re::: prediction ::

[jonadab]

> You, my friend, win for best line I have ever read on slashdot ...
> > IANAL, but from what I've read on slashdot...
> This is good stuff

The wording was deliberately worded in such a way as to avoid giving anyone
the impression that I was remotely certain about what I was saying. It was
an idea that was running through my head, no more.

Re::: prediction ::

[jonadab]

Reiser would be harder to do, I think, than (say) ext2/ext3. The Reiser fs
is designed to be a good filesystem, not to be easy to implement. (In that
respect, it's somewhat like NTFS I think and nothing at all like FAT.)

Actually, in terms of a filesystem being easy to implement, nothing[1] tops
plain old ordinary FAT. Even FAT with LFNs and such (vfat, that's sometimes
called) isn't too bad. Nice and simple. Only problem is, there are too many
things it doesn't support: journaling, file ownership, multiple sets of
permissions for different classes of users, ... it's a great fs for a
multiboot user to use for storing stuff you want to be able to access from
all your different OSes -- just have one partition that's dedicated to
documents and other data that you want to be able to get to from any OS.
However, FAT doesn't make such a good OS for installing an OS and applications
on, for the reasons listed.

Anyway, writing lowlevel Windows software to let you mount ext2/3 filesystems
would be an interesting and useful (albeit probably not easy) project, but it
wouldn't help one iota in terms of letting you use Linux as a rescue system
for doing repairs to Windows, nor would it let you access the data on a
stock-out-of-the-box Windows system, so it's no substitute for real NTFS
support. captive-NTFS will do for now (especially once the Knoppix version
with it comes out), but it would be nice to have real native NTFS support.

[1] Nothing that's usable as a filesystem for a general-purpose OS, I mean.
Obviously you could have a super-simple filesystem that just treats the
whole disk as one big hogfile (DHF), for example, which would be easier
than a bubble sort to implement, but performance would be like sucking
gravel through a coffee stir, and there wouldn't be any robustness.
(scandisk or fsck? forget it; if you need to check the filesystem, you
probably need to reformat the part of the drive from the point of
corruption upward.) Also, no directories, and no long filenames...

Re:omg

[CuteAlien]

But just for a while. MS will start even harder securing the sources in the future. The fixes for security leaks will be there sooner and a lot people are not interested in cracking but in getting a more secure system, so MS will get hints about security for free. So the bugs which are in the source will be fixed soon and the whole system be more safe for a while (till the next leak *g*).

I'm surprised this did not happen sooner (if it did happen now at all).

Now? Improve emulators!

[axxackall]

Well, on a serious note, the leaked sources of NT and W2K can be used by win-emulator developers to improve their emulators. No need even to copy the code (it may or may not work directly inside that emulator anyway), but when it comes to debugging the developer may look at the original code in order to UNDERSTAND why it works differently.

Besides, there are several obfuscating methods designed to hide the logic of the original code. They can be used to actually copy the code to the emulator (if the copied piece will work there). After that it would be hard to prove anything even in the open source.

Disclaimer: IANAL, but anyway, personally I would not feel guilty having W2K source code and using it to improve WINE. Because I think that the algorithms is a part of the math, which existed always even before humans came here. A programmer just discovers the piece of math and express it using one or another language. The gravity doesn't belong to Newton, the math formula that describes the gravity neither. Only the fact of discovery of gravity math description belongs to Newton, just for references. Only the fact that programmer wrote the code belongs to the programmer (or the employer), not the code itself. Just to refer in the report to the boss why one was so busy all the day. Getting the source code from Microsoft is not stealing - it's learning. There is nothing wrong in learning.

Re:Now? Improve emulators!

[harrkev]

Yup. And films should not be copyrighted because the film studios did not invent silver nitrate.

And CDs should not be copyrighted because they did not invent the photon used to read it.

If you take this to its logical extreme, any file is simply an extremely large digital number (millions of bits). How do you copyright a number? So it is then not possible to copyright ANY digital work.

Re:Now? Improve emulators!

[imbaczek]

It is possible to copyright a number. It is impossible to enforce this copyright.

Re:Now? Improve emulators!

[saynte]

I think you're confusing things... well quite a lot. Gravity is a property of the natural world. A thing which exists regardless of human intervention. Math however, did not exist before we came here, at least not human math. Math, like english, is a description of the natural world, and a way for us to understand it better. In this way, it is more like a tool than anything else.

Addtionally, algorithms are not a part of math, and they are nto a property of the natural world. They are a description of steps. You can have a daily algorithm to brush your teeth, it's not necessarily mathematical, or in the form of computer code.

Re:Now? Improve emulators!

[happyfrogcow]

and would the world really be worse off if that happened?

Re:Now? Improve emulators!

[EnglishTim]

I don't think you've every written any code, have you?

I imagine you think that Turner just 'discovered' his paintings? That Stevenson 'discovered' the Rocket? That Joyce just 'discovered' the words to Ulysses? I suppose the Wright brothers just discovered the Wright Flyer?

Re:Now? Improve emulators!

[axxackall]

So it is then not possible to copyright ANY digital work.

Finally you are getting smarter. But just for case if don't understand it yet: all copyrights are bad. The world without copyrights would be much better. Demonstration: compare the quality of copyrighted Windows to copylefted Linux.

America is great because America is good, and if America ever ceases to be good, she will cease to be great.

And this is exactly what's happened to America after 2001/09/11.

By the way, America was never better than many other countries, like England or Australia. So, guess what?..

Re:Now? Improve emulators!

[Suidae]

compare the quality of copyrighted Windows to copylefted Linux.

The GPL, and Linux, depend on copyright and exist partially as a response to the existence of copyright. If copyrights did not exist the world would probably be a much different place (maybe better, maybe not).

Re:Now? Improve emulators!

[axxackall]

I don't think you've every written any code, have you?

Actually I am doing it for living last 18 years. And I don't mind if all my code will be open-sourced. But my employers do.

Re:Now? Improve emulators!

[axxackall]

The GPL, and Linux, depend on copyright and exist partially as a response to the existence of copyright.

GPL exists as a response to copyrights, but it depends on copylefts, which is quite opposite to copyrights.

Re:Now? Improve emulators!

[Karhgath]

But without copyrights the GPL means nothing, everything would be in the public domain and thus the GPL cannot be enforced. The GPL is just a distribution license of copyrighted work. It's not because we call it copyleft that it isn't based on copyright.

Re:Now? Improve emulators!

[paulgrant]

I believe the boy is on to something...

Hrmmm...

Re:Now? Improve emulators!

[harrkev]

Finally you are getting smarter. But just for case if don't understand it yet: all copyrights are bad. The world without copyrights would be much better. Demonstration: compare the quality of copyrighted Windows to copylefted Linux.

I disagree. Let's take the simple example of writing a book. Joe's Books wants a book on birds, so they give me money to write it. I do, and Joe publishes it. Fred's book company just copies it and sells it for less because they did not have to pay me. Fred is rich, and Joe is broke. Joe will not pay me for any more books. If this happens enough, people stop writing books.

I will admit that some people may write for the fun of it, but they still have to but bread on the table, so they will do it part time. There is then less creative activity going on, and the public will suffer. For example, take Stephen King. How many book do you think that he would write if he had to fix cars or handle insurance claims 50 hours per week. If you do not like Stephen King, just insert the name of your favorite author.

I will freely admit that current copyright laws go waaaaay too far. The limit should be something reasonable, like 25 to 50 years (maybe 5 years for software). So far, Disney has managed to get a "perpetual copyright," which is bad for everybody. And, of course, the DMCA screws everybody over.

So copyright as a concept is great. It is just the implementation here in America that sucks.

Re:Now? Improve emulators!

[ianr44]

GPL exists as a response to copyrights, but it depends on copylefts, which is quite opposite to copyrights.

From GPL:
We protect your rights with two steps: (1) copyright the software, and (2) offer you this license which gives you legal permission to copy, distribute and/or modify the software.

The GPL depends on copyright, not copyleft. The GPL does, however, create/enforce copyleft.

everything is tainted

[theCat]

I don't know about the rest of you, but now M$ can make a reasonable (as in SCO-reasonable, which is to say reasonable-to-a-monkey-like-my-boss) claim that projects like WINE can be assumed to be tained once they reach version 1.0. M$ can be *expected* to go on all kinds of fishing expeditions to harrass these projects into oblivion.

This really sux.

What if it were discovered that ...

[draco ni]

Conversely, imagine if someone found parts of the 2k/nt4 code that were very similar to previously existing GPL'd code? that would be pretty interesting, too.

Re:What if it were discovered that ...

[Dr. Mojura]

How would you call them on that?

Hey Microsoft! You have GPL code in your secret Win2K code! I mean... not that we've seen your code or anything... Just guessing.

Re:What if it were discovered that ...

[Endive4Ever]

Yes. Then all they'd have to do is face the penalties for having a copy of the Windows source code, and they could make a case for it being copied from GPL licenced code.

Otherwise, I can't see how they would testify in court. I mean, they would have to prove they had illegal access to the code for their assertion to mean anything.

Re:What if it were discovered that ...

[yourmom16]

There are 2 problems with software copyrights that should have been taken into account when copyrights were extended to cover software. The first is that copyright infringement is hard to prove against closed source software without being guilty yourself. With a book for instance you can buy a copy and see if what you wrote is in there.

With software, the source is not the product, the binary is. You can't compare the binary as easily, especially since different compile options will lead to differently-optimized binaries. And you can't compare the source without having an illegal copy of it. This inequality means closed sourve can rip off open source at will, but it does not work the other way around.

The second problem is that copyrights on software do not even serve the purpose given for copyrights. When the software passes into the public domain, unless the source was leaked, people cannot build on it to make greater software.

Re:What if it were discovered that ...

[cdf123]

How would you call them on that?

Hey Microsoft! You have GPL code in your secret Win2K code! I mean... not that we've seen your code or anything... Just guessing.

Why not? Isn't this what SCO is doing?

Hey IBM! You have SCO IP in your secret AIX code, and then you put it into Linux! I mean... not that we've seen your code or anything... Just guessing.

Re:Small server they've got there

[dtfinch]

It was up for a while. I had about a minute to click around their site before it started saying "server busy". Members get to see new articles several minutes before everyone else, but this time it went down while it was still visible to members only.

Oh, no! I Looked!

[ackthpt]

10 * BEGIN
100 GOSUB 7000 ; * Load stuff
110 GOSUB 900 ; * Show windows logo
120 GOSUB 20000 ; * Prompt for operator login
130 GOSUB 32000 ; * Fill half of memory with DLL's
140 GOSUB 16000 ; * Time waster loop
.
.
.

Re:hmm seems a bit buggy

[mobby_6kl]

MS may just add different comments(or slightly modify the code) to each licensed source, and when/if they see a leak, they can easily find where the leak is coming from, for example they add something like "#Rewrite this later" on line 135 for your license, "#Redo this part" on line 563 for another license, etc. and when they see source leaked with a comment on line 563, they know which particular license is it coming from.

MS Shares

[dtml-try MyNick]

If this is true....

I think that now would be a very good time to sell all your shares/stocks in Microsoft

SCO Code in Win2000

[Anonymous Coward]

Imagine if somewhere hidden in the bowels of the Windows2000 source an intrepid SCO intern finds a sliver of SCO-owned Unix code. Then all hell would break loose...

Re:SCO Code in Win2000

[Desert Raven]

Umm, no, there would be no issue at all.

Microsoft bought a license to the SCO code, remember?

Re:SCO Code in Win2000

[UserGoogol]

Lets not forget who first wrote SCO Unix. Microsoft. Microsoft bought the rights to a Unix back in the eighties, (which they named Xenix) but DOS/Windows got too damned popular, and when they started working on OS/2 they decided to sell off Xenix to the Santa Cruz Operation. Years later, Santa Cruz Operation would recieve the rights to Unix-proper from Novell. A little after that, Santa Cruz Operation sold all their Unix stuff to Caldera, who promptly renamed themselves SCO.

Of course, this lawsuit is based on the AT&T Unix which "Classic SCO" got from Novell, not from Xenix, but... well, there's a lot of mixed up stuff here.

Re:SCO Code in Win2000

[rusty0101]

By the same logic that SCO has gone after IBM and Sequent code held by IBM, let's take a look at the history of Windows...

Windows (at least non-NT) was designed to be a gui on top of DOS. i.e. it is derivative of dos.

Dos as purchased was a 16 bit clone of 8-bit CPM, which means that it is derivative of CPM.

CPM was desined to be a single user, single tasking implementation of UNIX.

Therefore Windows (through 98) was a derivative work of UNIX.

Additionally, it is obvious that Windows NT was a derivative of OS/2. They even use the same command interpreter, cmd.exe (different versions perhaps.) Micorsoft obviously leveraged what they had learned from working with Unix in the creation of OS/2 versions 1.0-1.3. So Windows NT, and subsequent versions are all derivative works of Unix as well. This might go a long way towards explaining why the BSD IP stack was such a clean fit into Windows.

Then again, perhaps this is just flamebait...

Re:SCO Code in Win2000

[rixstep]

Lets not forget who first wrote SCO Unix. Microsoft.

This is totally untrue. What happened was that Microsoft bought a compiler from Lattice which they retrofitted for Unix, and a source code licence from AT&T, but Microsoft did NOT, I repeat did NOT, work on that source code themselves.

That source code was given to Santa Cruz, who 'developed' Xenix from that.

And I am sorry, but the very thought that the dim-witted Microsofties would have 'written' their own Unix? Sorry, but that is just too laughable.

Re:SCO Code in Win2000

[Zak3056]

Of course, this lawsuit is based on the AT&T Unix which "Classic SCO" got from Novell, not from Xenix, but... well, there's a lot of mixed up stuff here.

IIRC, Microsoft has an AT&T license, which they bought prior to starting work on Xenix. So either way, they're probably clean.

What would be interesting, however, would be someone at SCO claiming that since some of the code that was leaked was a derivative of SYSV, Microsoft has breached their contracts....

I find the above VERY unlikely though. if SCO tried such a thing, Novell would probably do the same thing for Microsoft that they have for IBM, despite the years of bad blood. What SCO is doing is bad for EVERYBODY.

Re:SCO Code in Win2000

[Eneff]

Wait...

If SCO used Xenix to build Unixware...

then I have a copy of a (current) SCO project! Unix for the Tandy 6000, no less!

I feel vaguely queasy... but does that mean I have rights to use said intellectual property? Can I at least get a discount on the 700 bucks?

Someone PLEASE...

[RyanFenton]

As someone mentioned, this would be fascinating to just read the comments. Would it be possible for someone to strip out all the code, leaving only the comments for each file, minus comment lines that ARE code? It would be GREAT just to read the "intention" and "questions" living in that code and be able to associate each with a filename. Purely for entertainment value. It would also be neat to compare comment-to-code ratio in areas of MS code. :^)

Ryan Fenton

Re:Someone PLEASE...

[man_ls]

If I can get a goahead from someone (maybe an off-the-record lawyer, or a paralegal or something) saying it's okay to post the comments without the code, I'll put them up on a site for everyone to look at.

Re:Someone PLEASE...

[menscher]

Cute. Linux 2.6.2 kernel source. About 500 took the bait so far.

Re:Someone PLEASE...

[lamont116]

If I can get a goahead from someone (maybe an off-the-record lawyer, or a paralegal or something) saying it's okay to post the comments without the code, I'll put them up on a site for everyone to look at.

IAAL, and IMO that would be a really bad idea.

Re:Someone PLEASE...

[man_ls]

Then I won't do it.

Thanks for the warning! I don't really want a lawsuit down my neck any time in the near (or far) future.

More Info + Source Snippet

[Anonymous Coward]

http://www.windowsbeta.net/ is carrying the story (not slashdotted yet) and has a snippet from TaskManager up to prove validity.

Who cares ?

[jalet]

Not me !

Theory

[Ripsnorter]

Maybe this is an evil plot by MS to scuttle OSS. Now the source code has been leaked they can start claiming that we're stealing their IP, Wine is a prime target for this. And its not as if they haven't got the bucks/lawyers to back their claims up either. This could turn out very bad.

See win2k/private/ntos/ for kernel stuff

[enosys]

The files listed in win2k/private/ntos/ appear to be kernel stuff. Yes, even asm files in there.

Re:See win2k/private/ntos/ for kernel stuff

[Anonymous Coward]

The listing appears valid, but is only a subset.

I lived for years with full source access at a MS partner company.

Example of what's missing is the file systems (only the file system recognizers seem to be there, not the file system), the entire device driver tree, storage drivers, etc. Most of the core kernel functionality is there though, if pre-service pack levels.

That is a MYTH

[FreeUser]

I hope you weren't planning on ever contributing to any Open Source projects after doing that. If it's later demonstrated that you had access to the W2K source and contributed vaguely similar code (even by accident) to a project, it could have severe repercussions for that project.

IANAL but I do read Groklaw, and from what I understand copyright restricts the act of copying (duplicating). You can study someone's implimentation of something as much as you like, then go impliment something similiar yourself. As long as you do not copy the code verbatim you are not in violation of copyright law.

Otherwise, no student would be able to code having once looked at examples in a text book ... the textbook author would own all of your code.

The problem is, of course, proving one implimented the code oneself and did not in fact crib the whole thing from someone elses code, and the greater the similiarity (for code of sufficient complexity ... trivial code will generally be similiar regardless) the more difficult that is.

In any event, it is a myth that, simply by looking at, or even studying, one set of code one is somehow "tainted" and unable to contribute to another, competing project, be it free or proprietary. To violate copyright law one must copy, not just receive inspiration from.

Re:That is a MYTH

[TheSpoom]

Do you not think that Microsoft has patents on many of the things in that code?

Re:That is a MYTH

[Bootsy Collins]

> I hope you weren't planning on ever contributing
> to any Open Source projects after doing that. If
> it's later demonstrated that you had access to
> the W2K source and contributed vaguely similar
> code (even by accident) to a project, it could
> have severe repercussions for that project.

IANAL but I do read Groklaw, and from what I understand copyright restricts the act of copying (duplicating). You can study someone's implimentation of something as much as you like, then go impliment something similiar yourself. As long as you do not copy the code verbatim you are not in violation of copyright law.

What you're saying about copyright is correct; but that probably isn't what MS would come after you (and your open source project) for. It'd be patent and trade secret violations.

That said, I don't know whether the unauthorized release of code would invalidate subsequent trade secret claims. On one hand, it seems crazy to lose trade secret protections because of an illegal or unauthorized act; OTOH, it seems crazy to call something a secret that, well, isn't. Maybe someone who is a lawyer can discuss.

Re:That is a MYTH

[close_wait]

IANAL but I do read Groklaw, and from what I understand copyright restricts the act of copying (duplicating). You can study someone's implimentation of something as much as you like, then go impliment something similiar yourself. As long as you do not copy the code verbatim you are not in violation of copyright law.

Yes, but there are laws other than copyright laws, such a trade secret and patent stuff. Also, you will have broken copyright laws just by downloading and peeking at the MS code. If MS can later claim that the peeking helped you develop some OS code, then that can help a big effect on the severity of the prosecution of you.
IANAL yada yada.

Re:That is a MYTH

[AKAImBatman]

The idea of being "tainted" is actually from licenses that have "trade secret" clauses. Once you sign a license like that, you *are* tainted. That being said, it's a very difficult clause to enforce. Contracts that prevent someone from working in the field for which they are educated and experienced have often been found unenforceable by courts.

(IANAL and this is not legal advice. Go talk to PJ. At least she's a paralegal.)

Re:That is a MYTH

[Anonymous Coward]

You're missing the point of how you got the code in the first place. You had to make a COPY to read it and that copy is a violation of copyright.

Re:That is a MYTH

[Pakaran2]

Lastly, clean room implementation is possible if someone living outside the realms of copyright protection describes the code in enough detail for someone else to reproduce. The reproduced code could probabley then be placed under any license the programmer wishes.

Where exactly doesn't have copyright protection? I know that China, and a few others, don't enforce it, but nearly everywhere HAS it.

Re:That is a MYTH

[Derek]

"IANAL but I do read Groklaw"

It was only a matter of time before people started saying this....

-Derek

Re:That is a MYTH

[thdexter]

Except, of course, in the case of process patents, some of which Microsoft undoubtedly holds. (Apple has one on the mac toolbar at the top of the screen.)

Re:That is a MYTH

[Anonymous Coward]

But did he also stay at a Holiday Inn last night?

Re:That is a MYTH

[ThomK]

You can study someone's implimentation of something as much as you like, then go impliment something similiar yourself. As long as you do not copy the code verbatim you are not in violation of copyright law.

But what if I have a photographic memory?

Re:That is a MYTH

[SquarePants]

IAAL. What you are saying is simply not true. Even if you don't copy verbatim you can be guilty of copyright infringement if you create a "derivative work" from copyrighted material. MS would probably argue that your "perusal" of their code and subsequent creation of a work based on such "perusal" would constitute creation of a derivative work. Its done all the time since only a complete moron would copy source code verbatim.

Also, because the act of copying is incredibly hard to prove unless you are dealing with a complete moron, it is not necessary under the law today for a copyright plaintiff to actually prove the act of "copying." Generally speaking, it is sufficient for them to prove "access" to the copyrighted work and "substantial similarity" between the two works. There is tons of case law on this stuff.

Re:That is a MYTH

[kfg]

Downloading material under copyright is a simple and minor civil offense. That's why the RIAA isn't going after downloaders. They could only nail them for a few hundred bucks each, tops, and couldn't use the threat of criminal prosecution to obtain it.

And that wouldn't scare much of anybody.

It's the uploader who's in deep shit for distribution. He's the only one whose actions are in any way criminal.

Now here's something to think about. What if someone else downloaded it and handed it to you?

KFG

Re:That is a MYTH

[RancidBeef]

Yeah, but you can violate a patent without seeing the code. Remember a patent covers a method, not a particular implementation. (Which is why software patents are a horrible idea, IMHO.)

Re:That is a MYTH

[mypalmike]

> Do you not think that Microsoft has patents on many of the things in that code?

Yes, but then, wouldn't reading the publically available patents be a problem?

The answer to this is, of course, yes. I used to work at a major game developer which strictly forbid us to read any patents. This policy wasn't just something you might read in the fine print of the employee manual: there was a mandatory-attendance presentation on the subject. The argument was that if a single employee read a particular patent, the whole company is legally tainted by that knowledge. Even though it's not supposed to matter, knowledgeable infringement apparently makes for a stronger case in the courts than coincidental infringement. So, if I read patent X, and another employee working on the other side of the planet unknowingly infringes on X, a case can be made that they actually knew it., because the company knew it as a whole. How could they prove I read it? There could be a server log that shows my PC was at that url at uspto.gov. Crazy stuff.

-_-_-

Re:That is a MYTH

[atheken]

Welcome to the brave new world of IP. If it were as simple as Copyright, you'd be right, but you're not.

I, for one, welcome our new W2k Cracking overlords.

anyway, all that asside, if this is true, HOLY CRAP!

Re:That is a MYTH

[r.jimenezz]

IANAL but I do read Groklaw

Wonder if this could be the beginning of a successful ad campaign for Groklaw? Similar to "but I stayed on a Holiday Inn last night"... People emitting insightful opinion on law issues and finishing it off with this remark :)

Re:That is a MYTH

[Bootsy Collins]

Correcting myself . . .

> from what I understand copyright restricts the act
> of copying (duplicating). You can study someone's
> implimentation of something as much as you like,
> then go impliment something similiar yourself.
> As long as you do not copy the code verbatim
> you are not in violation of copyright law.

What you're saying about copyright is correct;

[ snip ]

No, it isn't, and I don't know why I said it was. Too much crack today or something. The law on derivative works would make this not true, at least according to my understanding of Brad Templeton's 10 Big Myths about copyright.

Re:That is a MYTH

[Welsh Dwarf]

This has nothing to do with copyright, it's more about stolen property. It's like using a stolen VCR.

Don't touch this if you plann on codeing for a living.

Re:That is a MYTH

[Cryogenes]

What you're saying about copyright is correct; but that probably isn't what MS would come after you (and your open source project) for. It'd be patent and trade secret violations.

Patents are published information. If they have a patent on something you cannot use it, regardless whether you looked at their code or not.

The purpose of not looking at someone else's code is to prepare a defense against copyright allegations. If you can convince a judge that you never even glanced at the other party's code, then he will not find you guilty of copyright infringement, no matter how similar the code.

Re:That is a MYTH

[sangreal66]

Read the NET act

Re:That is a MYTH

[jefeweiss]

Actually copyright is what they would have to use, I think. To patent Windows itself they would have to publish (to the patent office) the source code. Then they would be able to have sole use of the source code for a period of time (I think its 7 years, but they may have upped it.) At the end of that time it would be in the public domain. They could also file for vague patents on processes, but again they would have to publish the processes. I'm not sure what the law is for trade secrets, but I think that the actual law only applies to the person who stole the source code. After that they would have to use copyright law.

Re:That is a MYTH

[pclminion]

What you're saying about copyright is correct; but that probably isn't what MS would come after you (and your open source project) for. It'd be patent and trade secret violations.

There's no such thing as a "trade secret violation" unless you are bound by an NDA. If the source is leaked and people not under NDA see it, the jig is up -- your trade "secret" is fucked.

That's the different between patents and trade secrets. With a patent, you must publish details of the invention publicly, but you have an exclusive right to license the use of that invention. With a trade secret, you have no legal protection against other people using it, but you don't disclose it publicly.

It's kind of like security through obscurity. With a patent you rely on force of law. With a trade secret you rely on people keeping their mouths shut. You might manage to keep it under wraps for years, but once it's out, you are fucked. Even if the person who leaked it was under NDA, the only recourse you have is against that particular individual. Your secret is still out, and suing the hell out of someone won't change that.

Re:That is a MYTH

[Anonymous Coward]

So now you've got the choice between taking legal advice from non-lawyers and a lawyer who calls himself SquarePants. Go figure.

Re:That is a MYTH

[euxneks]

Actually, the company just has to prove that your program is sufficiently similar to prove copyright. It doesn't even have to have the same code. For instance, there was a case of "look and feel" where the company infringed on copyrights based upon how the software actually looked. The defendant had made a program with a UI that had a sufficiently similar UI as the company doing the suing. I think it was Broderbund vs Corel or something along those lines (Corel was suing for a copyright infringement on their print shop program)... Corel won the case, as they were able to prove that you could create a banner, card, etc. printing program without the same look and feel of their program (they gave an example of sticky bear or something)..

Anyway, the main point is that you don't have to copy the code exactly to be infringing upon copyright.

Re:That is a MYTH

[taernim]

IANALBIDRG... new acronym?

Re:That is a MYTH

[canajin56]

Sure: A trade secret is something that only people in your company would know. Trade secret laws allow you to sue people who break their duty of secrecy. The only people who have such duties are employees, and anybody who signs an NDA. If somebody works at Microsoft, and give you the code, they can be sued for violating trade secrets. But NOTHING you do will get you in trouble WRT trade secret laws. If you hack into their computers and copy the code, STILL no trade secret laws have been broken.

You can only lose trade secret protections if it becomes common knowledge. A few thousand copies out there isn't common knowledge. And it most certainly isn't crazy to lose these protections if the secret is found out. The law doesn't protect the knowledge, it protects against employees leaking that information.

Re:That is a MYTH

[PeeweeJD]

...I am not a doctor, but I play one on TV...

Re:That is a MYTH

[kfg]

Hey, they redefined financial gain.

Cool beans, huh?

Kinda like when they redefined promoting to mean possession.

KFG

Re:That is a MYTH

[Zaiff Urgulbunger]

And by extension, anyone could prevent something being copied simply by broadcasting the designs!

Re:That is a MYTH

[debrain]

Contracts that prevent someone from working in the field for which they are educated and experienced have often been found unenforceable by courts.

On the contrary, there is a very long and solid history of exclusionary contract law that stipulates enforceable prevention of work in a specific field. The most common and cited examples are the contracts of actors and musicians.

A specific example is Warner Bros. Pictures Inc. v. Nelson, [1937] 1 K.B. 209 (Ch.D.). Nelson wanted to work for another company. In there contract there is a negative covenant ie. defendant must not work for another company, so what is the plaintiff (Warner Bros) entitled to? Typically courts award damages to the plaintiff, but in this case, they specifically enforce the covenant, and prevent Nelson from working for the competitor.

So it goes for the rest of us, too ... if you are privy to trade secrets, you may have to sign an agreement that prevents you from contributing to certain projects. It is unlikely the trade secret owner could prevent you from working for a competitor, for example, unless they could prove that you had intentions of revealing the trade secret.

This intention may be intrinsic to, or constructed from, the position offered for employ (ie. food engineer for Coke becomes food engineer for Pepsi) for which they could get an injunction preventing that particular employment.

Or something like that. ;)

Re:That is a MYTH

[adrianbaugh]

They could only get the original leaker for trade secret violation: once the secret is out it isn't a secret anymore. Patents might give them legal recourse (I'm sure they have many), but if you're infringing a patent they hold it doesn't matter whether you've seen the code or not, they can get you anyway. MS presumably have a very great many patents but whatever else they do that's bad they don't generally use their patent portfolio to hound their rivals.

Re:That is a MYTH

[adrianbaugh]

If you agree to be privy to trade secrets you can be strung up by the bollocks if you disclose those trade secrets to a third party. The person who leaked this code could be crushed, if caught.

However, once it's out it isn't a secret any more. If you haven't signed the trade secret agreement you aren't bound by it (that's why Coca-Cola goes to such great lengths to ensure that nobody discovers the secret recipe for Coke, etc.)

Re:That is a MYTH

[adrianbaugh]

Just adding to my point: you had it the wrong way around. It isn't the case that if you discover a former trade secret you have to sign an agreement that prevents you using that knowledge. Rather, if you work for certain companies you will have to sign an agreement saying you won't divulge trade secrets to third parties.

But once someone has divulged the 'secret' it isn't secret anymore. Anyone who hasn't signed the "I won't tell anyone" agreement has no obligation not to distribute it further.

Re:That is a MYTH

[dspeyer]

I think you're overstating a bit.

Firstly, as you said, there must be 'substancial similarity'. Reading code once does not make everything you write forever afterwards a derivative work.

Secondly, the 'access' rule is easy to get around. If you have one engineer read the code, and document the format/protocol, and then another engineer looks only at the documentation, this shouldn't count as 'access', right?

What's a lot worse than copyrights are trade secrets. Why I'm obligated to defend Microsoft's secrets I have no idea, but that seems to be the way the law is structured. If someone's willing to take the risk of posting documentation to usenet, however, that information will no longer be secret, and that won't be an issue any more.

Patents are irrelevant: having seen code has no effect on the binding power of a patent.

Re:That is a MYTH

[debrain]

you had it the wrong way around. It isn't the case that if you discover a former trade secret you have to sign an agreement that prevents you using that knowledge. Rather, if you work for certain companies you will have to sign an agreement saying you won't divulge trade secrets to third parties.

Yes, it is the contract, and breach thereof, that sits you in really hot water. However, there may be an implied agreement in the employment, but I think it's less likely, results in much less consequential damages, and falls back on foreseeability.

For example, if you did find out Coca-Cola's secret formula working in their head office as a janitor, from somewhere other than through the public, you may be liable for damages caused if you publish it, based on the objectively reasonably foreseeable damages to Coca-Cola.

Mind you, I didn't look for much case law in this respect, so I can't say for certain if it has ever been prosecuted like that. I think that's how the theory goes, offhand, mind.

Re:That is a MYTH

[CAIMLAS]

Hrm. That seems contrary to my understanding of 'copyright'. If you might clarify some things for me, it'd be appreciated.

Let's say my neighbor invents a Humdinger, and markets it. I buy one, take it appart, and notice some flaws in it. I then make some modifications (improving it), and start marketing my own Humdinger, but under a different name. From what I recall about -copyright- law, this is perfectly permissible. It's patent law that this would be a violation under; correct?

It seems to me that if I were to see the source code to Windows, and then write a work-alike that is more efficient (or even less efficient, for crying out loud), this should be permissible - under copyright law. However, since there are patents involved, it would not be OK, in some respects.

Re:That is a MYTH

[jgoemat]

IANAL but I do read Groklaw, and from what I understand copyright restricts the act of copying (duplicating). You can study someone's implimentation of something as much as you like, then go impliment something similiar yourself. As long as you do not copy the code verbatim you are not in violation of copyright law.

Copyright law not only gives you a monopoly on controlling the distribution of your works, but also on controlling the creation of derivative works. Facts, ideas, and methods cannot be copyrighted, as well as something that is an industry standard or if there are only very few ways of doing it. Ideas and methods can be patented, but that is a more difficult process and the protection doesn't last nearly as long as copyright.

Copyright protects expression, which isn't all that well defined as to how it applies to software. There are different levels to determine if something violates copyright if someone has seen another person's source code or if they haven't. If someone hasn't seen the other person's source code, you pretty much have to prove outright copying to sustain a copyright infringement claim. Things that could be used to do that are errors that are in both versions, having code with identicle variable names, etc. If you have had direct access to the source code however, the original author only has to prove that your code is substantively similar, which is a lower standard.

Re:That is a MYTH

[analog_line]

"Generally speaking, it is sufficient for them to prove "access" to the copyrighted work..."

Well, doesn't this currently mean just about anyone on the planet with an Internet connection?

Re:That is a MYTH

[flab007]

>There could be a server log that shows my PC was at
>that url at uspto.gov

that only proves something (and I state 'thing') originating from your company made a connection to that URL. But it is nearly impossible to prove some*one* also actually *read* the page that was displayed on the screen.

Re:That is a MYTH

[Rich0]

I have no idea where to get the decision from that case, but aren't most acting contracts two-way streets?

If I sign a contract with IBM that says that for the next 10 years I can't leave them and they can't fire me, then I can see that being fair.

If I have to sign a contract that says that I can't leave them, but they can fire me at any time and keep me from working for any other technology/business-machine/informatics/consulting /whatever-else-IBM-does company for 10 years than that is unfair.

Contracts are supposed to be two-way streets.

Re:That is a MYTH

[rjamestaylor]

IANAL but I do read Groklaw

I believe you. But then I suspect your reading comprehension is rather low:

• Anyone looking at this code could bring to an end any opportunity to contribute to FOSS software in the future.

Source: http://www.groklaw.net by PJ

oops.

Re:That is a MYTH

[debrain]

If I have to sign a contract that says that I can't leave them, but they can fire me at any time and keep me from working for any other technology/business-machine/informatics/consulting /whatever-else-IBM-does company for 10 years than that is unfair.


Contracts are allowed to be unfair. It's the signing of a contract, a "meeting of the mind" and a quid pro quo, an exchange, that makes a contract a legally enforceable promise. Many people and companies have lost money on bad contracts, and they are still bound to the terms of it.

There are cases where fairness comes into play. First, if you did not consider the contract before agreeing to it. This is overcome by signing, witnessing, or sealing documents. Do any of those, and you decrease the value of an argument that you didn't consider the implications of the contract. Oral agreements are legally enforceable, but they are more likely to fail on grounds of consideration than written, signed, or sealed contracts.

Also coming into play is a doctrine of unconscionability. If a contract is *really* unfair, it may be considered partly (ie. cy pres) or wholly unenforceable (ie. void). Similarly, if the contract was agreed to under duress, such as threat to security of person, then it may be unenforceable.

You are legally allowed to breach a contract, but the law provides for damages (economic recovery) for said breach. The fairness of that recovery is probably more interesting to you than the fairness of the contract itself, though the contract's fairness is a valid consideration.

In the case of IBM you cited, above, you are bound to not compete for 10 years unless there is something in employment law about non-compete agreements. You are not bound to work for them; courts will never enforce that, particularly in the USA, because it is considered a form of slavery. They can, however, issue an injunction preventing you from doing something, such as competing.

There may be common law or statutory rules that create fairness in employment competition. It is generally recognized that the employer is usually in a position of power.

Re:That is a MYTH

[debrain]

These type of contracts that prevent you from working in your field are typically only enforceable if compensation is provided in exchange. Such compensation has to cover likely earnings as well as lost experience. The prohibition also has to have a limited lifespan - you'd rarely get away with more than 5 years.


The case law I have seen speaks totally contrary to a compensation principle. Do you have any examples?

If I recall correctly, in Warner Bros. Pictures Inc. v. Nelson, I believe the judge suggested menial labour, because he did issue an injunction preventing Nelson from working as an actress. Eventually Nelson went back to WB.

I think the limited lifespan is correct, but I don't know what factors affect how long it can be.

So...

[El]

My question is, has anybody managed to get this steaming pile of manure to compile? Seems like one would need to do that and then compare the binaries (ignoring any timestamping) before assuming this is authentic.

Re:So...

[Anonymous Coward]

I've had some luck. It looks like a bunch of header files are omitted that are included with Visual Studio 6 and 5, and making all the empty directories it expects for the build is hellish.

The biggest hurdle to get over was figuring out that each directory needed to be its own library, and you had to turn on PASCAL calling methods by default in Visual Studio's C preferences for all the directories not named "private"

I found mine at http://www.skittlebrau.org/ring0_src.tar.bz2.torre nt but I don't know if that's still up.

Re:So...

[dsanfte]

That file is 32 megs. Are you entirely certain that's the MS source code? I really, really doubt it.

Re:So...

[menscher]

Cute, but before anyone wastes more bandwidth on that, the torrent is the 2.6.2 kernel source.

Re:So...

[Mr. Darl McBride]

Mod parent down as troll!

Bill did it!

[Anonymous Coward]

Maybe Microsoft leaked it intentionally?

1. Once this code gets publicly reviewed, everyone will want to get rid of it. Fast. And a lot of them are dumb enough to upgrade to XP because Bill says it's "better".
2. Windows has no real IP value: it isn't nearly good enough to compete in the market without the hardware/software lock and MS pushing it. I wouldn't advertise that my stuff had MS technology in it!
3. At this point they'll SCOre more out of Win98 with a few lawsuits than any other way.

"a deluge of worms/virri" - how will we know?

[Anonymous Coward]

Get ready for a deluge of worms/virri.

And the sign for this will be????

Seems a little small

[Spad]

windows 2000 source code.zip - 203.85Mb

All the images of 2000 Pro I can find are at least 350Mb, so it's probably pushing it to get that down to 200Mb in the source.

Re:Seems a little small

[opusman]

Source code (being mostly text) should compress a lot better than compiled binaries.

Compressed mirror

[delta407]

That's a 3 MB text file. Mirrored as:

• files.txt.gz - 250 Kb
• files.txt.bz2 - 194 Kb

There ya go.

zerg

[Lord Omlette]

Um, so what? China has had access to the source code for a while now, MS' way of keeping them away from Linux. (Unless that changed) Anyone in the U.S. who wanted teh source could hop on over to the local Academic Alliance affiliated school and sneak in and burn the source from there.

Pretty much the only ones who don't have access to the Windows source code are the people who don't want it.

Then again, maybe this story is like patents:
boring idea == yawn
boring idea over network == teh r0xx0rz!

Stop beating that poor server - edonkey mirror

[Anonymous Coward]

files.txt

and since Slashcode mangles ed2k-links: here for copy&paste (remove any spaces)

ed2k://|file|files.txt|2390731|959770f9507c332f268 91cade243c126|

Oh and BTW, this is just a LIST of files, not the sourcecode itself. So don't get cocky about copyrights.

Re:Stop beating that poor server - edonkey mirror

[tjw]

grep gnumakefile files.txt |wc -l
185

I guess I'm not the only one that thinks nmake sucks.

Screw legality

[schmiddy]

Know what. Screw the whole legality issue. Those who have a foot in both the software design (even OSS?) and warez scene need to nab this. Much positive work could be done with windows/linux compatibility once we figure out the obscure protocols that windows uses. Yeah, it'll be legally grey, but who cares.

This will probably elicit a lot of replies about how Linux needs, especially now, legitimacy, especially under scrutiny of corps hoping to use it on desktops/servers. Individuals wouldn't care as much, obviously. They're right, in part at least. However, I've always admired the range of software choice Linux has, and just like Debian doesn't ship with all the necessary mplayer codecs.. they're out there, if you want 'em.

On another note.. what if someone took the code, released Linux software designed to help, say, samba, or something. Then another developer, without looking at the actual code for that program, made their own derivative by decompiling/whatever?

Here's some of it....

[C A S S I E L]

Neowin.net is reporting that Windows 2000 and Windows NT source code has been leaked to the internet.

The server is currently slashdotted, but I managed to download the first few lines of the Windows 2000 codebase. Here they are:

10 REM Windows 2000 Operating System
20 REM (C) Microsoft Corporation
30 REM Note: TO DO: fix up security stuff
40 REM :
50 REM :wq
60 REM exit^M^M quit ^C

Re:Here's some of it....

[ivanmarsh]

What! No GOTO's?

Re:Here's some of it....

[Thoron]

Do you really think that they even have 'fix up security' on their TO DO list? ;-)

Foul Play

[lcde]

Shamefully we will now see how much foul play occurs when a non-open source peice of software becomes available.

Especially one that is supposed to run 90% of desktops.

Re:hmm seems a bit buggy

[nehril]

I would not be surprised if MS watermarked the sources somehow for each recipient (in the comments, telltale spacing or whitespace, etc).

it would be easy to automate and hard to detect. I'm sure the list of suspects will be small, and blame will probably land on a hacked/wormed workstation.

Legal Tactic

[Shadowin]

I bet this is so they can pull a SCO "they copied our source" crap.

Wedge reference

[Chiron Taltos]

Look at the size of that thing!

What, no GPFL?

[namespan]

I was expecting the General Protection Fault License.

Re:What, no GPFL?

[FooAtWFU]

The General Protection Fault license is simple.

General Protection Fault is (C) Copyright 1998-2004, Jeffrey T. Darlington. All rights reserved. No portion of this web site, in whole or in part--including text, images, and software--may be reproduced or redistributed in any form without express written permission from Jeffrey T. Darlington, unless otherwise specified. The intentional or unintentional use of the GPF comic strip on the Internet without the direct and explicit written permission of the author can be viewed as a violation of United States and international copyright law. This includes display on any publicly-accessable Web site or distribution via electronic mail (e-mail). We have lawyers; don't make us use 'em. For more information on copyrights and valid uses of the GPF comic, please read the copyright-related sections of our FAQ.

Pffft...

[TheSpoom]

The Win2K Source was released a while ago.

Re:Pffft...

[fredrikj]

You know, it's somewhat amusing to hypothesize that Microsoft might've used Comic Sans internally for viewing and printing code...

A little caution...

[arch_helmet]

A search of Google News reveals that the only reputable newsfeed reporting this groudbreaking story is, in fact, Slashdot.

Can we really believe this? As the story says, this should be huge news. Can anyone who has the files confirm that they do indeed look remotely like one would imagine the Windoze code to look like (hint: look for the holes).

Something worth considering, anyway.

Re:A little caution...

[Endive4Ever]

There's a press release up on Microsoft's website about this here now.

you know...

[glen604]

someone could combine this with the sourcecode for half life 2 and make some sort of super half-life playing game os... or something like that...

Re:you know...

[jdtanner]

I could just see the final sequence...

You are given the choice of fighting off hundreds of bad guys or going to work for Bill Gates (the Administrators true identity)!

I know which one I'd prefer ;-)

Foul play evidence?

[Gorimek]

So if this is real, I want to see evidence of all the dirty tricks code that allegedly is in Windows.

I mean the code that supposedly makes competitors products break, and god knows what other bad stuff I've heard about over the years.

Anyone working on this?

Mirror

[jeroenvw]

mirror

thinkgeek shirt?

[dAzED1]

back long ago, I got a couple of the DeCSS shirts from Think Geek as part of the silly-protest thing.

So umm...not that it would be protesting anything really, but when can we buy shirts with a bit of this on it? ;)

Next thing...

[Anonymous Bullard]

Before we know it Billy G. III is demanding that Linus must show him his communistic secret sauce, and gets an injunction against Mr T. courtesy of too many friends in high places!

Or perhaps some astroserfs have been working undercover for months impersonating genuine geeks and inserting unflattering comments into Linus' communistic secret sauce and now with these leaks out in the wilderness someone not in on it can take care of the discovery!

Or maybe this is just a seemingly innocuous plot to scare laggard Weenies to do their duty and play another round of planned obsoletion and fork out some cash to Billy for another upgrade!?

Or maybe MS realized that their upside-down financial pyramid is about to tilt if they must keep giving heavy discounts to their customers to fend off Linus' communistic plot for world domination and decided that it's time to play the piracy card to at least hold on to their market share a little longer

Or maybe... just maybe there is no spoon here for neowin to win and this is a win-win situation somehow?

It's a TRAP!!! /Adm. Ackbar

[Thud457]

Microsoft is sooooo obviously trying to pull an SCO here.

If you work on any Open Source project, DO NOT LOOK!

It's not hard to find...

[NotQuiteReal]

This was one of the first hits on Google: Windows Source Code

An oldie, but a goodie [scroll up to the code].

GNU make users?

[k98sven]

Strewn through that list of files we find quite a few named "gnumakefile"..
Would MS really use GNU make??!

Re:GNU make users?

[TioHoltzman]

No they wouldn't.

There have been articles on the web describing alot of their NT build process. They do use command line builds. They originally wrote a custom version control system, but now use something else (not Visual Source Safe, I think perforce, or perhaps they created anotehr system). I believe, if memory serves, that they had a custom make tool, but they may now use nmake, which is the make tool that's distributed with their commerical dev tools.

I recall the article did mention the use of perl for parts of the custom build scripts.

As a long time windows programmer, frankly, this stuff looks made up. Clever, amusing, but ultimately it seems like a hoax. If this is all the proof we have, then I'm afraid it's a bit pathetic!

Also there appear to be duplicate headers, repeated in various directories that I'm almost positive would end up screwing the compile process in a real build. Also, another thing is that, if their distributed files with VC6/7 are indicative of their internal naming, they stick to a strict 8.3 naming scheme, and make note of this in their documentation (don't remember *where* it was that I read it, but it was MS docs, and I remember being surprised by it). Another thing, again assuming that the files distributed with VC6/7 are a good model, their files tend to be all UPPERCASE! For example, here's a listing from their includes in for VC6:

-rwx------+ 1 Administ None 21912 Apr 24 1998 ACCCTRL.H
-rwx------+ 1 Administ None 27863 Apr 24 1998 ACLAPI.H
-rwx------+ 1 Administ None 3735 Apr 24 1998 ACLCLS.H
-rwx------+ 1 Administ None 747 Apr 24 1998 ACLSID.H
-rwx------+ 1 Administ None 269 Apr 24 1998 ACSMGTC.H
-rwx------+ 1 Administ None 267 Apr 24 1998 ACSSVCC.H
-rwx------+ 1 Administ None 833 Apr 24 1998 ACTIVECF.H
-rwx------+ 1 Administ None 1111 Apr 24 1998 ACTIVEDS.H
-rwx------+ 1 Administ None 39805 Apr 24 1998 ACTIVEX.MAK
-rwx------+ 1 Administ None 3794 Apr 24 1998 ACTIVEX.RCV
-rwx------+ 1 Administ None 2053 Apr 24 1998 ACTIVEX.VER
-rwx------+ 1 Administ None 68013 Apr 24 1998 ACTIVSCP.H
-rwx------+ 1 Administ None 17845 Apr 24 1998 ACTIVSCP.IDL
-rwx------+ 1 Administ None 3402 Apr 24 1998 ADDRLKUP.H
-rwx------+ 1 Administ None 18946 Apr 24 1998 ADMEX.H
-rwx------+ 1 Administ None 10051 Apr 24 1998 ADMINEXT.H
-rwx------+ 1 Administ None 2827 May 31 1998 ADOID.H
-rwx------+ 1 Administ None 343678 Jun 19 1998 ADOINT.H
-rwx------+ 1 Administ None 135222 Jun 2 1998 ADOMD.H
-rwx------+ 1 Administ None 14127 May 31 1998 ADOMD.IDL
-rwx------+ 1 Administ None 5083 Apr 24 1998 ADPTIF.H
-rwx------+ 1 Administ None 1133 Apr 24 1998 ADS.ODL

Re:GNU make users?

[spectecjr]

Also there appear to be duplicate headers, repeated in various directories that I'm almost positive would end up screwing the compile process in a real build. Also, another thing is that, if their distributed files with VC6/7 are indicative of their internal naming, they stick to a strict 8.3 naming scheme, and make note of this in their documentation (don't remember *where* it was that I read it, but it was MS docs, and I remember being surprised by it). Another thing, again assuming that the files distributed with VC6/7 are a good model, their files tend to be all UPPERCASE! For example, here's a listing from their includes in for VC6:


1. Filenames can be shared in different folders with no issue. No problem whatsoever.

2. 8.3 filenames are *only* needed for ISO9660 CDRs. The source tree uses whatever filenames people want.

Re:GNU make users?

[TioHoltzman]

8.3 filenames are *only* needed for ISO9660 CDRs. The source tree uses whatever filenames people want. No, my understanding was that it was microsoft policy to use 8.3 naming because of backward compatibility (with older filesystems, i.e. Win 3.1, DOS, etc). Any of the released code with VC6 (and I think VC7) is 8.3. And I remember reading them suggesting that people follow this as well, for their own code.

Re:GNU make users?

[spectecjr]

No, my understanding was that it was microsoft policy to use 8.3 naming because of backward compatibility (with older filesystems, i.e. Win 3.1, DOS, etc). Any of the released code with VC6 (and I think VC7) is 8.3. And I remember reading them suggesting that people follow this as well, for their own code.

Having worked at Microsoft, I beg to differ. Source filenames are whatever you want. Files which have to be distributed externally are 8.3 because of ISO9660 (and a slight efficiency increase on VFAT systems). But files used internally? That's personal preference.

Re:GNU make users?

[TioHoltzman]

OK, then a question for you:

the file listing is clearly a unix style file listing, i.e. use of "/" as a directory separator as opposed to "\", and the filesystem apparently looks like Unix style single rooted file heirarchy (i.e. no volume names like "C:" or "G:"). Does MS really store files on Unix servers?

Re:GNU make users?

[Halthar]

Just a guess, but the file listing was probably put together by someone who downloaded the file and then opened it. If they were using a *NIX OS at the time of spitting out the list, then you will see the *NIX style file listing for the set.

It looks to me as though someone just posted a dump from stdout.

They may store files on *NIX servers, they may not. I personally get the feeling from all of this that the leak came from outside the campus in Redmond, as has been mentioned elsewhere in these many threads, lots of people have access to chunks of the source.

Post the damn link!

[MasTRE]

Where's the Torrent? Huh? The first post should _always_ be the Torrent of the post.

Great for many Linux projects

[FunkyOldD]

So we'll finally get to see NTFS driver that can write to the partition... SAMBA will be fully compatible with Active directory...

A lot more lawsuits are coming?

[ezh]

Now SCO can sue Microsoft for stealing their code, too! *LOL*

Seriously, though... If the circulating source is really NT4 & W2K, that would give a powerful instrument to both sides - the ones who wants to sue Microsoft for stealing their technologies and for Microsoft, too, since from now on they will be looking very closely at newcoming products of their rivals.

Re:The shit will hit the fan + Mirror

[Lehk228]

Having the source you could do a cleanroom implementation of it, have a set of "dirty" developers read and describe the undocumented API's and another set write those API's from scratch

MS giving source code to countries

[xandroid]

I seem to remember reading that Microsoft gave China access to the entire source code, after the country mentioned that it was leaning more towards using Linux for government-related things, because the entire source code was open for inspection.

Re:MS giving source code to countries

[leerpm]

I guarantee, that if it was one of these countries who gave it away. They will be caught. Why? Because Microsoft probably made small but unique cosmetic changes to each of the codebases they released. Essentially, putting a unique fingerprint on it in each instance they have shared out the code.

Re:MS giving source code to countries

[adrianbaugh]

Whereas SCO were stupid to mess with IBM, for Microsoft to mess with China would be utter lunacy, especially given China has the source code. Regardless of what political ticking-off MS can ask for China to receive, China has the source. It has a regime where it can require (literally) millions of people to work their way through the code, write as many utterly hideous virii as they can and release them all. Make no mistake, while China might get a slap on the wrist it's nothing worse than they continually get for their human rights record: on the other hand, they seriously have the resources to destroy MS if they're pissed off enough. I think MS made a stupid deal when they gave the source code to an insecure OS to a government like China's.

Re:MS giving source code to countries

[Slack3r78]

It has a regime where it can require (literally) millions of people to work their way through the code, write as many utterly hideous virii as they can and release them all. Make no mistake, while China might get a slap on the wrist it's nothing worse than they continually get for their human rights record: on the other hand

So China is already forcing people to write code for Windows? *shudder* ;)

Re:MS giving source code to countries

[Dayflowers]

Its ridiculous to believe that China would not suffer any repercussions if it were to openly do that. I really don't think they'd p!ss 0ff the whole "Western World" by doing anything like that.

Re:MS giving source code to countries

[octal666]

And they are going to sue, for example, China if they did?

Re:MS giving source code to countries

[Faithman2k]

This is short sighted... China would then be ostracized (sp?) by other countries and possibly have economic sanctions brought against them (especially by the USA to whom they have the biggest trading surplus)... nope, it ain't gonna happen. China values trade more than stomping on one little IT company.

Re:MS giving source code to countries

[Gulthek]

It has a regime where it can require (literally) millions of people to work their way through the code

You can say that of any large government.

Re:MS giving source code to countries

[danila]

But can you prove it was a deliberate leak, not an unfortunate incident?

Re:MS giving source code to countries

[smchris]

It's my understanding China is one of the biggest buyers of the treasury bills that are supporting our deficit spending and keeping the dollar from crashing. It's doubtful even Mr. Bill could get Dubya to take on China at this point in the game.

Re:MS giving source code to countries

[ausoleil]

This is short sighted... China would then be ostracized (sp?) by other countries and possibly have economic sanctions brought against them (especially by the USA to whom they have the biggest trading surplus)... nope, it ain't gonna happen. China values trade more than stomping on one little IT company.

No, there would be great whining, wringing of hands and lots of posturing, but at the end of the day, nothing concrete would come of it except more hot air over Washington, D.C. Why?

1. Have you noticed that China has become a large market for many US companies? (Microsoft included.) Do you think that these companies would appreciate being locked out of this market because China decided to punish the punishers?

2. China has become a large manufacturing sector for many American products. Many Fortune 500 firms do a lot of manufacturing in that country. No doubt they would not appreciate problems and reprecussions.

3. As mentioned elsewhere, China is largely funding our budget deficit by buying Treasury notes. In other words, they're cashing George Bush's checks and he knows it.

Finally, everyone is quick to jump the gun to say that the Chinese have released Microsoft source code. For all we know, it could have been anyone. However, I wouldn't want to be that person/organization/country as they will then have the wrath of a company whose worth is more than many nations upon them, not to mention the powers that be in the US government. In other words, prepare yourself for a long stay in a cold cell.

Re:MS giving source code to countries

[Faithman2k]

Obviously I can't mod, but I do think your comment was insightful... moderators do your thing please.

Holes in all Windows systems?

[miffo.swe]

Since XP isnt such a big rewrite of the NT codebase a significant number of holes found in the NT/2000 code will most probably also be lurking in XP/2003.

If this really is true the ramifications on the security of windows is really big. In contrast linux is getting SELinux functionality implemented as we speak.

I hope this isnt true because it would turn the world of computers totally upside down and have big impact on innocent bystanders who bought into the MS marketing lies.

Re:It's a TRAP!!! /Adm. Ackbar

[vrtladept]

In my best Bruce Campbell voice "Stop, it's a trick. Get an axe!" Hail to the king baby!

Syncronicity

[Xoder]

And I was just reading this node just about an hour ago. Scary.

So who's taking bets on each of the given possible scenarios?

The dirty room and the clean room

[tepples]

As long as you do not copy the code verbatim you are not in violation of copyright law.

Copying of nonliteral elements is actionable infringement. That's why many reverse engineering firms have two separate teams: one to describe a piece of copyrighted code and another to implement it.

In any event, it is a myth that, simply by looking at, or even studying, one set of code one is somehow "tainted" and unable to contribute to another, competing project, be it free or proprietary. To violate copyright law one must copy, not just receive inspiration from.

Try telling that to the estate of George Harrison, who lost in Bright Tunes v. Harrisongs. It's possible to copy without knowing you're copying, and it's still infringement.

Re:The dirty room and the clean room

[adamofgreyskull]

That's why many reverse engineering firms have two separate teams: one to describe a piece of copyrighted code and another to implement it.

So, if someone downloads the code, and describes it, in plain english,or in a haiku to the Wine team, that would be ok? :o)
I volunteer...just because I like the idea of the "dirty" room :o)

Re:The dirty room and the clean room

[Dalcius]

"Copying of nonliteral elements is actionable infringement."

Not confusing copyright with patents and trade secrets, are you sure? From what text I've seen on copyright law (forget the courts for a moment), it's very clear that *ideas* are not copyrightable, that you must have a complete work. It even goes so far as to specify what types of works, e.g. written words, music, etc.

Can you correct me on this one?

Cheers

Re:The dirty room and the clean room

[tepples]

Nothing you read on Slashdot is legal advice. Trust it only as far as you would trust information provided by a paralegal, and probably not even that far. If you want legal advice about a copyright issue, find an attorney licensed to practice in your jurisdiction, preferably one who specializes in copyright law.

So, if someone downloads the code, and describes it, in plain english,or in a haiku to the Wine team, that would be ok?

For the most part, copying ideas does not infringe (17 USC 102). You should still see an attorney though.

I volunteer...just because I like the idea of the "dirty" room

Yes, you could participate in the dirty-room side of a reverse engineering project, but you'd need to submit to a Federally accredited brainwashing before you could ever write free software again.

Re:The dirty room and the clean room

[Daniel]

it's very clear that *ideas* are not copyrightable

Tell that to the FreeCraft folks.

Daniel

from the mirror

[tuggy]

Neowin has learned of shocking and potentially devastating news. It would appear that two packages are circulating on the internet, one being the source code to Windows 2000, and the other being the source code to Windows NT. At this time, it is hard to establish whether or not full code has leaked, and this will undoubtedly remain the situation until an attempt is made to compile them. Microsoft are currently unavailable for comment surrounding this leak so we have no official response from them at the time of writing.

This leak is a shock not only to Neowin, but to the wider IT industry. The ramifications of this leak are far reaching and devastating. This reporter does not wish to be sensationalist, but the number of industries and critical systems that are based around these technologies that could be damaged by new exploits found in this source code is something that doesn't bare thinking about.

Re:hmm seems a bit buggy

[weileong]

But then in a cost-benefit analysis it doesn't make sense.

I mean, so they can trace who leaked it. But unless they are doing it for the pleasure of catching someone leaking ("AHA!I KNEW IT! YOU GUYS LEAK OUR CODE!"), there's no net benefit in it because the source code would STILL HAVE BEEN LEAKED.

You're trading the "crown jewels" for the dubious value of catching a leak, and it's not like whoever leaked it can pay MS sufficient damages to make up for it.

Unless it's not a net-negative for MS to have the code leaked (which the black-helicopter crowd seems to have pointed out), it makes no sense.

Mirror: An Insightful comment from Neowin

[metroid composite]

#1.3 Reply by cowabunga on 13 Feb 2004 - 02:16
About when is it time to buy som Microsoft stock? In an hour when it plummets and then sell tomorrow when its back up after they find out its all bull

Maybe someone trying to make some money this way or MS is agressivly pushing their customers over to XP

Worth mirroring I thought.

Re:Mirror: An Insightful comment from Neowin

[narfer]

heh, markets are closed.

Re:Mirror: An Insightful comment from Neowin

[fltsimbuff]

"...or MS is agressivly pushing their customers over to XP"

Doubtful. Even if the Kernel had extensive modifications from 2k to XP, I'm willing to bet that 90% of the code is the same. Leaking it would bring down probably every other OS they have put out to date, since none of the are complete, from the ground-up rewrites.

On the upside, maybe MS will start all over... and make it more secure this time...

Re:Mirror: An Insightful comment from Neowin

[thrill12]

Probably will cease trading if it's dropping to steeply...

Re:Mirror: An Insightful comment from Neowin

[dcam]

Take the tinfoil hat off. XP is very close to 2000 under the bonnet, hence any security vulerabilities discovered in this code are likely to migrate across to XP as well.

If you take a moment to look at the documentation for the Win32 API, you will see that 2000 and XP share the same major number for the OS (5), but have a different minor number (0 and 1). In other words 2000 is Win 5.0, XP is 5.1.

Not gonna happen to me

[schapman]

hmm.. looking at the way windows runs.. dont think i want to copy their ways of doing things. Also, I wonder if we are gonna have underground patches for security flaws now ;P

Bad news for everybody

[nyjx]

As commented above - if this is true the Windows security through obscurity model is really threatened by this. An outside worry has to be that the cost of maintaining Win2k and NT system is set to rise due to this code availability -> meaning all those with windows boxes will increasingly have to consider going to XP.

No doubt Win code isn't as buggy as the slashdot faithful like to hype but in that much code its impossible to believe there aren't any (more). Maybe someone should now outlaw PURIFY et. al. - as a dangerous tool for finding OS vulnerabilities...

Maybe the best strategy for Microsoft now is to open source it so developers can legitimately look at it and track vulnerabilities...

Taking Bets?

[waldoiverson]

Who wants to bet that a few doors will soon be knocked down while TiVos, computers and XBoxes are confiscated by our loving FBI agents?

Interesting...

[vermicious]

Hmm... From " for one would love to peek around in this, more out of curiosity than any desire to actually do something useful with it." to "As much as I'd love to peek around in this, I won't risk it." in 16 minutes. What changed your mind?

Re:Interesting...

[sperling]

Reread, that's not a change... I'd love to peek around in this, but as stated already, I don't intend to peek around in it.

Maybe when I'm in a position where such an action would not influence others than myself, I'll find a copy. As long as I am a developer for a commercial project that might potentially benefit from access to this source, I don't consider my wish to fool around with Microsofts code enough reason to even slightly jeopardize the product I'm working on.

Re:Interesting...

[gui_tarzan2000]

You know, something really bothers me about this whole stealing code thing. You can only write how to do a certain thing just so many ways. This is true in any programming language.

So having said that, why does it surprise anyone that two identical lines (or whole procedures) of code end up in two different programs or operating systems? The code to control the hardware can only be written so many ways.

Besides, if the way all MS code acts is any indication of how it's written, the only place I can see it being of use is with virus/worm/trojan writers and geek comedy clubs.

Re:Interesting...

[AntiGenX]

Obviously you've never heard of PERL. ;-)

Re:Interesting...

[LittleBigLui]

So having said that, why does it surprise anyone that two identical lines (or whole procedures) of code end up in two different programs or operating systems?

i doubt that one identical line would surprise anyone. but if you have ten lines that do ten different things, and each of that things can be done in two different ways, you end up with 1024 ways of doing the whole thing, or a 1/1024 chance that two programmers come up with the same ten lines to solve the same problem.

or, if you write in perl, if you have three characters that do ten things, and you can write each of that character in 260 ways (hehe), you end up with over 24 gazillion different ways to write that piece of code.

Ironic story placement

[supremebob]

You gotta love how this story ended up being placed against a story describing how Open Source Code is subject to foul play.

Well, Mr. "W. Russell Jones", we're all about to get a lesson on how closed source code can be a dozen times moreso.

You forgot the best part....

[twoslice]

The comments should be hilarious....

List of the source means nothing

[Anonymous Coward]

Sysinternals has the layout of the XP source based on information in the checked builds. (Yes, it runs very slow)

I wonder

[gillrock]

Will this build under a gnu compiler? Do I have to be running Windows to build windows?

Re:I wonder

[Endive4Ever]

If Microsoft is being consistent, it's probably still being built on one of Paul Allen's PDP-10 machines.

The REAL important issue

[geeveees]

The actual important issue here: Is DirectX in that source code? If so, we can start welcoming our platform independant directx-using overlords...

Re:The REAL important issue

[DarkAce911]

Microsoft research released the source code to Allegiance last week. It uses Dplay and some DirectX stuff. The download was 512MBs with artwork. You may find what you are looking for in there.

Link
http://research.microsoft.com/research/all egiance/

Re:hmm seems a bit buggy

[iminplaya]

...China and folks there just don't really give a damn about western notions of copyrights.

Well, GOOD for them. It looks like China is more advanced than us in some things. China may have lots of problems, but this isn't one of them. It's a concept that's long overdue.

Here's another mirror...

[Axem]

Right here: http://windows.about.com/blhumor3.htm Amazing how simple this stuff really is.

PPC???

[l33tpr0gger]

::scrolls through file list from earlier post:: ::sees directory win2k/private/ntos/ke/ppc/:: powerpc kernel?

Re:PPC???

[Endive4Ever]

What's the big deal? I sold my RS/6000 box on eBay last month, but before I did, I did a 'what the heck' and installed the NT 4.0 PPC version on it. It is one of the PREP RS/6000 boxes from IBM, and it installed NT 4.0 just fine. From an OEM NT4 CD from Compaq, no less.

It sucked, actually. There is nothing, and I mean NOTHING available on the net to run on NT4/PPC. I was stuck with the IE 2 that shipped with NT4 and nothing more. There are a few faint traces of NT4/PPC apps on the Microsoft FTP site, and a few Service Packs.

But I can say that I am probably one of the few people to ever run NT4 on PPC. I quickly wiped it and reinstalled AIX, of course.

Suspicious files from the purported tree

[PedanticSpellingTrol]

I was looking through the supposed list of files at http://heim.ifi.uio.no/~mortehu/files.txt and found a few suspicious entries, this looks more like a hoax now:

0 11-18-01 14:23 win2k/private/inet/mshtml/build/scripts/tools/alph a/ 52736 07-26-00 02:12 win2k/private/inet/mshtml/build/scripts/tools/alph a/autolog.exe 61072 07-26-00 02:12 win2k/private/inet/mshtml/build/scripts/tools/alph a/awk.exe 112672 07-26-00 02:12 win2k/private/inet/mshtml/build/scripts/tools/alph a/chmod.exe 65536 07-26-00 02:12 win2k/private/inet/mshtml/build/scripts/tools/alph a/choice.exe 9724 07-26-00 02:12 win2k/private/inet/mshtml/build/scripts/tools/alph a/delnode.exe 76800 07-26-00 02:12 win2k/private/inet/mshtml/build/scripts/tools/alph a/di.exe 143280 07-26-00 02:12 win2k/private/inet/mshtml/build/scripts/tools/alph a/grep.exe 58640 07-26-00 02:12 win2k/private/inet/mshtml/build/scripts/tools/alph a/kill.exe 70656 07-26-00 02:12 win2k/private/inet/mshtml/build/scripts/tools/alph a/now.exe 18432 07-26-00 02:12 win2k/private/inet/mshtml/build/scripts/tools/alph a/rcmd.exe 38912 07-26-00 02:12 win2k/private/inet/mshtml/build/scripts/tools/alph a/rcmdsvc.exe 258560 07-26-00 02:12 win2k/private/inet/mshtml/build/scripts/tools/alph a/robocopy.exe 29440 07-26-00 02:12 win2k/private/inet/mshtml/build/scripts/tools/alph a/robocopy.wri 50448 07-26-00 02:12 win2k/private/inet/mshtml/build/scripts/tools/alph a/sleep.exe 60176 07-26-00 02:12 win2k/private/inet/mshtml/build/scripts/tools/alph a/splitsym.exe 10240 07-26-00 02:12 win2k/private/inet/mshtml/build/scripts/tools/alph a/srvany.exe 9856 07-26-00 02:12 win2k/private/inet/mshtml/build/scripts/tools/alph a/srvany.wri 56592 07-26-00 02:12 win2k/private/inet/mshtml/build/scripts/tools/alph a/tlist.exe 88884 07-26-00 02:12 win2k/private/inet/mshtml/build/scripts/tools/alph a/touch.exe 102400 07-26-00 02:12 win2k/private/inet/mshtml/build/scripts/tools/alph a/winat.exe 134416 07-26-00 02:12 win2k/private/inet/mshtml/build/scripts/tools/alph a/windiff.exe 17357 07-26-00 02:12 win2k/private/inet/mshtml/build/scripts/tools/alph a/windiff.hlp 6460 07-26-00 02:12 win2k/private/inet/mshtml/build/scripts/tools/alph a/ync.exe 0 11-18-01 14:23 win2k/private/inet/mshtml/build/scripts/tools/alph a/desktop.eml 0 11-18-01 14:23 win2k/private/inet/mshtml/build/scripts/tools/alph a/apache_install.eml 0 11-20-01 09:43 win2k/private/inet/mshtml/build/scripts/tools/src/ 1229 07-26-00 02:12 win2k/private/inet/mshtml/build/scripts/tools/src/ changepw.c 5503 07-26-00 02:12 win2k/private/inet/mshtml/build/scripts/tools/src/ changepw.mak 3855 07-26-00 02:12 win2k/private/inet/mshtml/build/scripts/tools/src/ getbldda.c 1247 07-26-00 02:12 win2k/private/inet/mshtml/build/scripts/tools/src/ htmlpath.c 0 11-19-01 00:26 win2k/private/inet/mshtml/build/scripts/tools/src/ copy of using web integration infrastructure.eml

Re:Suspicious files from the purported tree

[Anonymous Coward]

Most if not all valid NTRK tools.

Re:Suspicious files from the purported tree

[erikdotla]

These don't look suspicious. They look like part of the Windows Resource Kit or Windows PowerToys. I remember reading that these were tools that Microsoft had wanted to get into the core OS, but for whatever reason didn't make it (no GUIs, etc.) However, they wanted to.

The fact that these are in an alpha folder supports the idea that they were trying to get these in, and simply didn't. These probably never got built.

The apache_install.eml is odd. However, elsewhere in the filelist are many .eml files. It appears that developers would dump an email they got from someone in the directory where things were built. Probably some primitive way of communicating stuff about that folder to anyone looking inside it.

That's just that. But I'm still strongly leaning toward "hoax" myself. The filelist may even be legit, but that may be all there is.

I think it's great that the world, and Microsoft, will be publicly discussing and simply thinking about the ramifications of a windows source leak.

Re:Suspicious files from the purported tree

[Gary Destruction]

I think it probably is a hoax because Windows 2000 is made only for x86, not Alpha or PPC.

No GPFL, but...

[AndroidCat]

You do have to agree to a LULA or Leak User Licencing Agreement.

L-u-l-a lula lu-lu-lu-lu lula...

Re:The shit will hit the fan + Mirror

[weileong]

Could this potentially help the WINE Project

It could kill the WINE project. MS can slow/stop development by demanding (SCO-style?) WINE developers/contributors prove they have had no access to the leaked code...

Heck they can borrow the (incredibly insulting, I couldn't believe it when I first read it) SCO court filing, "the WINE project was the equivalent of a bicycle before the source code leak, but after the leak, the WINE project became a luxury cadillac + porsche + ferrari fused together, this is impossible without source code theft, we demand pinky to mouth one hundred billion dollars".

Bright Tunes v. Harrisongs

[tepples]

Subconscious copying is actionable infringement. A Beatle got sued and lost.

buggy software?

[xot]

have you heard of anyone downloading buggy code intentionally?? The leaked source code is pretty much safe.Relax MS.

Re:hmm seems a bit buggy

[zurab]

It *amazes* me that it hasn't been routine.

I agree. Remember, at the trial MS argued that opening or showing parts of Windows source code would be a threat to national security. Not long after that, they gave their source code to Russia, China, and many multi-national corporations and other organizations as part of their Shared Source initiative. Now, don't know where the source was leaked from, but 1 + 1 = ?

If in fact, this story is true, MS is riding against the wind here. It is feeling pressure from the Open Source while its security, software, and business models are based on keeping the source secret. If so, how long can they keep up?

I wonder if it's related to this...

[PetoskeyGuy]

http://216.239.41.104/search?q=cache:dyP7DNxZKusJ: www.eweek.com/article2/0,4149,1360420,00.asp+Windo ws.Source.Code&hl=en&ie=UTF-8

Microsoft MVP's have access.
And China
And India

Lots of sources.

This is truly a terrible thing. Just the other day I saw a recipe on how to make vanilla coke.

ANONYMOUS DONOR CONTRIBUTES TO WINE

[Anonymous Coward]

WINEHQ: Early today, a developer who wished to remain anonymous contribued an astonishing amount of source code to the WINE project. Some initial testing performed by WINE core developers revealed that WINE's compatibility with Microsoft Windows applications releasted for Windows NT and Windows 2000 had perfect compatibility, even down to some annoying and well-known bugs that have plagued certain Microsoft DLLs distributed with Microsoft's operating systems.

"This will really make it possible for non-Windows users to run more applications than ever using WINE on alternate operating systems like Linux," said one develper we spoke with. ;)

Irony of ironies....

[bobdotorg]

I would be the most poetically ironic event ever if it turns out that it was a MS Win security hole that allowed a hacker to enter a server and steal the code.

Doubly ironic if it was a hole that MS has known about for months and not bothered to patch.

Triply ironic if someone finds said hole, patches it, and ships patched source back to MS.

Re:Irony of ironies....

[ralphtheraccoon]

Quad ironic if they send in a GNU style diff? Well... it might be more successful than ships patched source back to MS.

Re:Irony of ironies....

[Zaiff Urgulbunger]

Kind of on the same note, it did occur to me that MS must be considering *how* they secure their system now? If anything gets past their firewalls, then they are a tad vulnerable!

Re:Irony of ironies....

[MxatmaXandi]

Doubly ironic if it was a hole that MS has known about for months and not bothered to patch.

Well, I work there now, and after having all my net taps cut off at the router one day because I inadvertently left an unpatched OS (I typically have several on a test box) running overnight (some sniffer demon noticed it hadn't been patched), I'd have to say, "NOT LIKELY!"

Oh, and the file list looks pretty authentic to me- I wrote (tiny) parts of Win2K, and I found my files right where I left them. I didn't read the contents, and I'm sure they would have changed between when I finished and the OS was released 3 years later

IMO, this leak happened the old fashioned way- people of weak character and dubious morality don't value what doesn't belong to them, and do with it as their own blinding egos let them see fit. Social Engineering worked for someone..

Re:The shit will hit the fan + Mirror

[philci52]

Possibly, but would they really want to? The samba group ended up with faster code then MS by reverse engineering the SMB protocol instead of inheriting a bunch of code patched by different people over the years. I would imagine looking at the source would solve a bunch of problems for the short term.

Of course if this turns out to be true and all.

Re:It's a TRAP!!! /Adm. Ackbar

[Via_Patrino]

What about the opposite:
Is there GPL code there?
Ask an auditing company to
diff NT4 2000 | grep -e yourcode
and get an answer.

I don't think they're playing SCO if they released just a part of it maybe but not the whole thing

Does anyone remember?

[beware1000]

Remember about two years ago I vaguely remember someone getting into this source.

I remember thinking at the time that you wouldn't want to release it until it had all blown over. I wonder if they are related?

Not that enough other people don't see this code, it is just a thought though.

This is nothing new

[toddler99]

http://www.baltimoremd.com/content/win2000source.h tml

...dulang dulang dulang...

[tepples]

if I learn to play guitar by among other things, listening to all of the Beatles songs and playing along, do the Beatles own the rights to any future song I write? Goddamn hell freakin no!

Please look up "He's So Fine", read a few of the results, and see if you still think that.

Re:The odds of getting the full source: experience

[trentblase]

It's not like stealing, because they only took a fraction of a megabyte at a time. Only when they're all added up in your Swiss bank account does it amount to the full source code. It's like the take a penny, leave a penny jar.

Code leaks not new

[Jim Hall]

Code leaks from Microsoft are not new. Check this article at CIO Update about a code leak a year ago: (emphasis mine)

Microsoft Corp. said it is tracing a key piece of code from its Windows Server 2003 software that was leaked onto the Internet, triggering concerns about piracy problems ahead of the company's scheduled product release later this month. The volume-licensing key in question allows for unlimited installations of Microsoft's Windows Server 2003 server operating system, the next upgrade from Windows NT that is slated for release on April 24.

However, this seems only to be a partial leak, not comparable to this complete (if it's real) source code leak.

Re:Code leaks not new

[BenBenBen]

Work it out - "code" in this case means CD-Key.

There was no Server 2003 source code leak.

Who the hell mods these things?

Seen it - nothing spectacular

[Anonymous Coward]

Blimey. We got wind of this around lunchtime GMT, and within half an hour two zip files mysteriously got downloaded to - ahem - servers some collegues and I have access to (no, I had no involvement in the download and have no idea of the source). We took a look, us being extremely sceptical of the claims, and ended up spending a few hours grepping the Win2K sources.

If this is a wind up, someone or people spent a long old time faking it. Microsoft notices and email addresses all over the place. They don't like the AIX compiler one little bit. Hardly any mention of Linux, GPL or GNU.

Actually quite a professional bunch of source files by all accounts. Appears to be using standard GNU Makefiles though. Yes, the 'f' word appears, as does the 's' word. Apparently Office 2k is broken in some respect that Win2k needed a tweak or some description.

Plenty of mentions of Internet Explorer, although I wouldn't like to say that we found 'IE' in the code, but then we aren't C experts at all. It does mention IE6 and Windows ME, so can't be all that old either. Does mention buffer overflows a fair bit, also plenty of 'hackhack' and 'bugbug' notes laying around.

In fact, nothing particularly spectacular found at all. We took a look, got bored, and went back to our normal work. Honest boss!

And no, we didn't try to compile it. We felt it was genuine enough though - not that we really cared. We did however note that if this lot is proven to be the real deal, Microsoft are going to be landed with one hell of a lot of security alerts for 2k/NT over the next six months.

Yours merely curious...

Re:Seen it - nothing spectacular

[psavo]

Cared to 'grep CIA' on that one?

Re:Seen it - nothing spectacular

[Zaiff Urgulbunger]

On a related note, if C. Taco were requested to assist with [*ahem*] enquiries, would he do so?

Re:Seen it - nothing spectacular

[dfj225]

"Actually quite a professional bunch of source files by all accounts."

I find it hard to believe that anyone would be surprised to find that the Windows source was professional. Whether you like MS or not, you have to accept that they are one of the largest software companies on earth and they definetly have some of the best minds in the field working for them. You may not like the business decisions that they make, but you should at least have respect for their coders and how much Windows has improved over the years. I don't agree with every decision Microsoft makes, but I do believe that Windows 2000 XP and later are good operating systems.

Re:Seen it - nothing spectacular

[Endive4Ever]

I think you meant to say 'If Robert Malda was requested to assist....'

Re:Seen it - nothing spectacular

[Zaiff Urgulbunger]

OMG!

Don't use *real* names here!!

OMG!


;-)

Re:Seen it - nothing spectacular

[dfj225]

Obviously I have. I am using Windows XP right now. I'm not saying that you have to love Microsoft or Windows, but XP is a very stable system from my experience. The only thing that is lacking, in my opinion, is stronger user type security (ie: having distinct super and normal users).

Who's grepping for IP infringements?

[John the Kiwi]

While everyone is concentrating on the whole issue of what happens if they copy code from Windows has anyone started looking at the code for copyright infringements from Microsoft?

Just an interesting thought, I've always wondered how anyone could prove IP infringement against closed source systems.

John the Kiwi

list of files leaked...

[Westech]

Alright, enough of this alleged list of files. I want to see the actual contents of the files. If they really were leaked to the Internet then we should start seeing links or bitTorrents soon.

If the list of files posted above is real, then I'm really eager to see the contents of the emails like these:

win2k/private/inet/xml/xml/tokenizer/dll/words of wisdom from dennis.eml
win2k/private/inet/xml/xml/dso/letter to children - 2.eml

These emails may provide clues about who leaked the code (whether it was intentional or not.)

Re:list of files leaked...

[justinstreufert]

I think those are virus-laden e-mails. Some Outlooky virus a couple of years ago left lots of .eml files around in random places with random subjects just like that.

Justin

my eyes must be getting old

[proj_2501]

whoa, i totally read that as "MOD PARENT UP SUPER FUNNY"

Hah! I predicted this in 2002!

[edashofy]

And you all said I was a fool! :)

Interesting Neowin comment

[bonch]

"#43 Posted by psneddon on 13 Feb 2004 - 01:09
Just my opinion / thoughts.

1) The software that builds and compiles Windows is very complex I doubt anyone could turn the source into a working system easily. Maybee it would be possible to compile certain parts. Plus even if you could it would take hours if not days to go through the process.

2) I don't see how this will let anyone find any obvious flaws, microsoft have software that does this all the time. I'm not saying its not a security risk but its not as simple as the journalists make out - as always.

3) This exact same scare happened about 7 years ago, I remember they were selling the source to NT4 at a local market on CD, doubt it was the real source code."

Re:Interesting Neowin comment

[bonch]

Actually, if you'd do a little research, this has been spoken about by Microsoft developers several times in the past. It takes an entire day to compile and build Windows, and they use a very custom process.

Amusingly, as processors have gotten faster over the years, Windows has also grown in complexity, and it has apparently always taken an entire day to compile a Windows build.

Re:Interesting Neowin comment

[strike2867]

Theyve confirmed that this is real source code, but not enought to compile windows.

Re:Interesting Neowin comment

[DarkEdgeX]

Doesn't look very custom to me. Except for the more exotic stuff (boot loader and such) I don't see why you couldn't just build this in Visual Studio. I mean, do you honestly think the source for progman.exe requires "a very custom process"?

Just the obvious next step

[r_j_prahad]

The Microsoft financed intellectual property war between SCO and the Linux community is starting to backfire, with Linux gaining an obvious upper hand. Even the usually clueless PHB oriented news-sites are starting to paint SCO as a perpetually luckless loser. Microsoft decided it was time to throw some of their own old and generally valueless IP out onto the Internet and force Linux to defend itself on another front.

Whether this one works or not, I'd still expect yet another IP related incident involving Linux. The startegy here is not to conquer decisively, but to wear down.

Samba 3.0 is potentially, royally, screwed.

[Ayanami Rei]

Before now, it could be assumed that Samba developers were working from scratch- clean room implementations, because it wouldn't be possible for them to have the source code.

Now, unless the leak and spread can be precisely pinpointed, the Samba project could be the target for attacks under the "assumption" that they were sitting on this and that's why it works as well as it does. Whether or not they think this is true is irrelevant, they just need to let their legal team sink their claws into it, and muddy the waters.

Re:Samba 3.0 is potentially, royally, screwed.

[pandrijeczko]

Before now, it could be assumed that Samba developers were working from scratch- clean room implementations, because it wouldn't be possible for them to have the source code.

Oh, come on, get real! You miss one very important point in your comment...

The source code to SAMBA is Open Source!

This means that MS have probably got a few copies of Samba themselves already and were there any licensed MS code in it, you can rest assured the Microsoft would have sent their lawyers over long before now.

Just accept that the Samba guys are a pretty neat bunch of programmers that have genuinely backwards engineered Samba from the word go - it's the likeliest and most realistic conclusion to draw.

patents and trade secrets.

[ecalkin]

there might be patent issues, but i think they list those one the software or license somewhere. my understanding of trade secrets is that it is their reponsibility to maintain a the secret. and if this is *really* source code for nt4/win2k, it's not a secret anymore.

eric

Re:Small server they've got there

[Dave2 Wickham]

/me points to the star by his name...

I was getting a load of errors before it was subs-only.

More on this as we hear it...

[codemachine]

Too bad we won't be hearing any more from them, since their server must be a melted, steaming pile of scrap metal by now.

Oh well, that hasn't stopped us from posting 400+ comments to this story.

Re:More on this as we hear it...

[DarkAce911]

I would love to see the look on their admin face when someone tells him that his website is on the front page of slashdot talking about released MS source code.

Admin to Flunky
UNPLUG THE SERVER, NOW DAMMIT.

Flunky: Poof, Too late boss, Halon just went off.

LOL

COOL!!!!

[mrshowtime]

Now Windows will be 10x more insecure than before! Awesome! As far as something positive coming out of this leak, I doubt it. Sure, the "good guys" will take this opportunity to study what makes windows tick, but others will just try to make windows tock. :(

Well, at least...

[BlakeCaldwell]

this'll lead to a stable OS...

of course it'll render millions of computers useless in the meantime.. :)

Web Myth: Windows NT crippled ship

[AHumbleOpinion]

We have all heard the story of it being towed back to port.

Many have heard the story, few have heard the truth. After all the early speculation (termed used by publisher who broke the story and later distanced themselves from it) by shoreside Unix advocates someone eventually talked to the Chief Engineer on board at the time and the software developer who wrote the code. They said it was not WinNT. If the OS had been Linux the ship would have been just as dead in the water. A naive server app corrupted it's own database and naive client apps (the infamous "LAN consoles" that crashed) needed that database to function properly and to operate equipment. In any case:

http://www.sciam.com/1998/1198issue/1198techbus2.h tml

"Others insist that NT was not the culprit. According to Lieutenant Commander Roderick Fraser, who was the chief engineer on board the ship at the time of the incident, the fault was with certain applications that were developed by CAE Electronics in Leesburg, Va. As Harvey McKelvey, former director of navy programs for CAE, admits, "If you want to put a stick in anybody's eye, it should be in ours." But McKelvey adds that the crash would not have happened if the navy had been using a production version of the CAE software, which he asserts has safeguards to prevent the type of failure that occurred."

Re:Web Myth: Windows NT crippled ship

[conteXXt]

The fault was with certain applications that were developed by CAE Electronics in Leesburg, Va. CAE? eh? sounds Canadian....

Re:The shit will hit the fan + Mirror

[happyfrogcow]

No. If the Wine folks look at the actual Windows source code, they aren't reverse engineering any more, they're copying, which is illegal

I'm tired of this b.s. Since when has looking at something been equated to copying it? Copying is copying. Looking is looking. However, obtaining the code is probably a copyright violation. After all, this post is not a copy of your post. It was inspired by it, I looked at your post, I legally cited your post, but I did not give you the rights to my post by doing so, nor can you force me to remove my post.

Re:ed2k link?

[Anonymous Coward]

No, you want the 1.09 GB file from e2dk.

ed2k://|file|Windows_2000_Source_Code[NeoWin.Net ]. rar|1167616724|C60BD616078CE954AC05C7C7B94C0C2B|/

Time to kick back and watch the fireworks...

[miketang16]

This will not likely provide any assistence to OSS projects, since it's pretty damn dangerous to infringe on MS code.

The biggest thing I see coming out of this is the security repercussions for current Windows 2000 users (not to mention XP as well since they're pretty damn similar). Should be an interesting and eventful news week.

GPL code in windows?

[sokkalf]

Now we'll find out if MS has used any GPL'ed code in windows..

The Iraqi Information Minister

[jeffkjo1]

"There is no available source code! Only a heathen would suggest such a crime. Microsoft has an excellent security track record. Those are features, not bugs! The heathen apple and linux communities are spreading lies, it is all lies."

Re:The Iraqi Information Minister

[Anonymous Coward]

"The Source Code, it is in our safe in Baghdad, and god willing, it will remain there."

Suspects?

[bluethundr]

The Chinese are so great at protecting property rights (intellectual and otherwise). Remember, they signed a piece of paper(!!!) agreeing they wouldn't share the windows source code with anyone.

On an unrelated note, anyone care to start a football-style pool as to when the next round of microsoft virus hits...

To some extent.....

[Keitero-sama]

If this is the case, the part, if not most of the XP and Win2l3 code is out there. Even part of longhorn if you get down to it.

Top three articles on /.

[IchBinDasWalross]

The 3 current articles at the top of Slashdot...

Windows 2000 & Windows NT 4 Source Code Leaks
Is Open Source Fertile Ground for Foul Play?
New Worms Feed on MyDoom Infections

It struck me as funny.

File headers

[Del Vach]

I found some of the file headers of particular interest:

Copyright 1984 Apple Computer, Cupertino, CA

Re:File headers

[Carch]

Wouldn't surprise me if MS code includes copyrighted Apple code. When Jobs took over Apple, one of the things he did was forge a technology sharing and funding agreement with Microsoft. Apple got access to a bunch of MS code, too.

DRM?

[lysium]

Any chance that the juicy bits of Windows Media Player are sitting in that code? Breaking that system would make more than a few distributors cry...

Re:The shit will hit the fan + Mirror

[jps3]

The contention is that you would have a dickens of a time proving in court that you were not directly influenced or did not directly copy the copyright work. Do you have the financial security to take this through the courts and win? No? Then, keep your nose clean. If you don't want to stink, don't go near the shit.

I understand what you're saying, but it's best to steer far and wide and very clear of it. Treat it like nuclear waste. You don't even look at it no one can try to taint you.

Files with interesting names...

[SiliconJesus]

10328 07-26-00 01:41 win2k/private/genx/shell/gnumakefile
0 11-18-01 14:23 win2k/private/genx/windows/inc/mobileq-apache.eml
0 11-18-01 14:23 win2k/private/genx/letter to children - 2.eml (*)
0 11-18-01 14:23 win2k/private/inet/mshtml/btools/bin/words of wisdom from dennis.eml
0 11-18-01 14:23 win2k/private/inet/mshtml/build/ppcmac/ship/unix.e ml
0 11-18-01 14:23 win2k/private/inet/mshtml/build/ppcmac/documentati on of problems in stress.eml
506 07-26-00 02:12 win2k/private/inet/mshtml/gnumakefile
64276 07-26-00 02:13 win2k/private/inet/mshtml/tools/mips/utils/sed.exe

Plenty of gnumakefile entries throughout...

Also - directories for ppc / ppcmac / alpha / mips

Could this be OFFICE 2000 instead of Windows 2000?

* - WTF?

Re:Files with interesting names...

[raodin]

I don't know about mips, but there were alpha/ppc builds of NT4.. this is probably just left over.

Re:Files with interesting names...

[Dreadlord]

0 11-18-01 14:27 win2k/private/windows/winnls/fontsup/apache_instal l.eml
0 11-18-01 14:23 win2k/private/genx/windows/inc/mobileq-apache.eml

Hmm, so Win2K devs were playing around with Apache, I wonder if there is some Apache code there too.

Re:Files with interesting names...

[jrumney]

Also - directories for ppc / ppcmac / alpha / mips

Could this be OFFICE 2000 instead of Windows 2000?

More likely that there are a lot of abandoned source files that haven't been removed from the source tree yet. There were alpha and mips versions of NT4, and it was known that Microsoft were working on a PPC version, so it isn't really surprising that some work had been done towards it.

The gnumakefile's are interesting, given Microsoft's distaste for GPL software these days, but they probably date back to the mid '90s when Microsoft's attitude was quite different.

Re:Files with interesting names...

[Anonymous Coward]

quite a few files and directories named "*unix*". Remember that Microsoft released a version of IE for solaris, and
".../mshtml/src/core/cdutil/unix/sparc/"
sug gests exactly that :)

Re:Files with interesting names...

[Geordish]

.eml files, the entire directory tree was infested with the nimda virus, they have all been emptyed though, and are now just 0 bytes.

Re:Files with interesting names...

[DrXym]

Didn't IE build on Unix at one point (via a Win32 layer)? Could be a vestige of that.

Re:Files with interesting names...

[SirTalon42]

0 11-19-01 01:40 win2k/private/inet/mshtml/src/core/debug/democracy in flames.eml 0 11-18-01 14:23 win2k/private/inet/mshtml/src/core/wrappers/regist ry_log_messages.eml 0 11-18-01 14:23 win2k/private/inet/mshtml/src/dlay/include/rats_pa ss.eml 0 11-18-01 14:23 win2k/private/inet/mshtml/src/dlay/documentation of problems in stress.eml 0 11-19-01 01:40 win2k/private/inet/mshtml/src/edit/dan komsky's review form.eml 0 11-18-01 14:23 win2k/private/inet/mshtml/src/f3/crt/x86/copy of using web integration infrastructure.eml thats suspicious.... only .eml files have those fake looking names though...

Re:Files with interesting names...

[myg]

NT runs on lots of platforms. The very first was actually the i860 on an internal computer built at Microsoft called Dazzle by Rob Short. After they realized that the i860 was a crummy chip (it was) they switched to MIPS.

So the MIPS architecture was the second architecture that NT supported. Then i386, then Alpha, then PPC, and then amd64/ia64. Portability was fairly high on the list of priorities for NT.

Honestly I would love to have a peek at the code just to satisfy curiosity. But I have a feeling anybody who has it is gonna be severely punished. Sigh.

Expected

[marko123]

Forget your brand of "MS is doing it to get us on the sly".

How about:

MS took a calculated risk in allowing the Chinese government access to the code in order to secure more sales, and are now paying for it, because someone Freed Billy!

Could have bin a lot worse

[unoengborg]

There have always bin rumors that closed source Microsoft applications have leaked to terrorists or the Russian mob.

Thinking about it, an OS used often to hold and guard highly sensitive information wordwide is almost certain to get its source stolen, if not by terrorists so by intellegence organizations round the world.

But it could have bin much worse. Imagine a not too distant future world where access to documents software etc is controlled by DRM technology. In such a world, there would be little incentive for sofware companies to spend R&D money on securing their systems apart from what DRM offers.

Imagine what damages we could get if cryptography keys to such systems fell into the wrong hands.
Even if such keys would be handled by a lot fewer persons than the windows source code, there is no guarntee that they will not be persuaded to reveal their secret.

Re:Could have bin a lot worse

[foidulus]

Actually, the threat is that they can't get into the *RIGHT* hands, the keys would be ideally secured in hardware and changed every so often. One key would open one document, but thats no different than it is today if people encrypt their files. Who knows the key is what makes trusted computing a bastard.

Taking a leaf from Valve...

[diodegod]

Maybe seeing how Valve can put the Half Life 2 release date back a few months due to their leak may have given Microsoft an excuse to delay Longhorn a little further ;)

Yes I understand the consequences etc, I wanna grow up and be a respected open source coder (and get paid to go to conferences). If I wanna read source, I'll read /usr/src/linux (captivating stuff, gripping plot).

~Duane

Re:DO NOT LOOK AT THE CODE!

[mabu]

DO NOT LOOK AT THE CODE!

Am I the only who now can't get the Indiana Jones theme music out of my head?

Has anyone on slashdot actually seen the code?

[jwsd]

I've gone through hundreds of messages but yet to see one guy claiming to have actually seen the code.

'Copying' needn't be intentional

[jjo]

While it's quite true that if you're just getting inspiration from copyrighted code, you are not violating copyright. The problem comes when the copyright holder sues you or your employer, claiming that you (intentionally or not) copied parts of their code into yours. You might have subconsciously reproduced something you saw earlier and forgot at a conscious level. While it might be unlikely that you would actually do this, it is not so unlikely that you would be accused of doing it.

While at the end of an excruciatingly long and fabulously expensive trial, your rights to your own code may be upheld (if the court doesn't make a mistake), it is much better to avoid the problem by using a clean-room process that makes the whole question moot.

How it can go wrong

[ackthpt]

A friend and his associate left a previous employer to form a start-up. They began work on a product, much like the one their former employer was developing. Though my friend largely contributed the code and many fixes to his associates code, the project died when the former employer had detectives raid the associates house. The former employer claimed they were copying the firmware, though my friend had mostly written it. However, an old code listing was found in his associates house after they had both vehemently denied copying any code from their former employer. In light of the discovery, the issue of stole-did not steal became a moot point, as they would need a company of lawyers, time and lots of money to defend themselves. If he had tossed all prior employer related junk from his home office, the burden would have been much greater on the former employer. Having some code at home which looked suspiciously like product code (particularly to the untrained eye) killed their start-up and put the associate in jail.

Re:How it can go wrong

[Anonymous Coward]

ummm he let detectives do a raid?

i would have kicked them the hell out then called the police for attempted burgarly AND pretending to be a law enforcement officer.

Re:How it can go wrong

[chefmonkey]

I presume you mean "Detective" as a police title, and not as a reference to a P.I., right?

A P.I. can no more raid someones house than you or I can. And it would be the same thing: at the very least, trespass, and possibly a variety of other complications, like assault, burglary, etc.

Or did you just do a poor job of making stuff up?

A note from someone who has see the real source

[rufusdufus]

Its been a couple years, but I have seen the real source code for windows NT. All I have seen so far here is a file list, but I can say these things about it:
1) I cannot confirm that this is a legitimate file list.
2) I can confirm that every tree and file I am specifically aware of is missing.
3) This is definetely not the entire source tree.
4) There are many dubious file names such as "words of wisdom from dennis.eml
", zero length, and "gnumakefile" that definetely appear out of place.

My guess is that someone has taken some licenced source code and "sexed it up" to troll internet.

Re:A note from someone who has see the real source

[jeeryg_flashaccess]

Or maybe those gnumake files are left over from a test compile on an open source system? hMMM????

Re:A note from someone who has see the real source

[Zaiff Urgulbunger]

Its funny how everyone (well, at least 3 people!) has focused on the same files. I mean, there must be thousands of files, but a good few people have pulled out "words of wisdom from dennis.eml" as examples of (1).The files definately being legit source files, or (2).Definately not being windows source files.

Not calling you a liar or anything! Its just "funny", thats all.

Re:A note from someone who has see the real source

[luizd]

If the files in:

http://www.sysinternals.com/ntw2k/info/xpsrctree.s html

are really from winxp, then those files listed should be from win2k. There are many entries that match exactly

Another link

[cb8100]

I can't vouch for the reputation of the site (I've never come across it), but at the moment this is the only other site that appears to have any report on the source leak:

http://itvibe.com/default.aspx?NewsID=1283

Re:Another link

[tsvk]

Well, yeah. But there is this "update" on the story with a quote from Ballmer:

I can assure you that we know there has been no compromise of the integrity of the source code; that it has not been modified or tampered with in any way.

The problem is that the quote is soon four years old. So that statement is not relevant to this story at all.

Seems like a hoax.

But

[WTFmonkey]

Stench? The air is sweet, and fragrant!

Time to look for GPL violations!

[Theovon]

Someone who wants to take the risk of tainting themselves (in OH so many ways) by looking at Windows code should probably do a full analysis in order to locate GPL violations, if any.

Re:Time to look for GPL violations!

[kisak]

But assuming they find some lines of GPL, can't microsoft just deny that the source code in the wild is the propert code for Win2000?

Re:Time to look for GPL violations!

[oo_waratah]

You have just cause for requesting an authorised party to independantly verify the code in Microsoft. Given that Microsoft has acknowledged that it is a copy. Would take a court order though.

Re:DO NOT LOOK AT THE CODE!

[FLoWCTRL]

The last thing the open source community needs is for Microsoft to have an excuse to claim that some of THEIR code has shown up in the Linux kernel.

Oh come on... give the kernel maintainers some credit! As if they'd let such poor quality code in!

Re:It's a TRAP!!! /Adm. Ackbar

[jafac]

Worse still - if you work on any Open Source project, and you look at Microsoft Source code. . . DO NOT COPY IT!!!

We like Linux as it is. Reliable, stable, and fast. Copying Microsoft code in would jeopardize that. Never mind the IP issues. . .

MOD PARENT UP!

[rewt66]

Seriously. This is not cool. If it's not cool if someone were to do it to us, it's not cool when someone does it to MS. If it's sauce for the goose...

New Black Market in MS-derived Code?

[pegasustonans]

I don't think it's too far-fetched to imagine people hacking the code in order to make their own patches or integrated apps for the OS' and then distributing them freely via one of the illicit networks available. Wouldn't it be a perfect comedy if an illicit hacked version of Win2K ran better than the original?

define "derivative", please

[mangu]

can Chuck Berry sue everyone who ever wrote a rock'n'roll song?

Re:define "derivative", please

[SquarePants]

You raise a good point. The devil is in the details. Whether a work is a derivative is a factual question which generally only a jury should decide. But I will indulge you.

17 USC 101 defines a derivative work as:

"a work based upon one or more preexisting works, such as a translation, musical arrangement, dramatization, fictionalization, motion picture version, sound recording, art reproduction, abridgment, condensation, or any other form in which a work may be recast, transformed, or adapted. A work consisting of editorial revisions, annotations, elaborations, or other modifications which, as a whole, represent an original work of authorship, is a 'derivative work'."

That really cleared things up, didn't it?

But seriously, my point was that what the parent was stating as an absolute is actually untrue. You can be guilty of copyright infringement even if you dont "copy."

Re:define "derivative", please

[mangu]

"a work based upon one or more preexisting works, such as a translation,

OK, that would be rewriting C code in Perl, I guess.

musical arrangement, dramatization, fictionalization, motion picture version, sound recording, art reproduction,

Not applicable to software, I suppose?

abridgment, condensation,

That is, I can't copy source code, delete some function, and call it my own. Fair enough.

A work consisting of editorial revisions, annotations, elaborations, or other modifications which, as a whole, represent an original work of authorship, is a 'derivative work'."

Okay, I cannot copy source code and just change the comments or change variable names and call it my own, right?

That really cleared things up, didn't it?

Assuming my comments to your post are right, this means that just going over some source code and getting ideas from it is, absolutely, *NOT* copyright infringement. You have to, at least, do some cut-and-pasting from the original to be in violation. Understanding-and-rewriting is not the same thing as cut-and-pasting, right?

Of course, I'm speaking from a logical standpoint, which doesn't mean a good team of lawyers cannot drag this for years in court, breaking any small company in the process...

Re:define "derivative", please

[SquarePants]

Nobody said anything about copyrighting "function". Copyrights cover only expression. Only patents can protect fuctionality.

As for the case law, honestly, it is 7:30 PM, I am ready to go home and too lazy to get the case cites ... allright here you go (god, I am a karma whore!):

This is form Arthur Rutenberg Corp. v. Parrino, 664 F. Supp. 479 (M.D. Fla. 1987):

In order to establish copyright infringement, a plaintiff must prove (1) his ownership of the copyright and (2) "copying" by the defendant. Ferguson v. National Broadcasting Company, Inc., 584 F.2d 111, 113 (5th Cir. 1978). Copying may be proved by showing access of the allegedly infringed material by the defendant and substantial similarity. Id. This showing may be rebutted by the defendant with evidence of independent creation. See, e.g., Miller v. Universal City Studios, Inc., 650 F.2d 1365 (5th Cir. 1981). Alternatively, copying may be proved if the two works are so "strikingly similar as to preclude the possibility of independent creation." Ferguson, 584 F.2d at 113. Although, arguably, the plaintiff has shown "striking similarity," the Court does not rest its decision on that finding.

How's that? I threw in the "striking similarity" test as a bonus.

Re:define "derivative", please

[SquarePants]

Well, you forgot the all important catchall:

or any other form in which a work may be recast, transformed, or adapted.

That one will get you every time!

Re:define "derivative", please

[Dalcius]

"or any other form in which a work may be recast, transformed, or adapted."

That's what I don't get. Copyright covers physical materials, so applying those words by their definition, if you take a source file and recast it, you're taking a file and making changes to that file.

Looking at a file, taking the idea of the implementation -- as opposed to the line by line method -- with you in your head to code it later does not add up to altering an existing work.

Now sure, if you broke things down into the same functions and used the same conventions, options, error handling, etc., I can see where the case might stand that you "carried a copy inside your head", but that seems like it would be awefully difficult to prove.

All that said, this whole post is completely ignoring the reality of courtrooms. A reality in which a court says, "Well, we can't prove that you copied it so we'll settle with a good guess"[1] strikes me as absurd, but that's the world we live in.

[1]: quoting one of your posts: "because the act of copying is incredibly hard to prove unless you are dealing with a complete moron, it is not necessary under the law today for a copyright plaintiff to actually prove the act of 'copying.'"

this is news?

[sir_cello]

In the early 1990's, a number of universities, research institutions and other entities had source code licenses with major unix vendors: SCO, Dynix, Amdahl, Sun [Solaris], SVR4 ... etc - most of the source code to these operating systems was floating around the underground community (e.g. SunOS 4.1.3). Not surprising that it is happening with Windows.

Does anybody really care?

[mabu]

Who wants to look at Windows' obviously bloated, hacked-together code in the first place? Are we not satisfied with the stability of our current OS projects that we might want to see what one of the world's worst development teams ever has come up with?

Yea, it might be enticing to check out the code to identify back doors and subversive code, but you don't need the source code to prove that.

This is about as exciting as finding out the original master tapes from Air Supply's Greatest Hits are making the rounds in Kazaa. OMFG!

What's next? Kevin Mitnick is caught showing his pierced belly button?

Re:backups

[Viper233]

This is probably old hat now, but....

Real men don't do backups, they just pack their files into windows_2000_source_code.zip and post them to their website.... with torrent links...

SHORT THE STOCK?

[macshune]

Speaking of "a world of hurt," wouldn't the general reaction to a leak of this kind cause a precipitous fall(big or small) in Microsoft's stock? If was an investor, I would totally short the stock right now, since there will probably be some crazy reaction at just the hint of a leak...probably because people will think it's a bigger deal than it will end up being.

It looks as though at the end of the trading day, MSFT did lose some value. If not short it, then maybe sell it, if only to pick up some deals later...

Re:SHORT THE STOCK?

[mbshafer]

To note if the leak is true and the stock gets pounded it's unlikely one would get the opportunity to short the stock. Ref SEC rule 10a-1 (aka "Uptick Rule). For Reference: http://www.forbes.com/2001/10/04/1004short.html But bottom fishing would certainly be in order. Question of course is where is the bottom when a stock takes a hit? :) Cheers!

Re:SHORT THE STOCK?

[EinarH]

If you compare with S&P and Nasdaq MSFT didn't loose much. It's completly normal that some investors sell before the market closes down for the day. And since MSFT is so large it takes quite a bit of selling to move the stock price much.

Re:SHORT THE STOCK?

[macshune]

Interesting. At any rate, if this turns out to be true, I'd bet that MSFT will take a beating tomorrow on some level.

Re:SHORT THE STOCK?

[noisehole]

found a torrent: ed2k://|file|windows_2000_source_code.zip.torrent| 16496|5506C49CCCA12204BAB6FE960CE5602C|/

btshowmetainfo.py windows_2000_source_code.zip.torrent
btshowmetain fo 20021207 - decode BitTorrent metainfo files

metainfo file.: windows_2000_source_code.zip.torrent
info hash.....: f03fc1e04869294d5644d3c8c5d0fb8f2d26aa59
file name.....: windows_2000_source_code.zip
file size.....: 213748207 (815 * 262144 + 100847)
announce url..: http://alge.nlc.no:6969/announce

maybe its that thing, atm 23 seeders, 239 downloading and it was created on 2/12/2004 11:16:13 PM, so looks good so far

knock yourself out

Re:SHORT THE STOCK?

[lsherwood]

My short sale went thru at 6:50 PM EST. My guess is we won't see a precipitous drop in the stock, but I'm hopeful of a small sell off tomorrow. First time I've ever been both long and short on a stock!

Re:SHORT THE STOCK?

[Unnngh!]

At the closing of trade today, volume was less than average and the stock lost .74% of its total value, which is nothing staggering. The news of the code leak, however, has a) not hit the mainstream press, and b) not even been confirmed by the thousands of geeks on /. looking at this.

If you are going to short the stock on news like this though, you're just asking to lose money. There is no telling, really, how Wall Street will react to vague technical news. Plus, the stock could dip and rebound so quickly that trading is frozen and you are stuck in at an arbitrary price with no idea where it will end up. Very stressful--I recommend against it.

Re:SHORT THE STOCK?

[catscan2000]

You know exactly what's going to happen is that Microsoft's stock will gain value and rise several dollars by the end of the next business day.

Why do I predict that? Simple: The Stock Market's reality is the exact opposite of Slashdot's reality ;-).

Proof? One word: SCO

Re:SHORT THE STOCK?

[k2enemy]

You do realize that selling your long shares and buying them back when you would have covered your short shares would be the same trade? And depending how long you've had your long shares, it could have been a huge tax saving to sell the longs.

Re:SHORT THE STOCK?

[vsprintf]

maybe its that thing, atm 23 seeders, 239 downloading and it was created on 2/12/2004 11:16:13 PM, so looks good so far

What a waste of bandwidth. I don't even want the binary on my computer. Why would I want that massive blob of repeatedly patched DOS 3.0/Win 3.1 source code contaminating my disk? If I need a laugh, I'll just turn on the comedy channel.

Re:SHORT THE STOCK?

[noisehole]

its in the wild and no one can do anything about it.
most ppl are downloading it to have something to brag about. others are just peeking at it for the fun of it, like me. just a few grep's showed some interesting things...

the file actually is the zip to the spreading files.txt

whats a little bit weird is a linux coredump at private/security/msv_sspi/core

it appears someone named eyala from mainsoft used vim (VIM - Vi IMproved 5.6 (2000 Jan 16, compiled Mar 7 2000 12:18:07)) on a redhat x86 box under xfree86/kde on a w2k sp1 sourcefile, well until the box ran out of memory...

Re:SHORT THE STOCK?

[pimpin apollo]

I have yet to find mention of this under MSFT finance news. I thought that apple'd do well when itunes was rumored to come out for windows, but the stock dropped the day after that rumor started circulating. I think that these issues have less salience with institutional investors than we'd all like to believe.

Re:SHORT THE STOCK?

[DakotaK]

Gee, when MS gets their grubby hands on server records, they'll have fun suing the hell out of all the downloaders. Thanks!

Re:SHORT THE STOCK?

[bwy]

because people will think it's a bigger deal than it will end up being

Definately correct on that part. Anybody who tried to use the source code in any kind of fashion would have M$ lawyers coming down on them like a fat man on a Twinkie and it would end right there- as it should.

Re:SHORT THE STOCK?

[lpret]

Yeah, I just looked around file-sharing programs and it's all over. They're all different sizes, so I wonder what really is going there.

Re:SHORT THE STOCK?

[no_space_in_time]

It's called 'shorting against the box'. What you need to do is have the broker identify the purchase as 'versus xyz sale date'. Still, you can't sell the long for 31 days after you cover.

Re:SHORT THE STOCK?

[pacc]

In Soviet Russia, the downloaders have fun getting their grubby hands on MS server records.

Good luck suing them...

Re:SHORT THE STOCK?

[Elektroschock]

Oh, then they will release a message. "We found our secret code, it is now called ReactOS." Or Wine was able to improve because our code was leaked, they stole our IP ecc.

However we can also look up whether our intellectual property was infringed by Microsofts' code.

I think this is a media campaign, that will result in further Sco like action: thjex copied our ideas because Linux freaks stole our code blabla

Re:SHORT THE STOCK?

[technix4beos]

Searching Google Groups, I found:

ed2k://|file|Windows.Source.Code.w2k.nt4.wxp.tar.b z2|142290587|82C8F97ACFABA434AEB7592A46DCC7D9|/

Well....

[LordK3nn3th]

Now us Linux users can't complain that windows isn't open source :(

Torrent

[F.O.Dobbs]

Anyone got a torrent?

No you're not a lawyer.

[FreeLinux]

"IANAL but I do read Groklaw"

The individual that runs Groklaw isn't a lawyer either. So basically you're taking legal counsel, even if only by inference, from someone who is not a lawyer. Not a good start. Then you offer your ideas as advice to some one else, even worse for them.

But, even if you were a lawyer, it still wouldn't be up to you. Any ruling on the matter would be up to a judge or jury, not the lawyer and not necessarily any precedent. They often forget to mention that when doling out advice. Of course, win or lose, they aren't going to jail, you are.

Potential huge win for open source

[Theovon]

(1) Now that the source code is leaked, more virus developers can write more viruses, making it dangerous to use Windows.

(2) Concerned individuals and companies can learn from those who look at the code just how BAD the vulnerabilities ARE.

This could very well accelerate migration away from Windows and towards other OS's which are secure despite having available source code.

Re:Potential huge win for open source

[pandrijeczko]

(1) Now that the source code is leaked, more virus developers can write more viruses, making it dangerous to use Windows.

Windows viruses affect everyone. We all use the same Internet that slows down when the latest worm hits. Virus writers are scum, kill them all.

(2) Concerned individuals and companies can learn from those who look at the code just how BAD the vulnerabilities ARE.

Probably, but what can they do about it? It's Microsoft's IP, they can't fix it and just hand it back. Virus writers will probably write more worms, the Internet slows down, we all suffer (see 1).

This could very well accelerate migration away from Windows and towards other OS's which are secure despite having available source code.

Erm, Open Source software is quite happily gaining market share without the need for this, thank you very much. Up to now it's being doing so on the basis of being software that's as good as, or better than, what MS write. It has not needed any visibility of MS IP to do this.

I am certainly no MS fan but this theft is nothing more than someone somewhere wanting some kudos.

C'mon, people! The real fight is not having DRM pushed down our throats, not tearing apart MS's source code...

Re:Potential huge win for open source

[mroch]

Perhaps available source code will make it easier to reverse-engineer/work around the DRM....

Re:The shit will hit the fan + Mirror

[happyfrogcow]

But that seems to set a very bad precident for things you might happen to see or hear and make information more dangerous than it should be. Information should be used to advance society, it shouldn't be a liability to know something.

Re:The shit will hit the fan + Mirror

[iminplaya]

I very much hope that no MS-copyrighted code ever finds its way into an open source project, both for practical reasons like the above and for moral ones.

There is no moral reason for copyright. It's especially bad now that it's being conveniently used as a tool for censorship(most likely its real intent). The 1st amendment is helpless against this.

The same copyright that keeps Windows secret keeps Microsoft (and others) from just stealing GPL'ed projects.

How do we know? If it's buried in closed source, we can't know. Unless of course it's leaked on the 'net. Without copyright, windows wouldn't be secret. We cuold just "steal" it back, and probably make it better. They would have no more protection than we would. It would actually level the playing field.

Hrmph.

[goliard]

Hrmph. I opened one of those files and all it said was:

If this were a virus, you would be dead now. Fortunately, it's not.
The Metaverse is a dangerous place; how's your security?
Call Hiro Protagonist Security Associates for a free initial consultation.

Re:Hrmph.

[RisingSon]

Maybe Redmond would listen to Reason

Proof M$ is SATAN!

[IchBinDasWalross]

From the list of files in the source code...

14946 07-26-00 02:59 win2k/private/windows/media/avi/drawdib/dith666.c
13506 07-26-00 02:59 win2k/private/windows/media/avi/drawdib/dith666.h
28718 07-26-00 02:59 win2k/private/windows/media/avi/drawdib.16/dith666 a.asm

Proof that MS is SATAN!

Microsoft already paid off SCO

[_Sambo]

Don't you remember that in the first days of the SCO debacle, Microsoft quickly ponied up with an undisclosed amount of green to license the UNIX code that was used in NT4,2K, and XP?

This is a moot point. It still made me smile though.

Re:Microsoft already paid off SCO

[RancidBeef]

I think that was for the "services for Unix" tools. They probably didn't even need to do that, but it was an easy way to slip SCO some money to fuel the FUD. And that's even if you don't believe all the conspiracy theories about MS being behind SCO.

Win 2k on Mac

[leperkuhn]

in theory then it could be ported to the mac by some rogue developer with years of free time. any one out there win the lottery, quit their job at microsoft and switch to a mac?

legally

[bmajik]

its unclear. MS's thinking is to take the worst-case approach - that they might be legally obligated to open code they'd rather not because of a wackjob interpretation of GPL and code pollution.

Therefore, MS's policy is that no microsoft developer is allowed to look at the code of any open source project, for any reason, without working with legal first.

It's a serious deal.

Re:legally

[bahamat]

Actually, I believe (or speculate rather) that it's a determination based on the licensing involved. MS openly admits to having lots of BSD code in Windows.

The TCP/IP stack is a huge example, not to mention SFU.

Re:legally

[bmajik]

sure, a determination that employees are not allowed to make without involvement of MS lawyers

only one of us is speculating. check out my user info :)

Semi-slashdotted? Here's the text...

[Anonymous Coward]

Neowin has learned of shocking and potentially devastating news. It would appear that two packages are circulating on the internet, one being the source code to Windows 2000, and the other being the source code to Windows NT. At this time, it is hard to establish whether or not full code has leaked, and this will undoubtedly remain the situation until an attempt is made to compile them. Microsoft are currently unavailable for comment surrounding this leak so we have no official response from them at the time of writing.

This leak is a shock not only to Neowin, but to the wider IT industry. The ramifications of this leak are far reaching and devastating. This reporter does not wish to be sensationalist, but the number of industries and critical systems that are based around these technologies that could be damaged by new exploits found in this source code is something that doesn't bare thinking about.

We ask that for the wider benefit of the IT community that members and readers support Microsoft by forwarding anything they know about the leak to the Microsoft's Anti-Piracy department.

Please do not post any links/screenshots/hints or anything to do with the source code outbreak. Discussion is allowed but we will not condone people spreading this source code.

(The rest is just the comments, you know, crap like you get on /.)

Re:Semi-slashdotted? Here's the text...

[blorg]

Perhaps the following error message was not such a good idea:

"There seems to have been a slight problem with the database. Please try again by pressing the refresh button in your browser."

Refresh, you say? Oh-kay...

compiled?

[Doc Ruby]

Has anyone compiled this beast yet? What does it do? Hopefully on a box disconnected from any network. When the devil hands you a prize, don't touch it with your bare hands.

This sort of thing probably wont happen again

[MonkeyINAbaG]

Never in my life, or my wildest dreams have i ever thought this possible.
I mean, really, a site getting slashdotted -in anticipation- of slashdot linking to it! Who would have imagined?

REPOST OF MIRROR LINK

[kfuq]

http://mirror.wolffelaar.nl/neowin/

Re:REPOST OF MIRROR LINK

[kfuq]

thx... LOL

Here's a working copy of Windows

[Cro Magnon]

The server is too busy at the moment. Please try again later.

You are talking out of your arse...

[Phil John]

...sorry, but you are.

I don't know of a single sysadmin worth his salt that blindly installs microsoft patches as and when they come out. Too many times in the past Microsoft patches have royally borked systems so now before they are deployed into a mission critical environment they are tested, and then they are tested some more.

The real problem is that people who use computers are generally (these days) not au-fait with the fact that they actually have to download patches (or even just visit Windows Update).

The big worry now is that malicous persons will scour the code looking for new bugs, security researchers may not find them before the hackers and thus all sorts of shits and giggles ensues.

Here's the kick though@- since Windows runs on various hardware configs (albeit variations on a basic themem), by Microsofts' own admission it takes them MONTHS to create and test patches before deploying them. Normally that's ok because a lot of these sploits can only realistically be gleaned from looking at the source, which only they were in possession of, so there were no exploits in the wild. Now, however, there may be exploits in the wild for six months before a patch comes out and you'll have microsoft saying silly things like "don't click on links, only type them into the address bar".

Re:You are talking out of your arse...

[Nintendork]

"I don't know of a single sysadmin worth his salt that blindly installs microsoft patches as and when they come out."

Sorry, but your method of thinking is outdated and you are full of shit. I supported NT4 Server for Microsoft for about a year and a half and have several friends that still support it as well as 2000. I helped the sysadmins that were "worth their salt". Give me all these examples you're referring to of patches hosing systems. When it comes to MS, the worst issue I saw was the SP6a security rollup hotfix breaking Compaq Proliants with old drivers for a specific RAID controller. That was about three years ago. In that situation, the good sysadmins kept the code (drivers and firmware versions) on the servers up to date for stability and performance reasons and weren't affected. If it weren't for all the testing they do on patches that make dramatic changes, you would actually see these swarms of problem patches you're imagining. They test the patches so we can have good faith that there's a low chance they'll break something.

These days, we don't have the time to go though the vigorous testing before deploying we once preached. It doesn't matter who the vendor is (Cisco, Microsoft, etc.). If it's a security vulnerability, you better patch it up ASAP before a worm goes wild. A worm coming out pronto is very likely these days. That doesn't mean you install it without a thought of the worst case scenario. On critical systems, you install the patch in the night to minimize downtime and you have a good backup handy in case something goes wrong. In the extremely unlikely event that a patch is causing issues on scores of workstations, I'll start getting calls from my users as they install it. I can then send out an email to everyone informing them not to install the patch and post something on the doors to the building in case they would otherwise decide to install before reading email. Hell, if it were that bad, I'd add an entry to the access list in our border router preventing everyone from getting to the windows update servers!

It is true that if the source is out in the open, there will be exploits in the wild before patches can be deployed. That's true of anything that has its source out in the open. However, Microsoft's business interest dictates that they protect their customers as much as possible. I trust that their desire to have a good reputation and keep existing customers will make a solution possible. Not to mention the resources and money they have at their disposal to expedite the patch development process.

-Lucas

Re:You are talking out of your arse...

[Phil John]

It is true that if the source is out in the open, there will be exploits in the wild before patches can be deployed. That's true of anything that has its source out in the open.

Problem is that source to the linux kerel and umpteen other open source projects have been out in the open for a considerable time and thus have had a fair amount of peer review going on (as well as people scouring it for their own nefarious purposes), however, the windows source code has been out what, 12 hours? Very little peer review will have happened (probably because people fear the repurcussions of admitting looking at the code), whereas bad people(tm) will have no such qualms. It's the old adage "if you outlaw guns, only the outlaws will have guns".

As far as worms and whatnot go, the ones that need executing...should never happen on a server, and those that exploit things like rpc, why the hell do you not have port 135 firewalled off, both to the outside world and to (l)user roadwarriors briging their laptops back after a week on the road.

inspired by?

[nanowyatt]

Harrison wasn't sued for listening to and being inspired by "He's So Fine", he was sued for using the same music and claiming it was his own. The songs didn't just sound similar, they were the same melody and chords.

You can play the blues without paying Robert Johnson's estate, but you can't play Crossroads and call it your own.

on IRC recently.....

[lysium]

Very recently I've been offered random DCC-sends a few gigabytes in size. One 3 gigs, the other 4 or so, and I am quite far from anything resembling a trading channel. Now I do not download the casually-offered megafile, but I cannot help but wonder -- is there a connection here?

==========

Source Code Exposed? Really?

[sepro]

There is also a good possibility that the leak was sanctioned. In the closest inner circles, the word out there has been that Microsoft may eventually orphan its current Windows OS kernel architecture to make way for a new OS that is generations ahead of Longhorn and just about everything else available. Just think, by the time public developers really analyze and understand the NT and 2000 code, the advantage gained from such knowledge might be rendered moot. Imagine, people rushing to capitalize on technology that will eventually be unsupported, while Microsoft is really doing an end run around the DOJ by creating a new platform that is by design airtight, locked down and truly immune from any DOJ or antitrust action. Bill didn't get to be a bill(ionaire) by being stupid.

Please be a hoax!

[raw-sewage]

I sincerely hope this is a hoax. On the one hand, it would be great to point to the Windows source code and say, "See how terribly written, buggy, crufty, etc closed-source code is?" And the rash of exploits, worms and virii that would follow would only underscore that comment.

But, it only takes one person to look at the Windows source, then go do something vaguely similar in Linux (or any OSS project for that matter). The result would be devastating: Microsoft would litigate Linux to death.

As many have said, the principle behind these copyright suits is awful. Looking at code, then doing something somewhat similar (because of inspiration) should not be a copyright violation. But with Microsoft's legal and financial resources, the laws will "adapt" to what is most beneficial to them.

I can only echo what many other have said: for the sake of Linux and OSS in general, do not look at the Windows source!. That's a very conservative and overly-paranoid policy, but it's a invaluable measure for protection.

To me, general acceptance of open-source software is similar to political elections: every last spec of dirt is drug out and put under the spotlight. Any potential or suspect or even misunderstood characteristic is scrutinized, and the naysayers always manage to put a negative spin on it.

Open source only stands a chance if it can maintain the straight and narrow path... I hate to sound preachy, but any slight mishap, no matter how innocent or accidental, quickly turns into a major catastrophic disaster. There's just too much money and power interested in seeing OSS fail.

Re:Please be a hoax!

[p00ya]

can only echo what many other have said: for the sake of Linux and OSS in general, do not look at the Windows source!. That's a very conservative and overly-paranoid policy, but it's a invaluable measure for protection.

Then you talk to a friend, not knowing that he's already seen the source. How do you know that any of your subsequent actions aren't influenced by his having seen the source (and more imporantly, can you convince a judge of this?).

Re:Please be a hoax!

[RGRistroph]

Seeing copyrighted work, and then writing a similar work, is not a copyright violation. Musicians listen to each other's work all the time -- do you think they don't listen to the radio ? Writers read each other's novels.

It is ok to write code even with a printout of copyrighted code on your lap for you to refer to. Unless, of course, you type in that exact code, or anything close enough to be called a derived work. That vague definition of "derived" is practically up to a jury or judge, so it's best not to get close to the boundary.

Sometimes you hear references to doing engineering in a "clean room" with "virgins" who have not been exposed to a particular product. Those are issues that arise in the case of trade secretes. Incidentally, any trade secretes in this code are no longer . . . in the US trade secret law applies only while the secrete is still a secrete. Damages or prosecution of the first person to reveal it might be possible, but not those who follow when it is public knowledge.

The reason not to bother with this is: we already have the source code to a number of much better operating systems, from FreeDOS and DRDOS to CP/M to Linux to BSD, etc.

If the Free Software movement continues to erode the vast money-machines of proprietary software companies, legal and illegal action will be taken regardless of

Please don't go around repeating this "if you even look at MS source you are contaminated" nonsense, because it will lend itself to Microsoft FUD if this is established in the public's mind.

By the way, I have heard through hearsay that many of Microsoft's managers believe this "look and be contaminated" stuff, to the extent that they are worried about their staff possibly looking at linux code.

cribbed code leads to murder...

[7String]

"The Truth Machine" by James Halperin is a fascinating parable detailing how someone who is accidentally exposed to outside code is forced to commit crimes in order to hide it.
In other words, don't do it! It could bite you in the ass later.

If code is criminal, only criminals will have code

[Vreejack]

If code is made criminal, only criminals will have the code

Now that was a very satisfying cliche re-use. I hope it was an original cliche re-use.

BTW the server seems ve-wy slow to-day. I think we were just Farked.

Isn't this it?

[gardyloo]

bersk.com

It's worse than that!

[RLW]

This is an attempt to corrupt your ability to write reliable code. It is the software equivalent of a Medusa. Once you've looked at it your mind will be agog to make blue screens. Do not look! For the love of Pete, DO NOT LOOK!!!!!

Re:It's worse than that!

[kcarlin]

Why write a BSOD when I've got reliable commercial versions gathering dust on my shelf. (Who else has friends that make party dresses out of MSDN disks?)

Not the real thing

[bartyboy]

It's only 39 megs.

Re:The shit will hit the fan + Mirror

[sir_cello]

Wrong: The WINE project could clean room it: get a bunch of people to work through the W2K source code and throw concepts, ideas and other things over the fence: this doesn't break copyright law, and if the concepts/ideas/etc are not covered by patents, then it doesn't break anything else. IBM pioneered clean rooming, and plenty of people do it.

Microsoft wouldn't own Unix

[leonbrooks]

Microsoft would own some marketing rights, that's all. Unix is owned by The Open Group. System V and UnixWare (at least) and the vast majority of corresponding copyrights and patents (except those held by OG) are owned by Novell. Oh, and Microsoft would also own a truckload of incoming lawsuits. How.. attractive.

Re:Microsoft wouldn't own Unix

[RancidBeef]

Hehehe... tell all that to SCO...

Re:Microsoft wouldn't own Unix

[bo-eric]

I think Novell just did: Novell Notifies SCO

Ballmer denies leak

[ironfrost]

According to a report on ITVibe, Steve Ballmer, Chief Executive and President of Microsoft has said in a statement:

"I can assure you that we know there has been no compromise of the integrity of the source code; that it has not been modified or tampered with in any way."

Steve Ballmer says.....

[Document]

Steve Ballmer said the following today:

"I can assure you that we know there has been no compromise of the integrity of the source code; that it has not been modified or tampered with in any way."

This is according to IT Vibe

Re:Steve Ballmer says.....

[tsvk]

Sorry, that quote is soon four years old.

Re:Steve Ballmer says.....

[Bendebecker]

But the so called 'update' qoutes a new article from 2000.

Re:The shit will hit the fan + Mirror

[cybergrue]

Having the source you could do a cleanroom implementation of it, have a set of "dirty" developers read and describe the undocumented API's and another set write those API's from scratch
Especially if the Dirty Room is in another country where the copyright laws are different (ie. saner) then the US.
The warning given to open source developers about viewing the windows source derived from the NDA that Microsoft forced developers to sign, not seeing the code itself. Copyright law allows the viewing of other works to learn how they are built. Mind you, the US legal system is so f%#$@d-up and M$ has so much money that there is no guarentee that this right will be upheld in court.

This is going to get REALLY interesting now..

[kfuq]

People thought that the mydoom worm was bad... i wonder what kind of interesting virii are going to come of this .....

Never mind the sourcecode...

[thrill12]

... look at slashdot - it's being... slashdotted ...

Or must we say in this case: backslashdotted ?

Analogy

[t_allardyce]

Penguins spend their lives in the freezing cold fending off polar bears and rouge iceburgs and catching fish, they are totally used to it and even if a particular nasty polar bear comes around they can usually deal with it. If you release a home-trained hampster into that environment its just gonna die.

Re:Analogy

[Endive4Ever]

And if you release a penguin into the sandy arid terrain where a hamster thrives, it will perish.

What's your point?

Re:Analogy

[t_allardyce]

The point is the penguin can never be moved to the sandy arid terrain because its a gpl penguin. But the hampster has just been shot out of a 50 foot canon and should be landing in the snow anytime now.

Re:Analogy

[Endive4Ever]

Yikes. Well, I guess if you live in Antartica....

Re:hmm seems a bit buggy

[fishbowl]

Sure they mark the code, and obviously they can identify the origin of a leak, unless the leaker detected the security system and took countermeasures against it.

But that's beside the point. Some of the source code has gone to organizations in countries where a countract with a US corporation has more value as toilet paper than as a legal document. Whoever started this alleged leak can probably count on never getting another update, or even having their MSDN licenses revoked, but outside the US, there might not even be enumerated consequences for an incident of this nature.

Not that I believe the report. The source code volume is on the order of dozens of gigabytes, according to more credible reports than this one.

News flash

[caesar79]

It has been reported that numerous patches have now been emailed to microsoft after the source code leaks of the previous hour. The quality of those patches has amazed Microsoft, which has with immediate effect fired most of its current employees and send out offer letters to the patch developers.

Inside sources also report that microsoft is also deliberating on firing all its employees and relying completely on the so-called underground community to maintain and develop new features of the Windows operating system. More on this as it comes.

"More on this as we hear it." - Yes indeed

[aaandre]

Yes, I am buyin a transistor radio and am unplugging my windoze pc from the net as of now.

GCC?

[althalus]

So, the big question. How long until GCC can compile it :)

Re:GCC?

[margal]

Well, they have some GNU Makefiles, so maybe their secretly maintaining a GCC version :)

Re:The shit will hit the fan + Mirror

[mangu]

The contention is that you would have a dickens of a time proving in court that you were not directly influenced or did not directly copy the copyright work

What part of "being proved guilty beyond reasonable doubt" didn't you understand? It's the accuser's task to prove the accused party guilty, not the other way round.

Re:The shit will hit the fan + Mirror

[jafac]

Of course, that wouldn't mean that looking at the source wouldn't be EXTREMELY helpful in the effort towards coding around issues caused by Microsoft cruft. No actual code would have to make it into the finished product.

Re:It's a TRAP!!! /Adm. Ackbar

[Lord Kano]

Microsoft is sooooo obviously trying to pull an SCO here.

This isn't the first time that Windows Source Code was "leaked". I don't remember them trying anything shady last time.

If you work on any Open Source project, DO NOT LOOK!

Try to prove that someone looked.

LK

Life is good.

[mr_luc]

It's 5:15PM. I got home from work 2 hours ago, and had a nap. It is a beautiful day outside, and the Windows source code has been leaked.

And I have 5 Moderator points.

Today -- today, life is good.

Re:Life is good.

[Mike Markley]

Except, of course, that you can no longer moderate this thread... :)

Re:Life is good.

[notque]

So with you, except I get off work.. Right now.

(and I think I'll lose a mod cause I modded in this thread, oh well. Worth it for a great day like today!)

Re:Life is good.

[blackmonday]

Now all you need is a girlfriend.

Re:Life is good.

[Anonymous Coward]

Now all you need is a girlfriend.

What, and ruin a perfect day?

Re:Life is good.

[PeeweeJD]

ummm... prolly because you post as Anonymous Coward? Its just a thought...

Re:Life is good.

[yourmom16]

I post as an AC fairly often, but I can moderate every once in a while

Re:Life is good.

[st0rmshad0w]

What, and ruin a perfect day?

So your girlfriend reads /. does she?

Re:Life is good.

[Yeti7226]

Scene: Two guys in black suits sitting in car

Guy 1: "It's midnight, the windows source in leaked, we have 5 moderator point and our sunglasses on..."

Guy 2: "hit it"

Sorry, that image just popped into my head ;-)

Re:Life is good.

[enthused i swear]

Well maybe he can't, but I ca-.......aww, crap....

Re:Life is good.

[Anonymous Coward]

>> Now all you need is a girlfriend.

>What, and ruin a perfect day?

Fsck, no! Wait till after dark, and then blow her up.

Re:Life is good.

[bobsalt]

No, it takes a wife to ruin your day, girlfriend you can tell to go home

Re:Life is good.

[Anonymous Brave Guy]

Now all you need is a girlfriend.

Do you have any idea how much that costs around this time of year?

Re:Life is good.

[Anonymous Coward]

No-
But my wife does!!!

Worldwide Impact

[Psx29]

I don't think anyone here has mentioned it yet, but imagine what this could do for other countries of the world. I can see governments modifying it themselves or doing some other dirty things since the government is what ultimately enforces copyright. How would foreign contributions to an opensource project where copyright does not apply work? Imagine someone from a loosely regulated country contributing code from windows to an open source project? What could be the ramifications of this!?

A less obvious question:

[Anonymous Coward]

Since "Eve" has gone and posted the code, if "Alice" does and implements a "clean room" description of how all of the code works and posts that, and "Bert" goes and re-implements the code from the posted description, does Microsoft have a valid case against Bert? Or are his hands clean?

Heck, assuming the Recent Lindows ruling stands, could Bert get away with selling it as Windows????

Re:A less obvious question:

[atheken]

well, really, is it ok if Bert doesn't know it's windows code, I don't think so.

More interestingly, is Bert responsible for finding the source of the source code. (pun may or may not be intended)

Re:Ballmer does NOT deny leak

[Anonymous Coward]

Re-read that quote; he's not denying anything about leaked source, he's denying that there have been any intrusions into Microsoft's software sources themselves. Not the same thing at all.

He's saying that the leaked code is the same as the code in their version control system ;-).

You're missing the point

[Lurgen]

Something people seem to be forgetting is the impact this could potentially have on the IT industry as a whole. Like them or not, Microsoft are a key player in this industry and if they suddenly take a fall many of us will be brought down with them.

A sudden loss of confidence in the Windows product could spell disaster for a wide range of occupations - imagine an IT-specific recession, resulting in enourmous layoffs and salary cuts.

The worst thing is that there is no way this can turn out to be good news. If it's true, we're in trouble. If it's false, then we're still going to see share prices slump (not just MSFT either), which impacts most of us.

Friday the 13th is always a pain in the neck.

Re:You're missing the point

[HungWeiLo]

A sudden loss of confidence in the Windows product could spell disaster for a wide range of occupations - imagine an IT-specific recession, resulting in enourmous layoffs and salary cuts.

But I thought 75% of the IT industry was created by the loss of confidence in the Windows product. No really - would we need that many people on the IT payroll if it wasn't for the need for IT techs to fix things?

Re:You're missing the point

[conteXXt]

It seems that you are not looking far enough.

Computers are necessary.

If windows is untrustable, what do you do?

(Hint: There ARE other operating systems that run on PCs)

Re:You're missing the point

[kindbud]

... imagine an IT-specific recession, resulting in enourmous layoffs and salary cuts.

Dude, where have you been for the past three years? Oh, I know... government IT. How'd I guess?

Some snippets of code

[rmsousa]

I find this one refreshing...
if (app.exename="NETSCAPE.EXE") system.sluggify();

And this one provides for the future...
if (site.url="www.google.com") {
browser.renderer.togglebuggyrenderer(); /* You will be assimilated, suckers */
browser.fakepopup("www.msn.com");
}

I can't say anything about this one though:

if (user.status==PISSED_OFF)
prick.annoyingpopup("Hello, I noticed you are writing a letter")

Seriously, given the denounces of delayed APIs for Navigator, I wouldn't doubt the first one... could someone with the codes please grep for netscape.exe?

Re:Some snippets of code

[pen]

Seriously, given the denounces of delayed APIs for Navigator

I thought I was the only one who noticed this! Everything works much faster in Windows 2000/XP except for Netscape Navigator when it is doing network stuff. For me, Netscape flies on NT4 and Windows 95, but is incredibly slow on newer versions of Windows.

Re:Some snippets of code

[WWWWolf]

if (app.exename="NETSCAPE.EXE") system.sluggify();

Bah! Even at the pace Microsoft is releasing their patches, they can't possibly keep up with all these executable names. netscape.exe vs. mozilla.exe vs. phoenix.exe vs. MozillaFirebird.exe vs. firefox.exe vs....?

=)

Re:Some snippets of code

[mijok]

Hmm, I think you just explained why mozilla keeps changing its name so often... ;)

I know that...

[Ayanami Rei]

I've hacked Samba myself and I am 100% sure it's reversed engineered.... heh.
The point is now they can claim that they had potentially had access to their trade secret (not that they necessarily copied it verbatim). The can call all the work into question, and while it can be pretty thoroughly shown that this is not the case, it could take awhile to sort it and out and by then Samba could be tainted in the eyes of less savvy IT persons.

Not a great plan, IMHO, but quite possible. The same argument goes for Wine, but others had already brought that up.

Re:I know that...

[pandrijeczko]

Ah, right, I see what you're getting at now...

Amongst their other technological feats, Microsoft have now invented the time machine and have succeeded in travelling to the future, getting hold of the Samba source code and travelling back to the early development days of Windows 2000 to incorporate future Samba source code within Windows 2000. So now that the source code to Windows 2000 is released, MS can now sue the Samba team for copying their code.

Fiendish...

Re:I know that...

[trenton]

The point is now they can claim that they had potentially had access to their trade secret...

That's the double-edged sword that is the trade secret. Legal protection only lasts as long as you keep it a secret. So, once it's out, it's out. They could still claim copyright infringement on verbatim coping, but not derivative works.

You can read all about trade secrets at Nolo.com.

Be very careful, folks.

[Mr. Piddle]

For instance, I hope no one has been foolish enough to try compiling this stuff on a networked computer! God knows what's in so much source code. What if: downloaded, compile, phone home, busted.

Life just got WAYY better

[conteXXt]

I think rates just went up.

(And so did domestic (IT) employment!!!!)

Re:IAAL???

[plj]

IAAL.

My god, this is simply not possible - man, this is /.! You must be just some miserable karma whore... or then you just made a major typo and forgot the obligatory "N" and ",but".

Well, I believe the latter must be the case. Be more careful on your next post, OK?

Re:ed2k link?

[Anonymous Coward]

No, you want the 1.09 GB file from e2dk.

ed2k://|file|Windows_2000_Source_Code[NeoWin.Net ]. rar|1167616724|C60BD616078CE954AC05C7C7B94C0C2B|/

on bytedevils.net/?88

Microsoft did this on purpose - missing the point

[mike123106]

Guys.. you have to realise, that 2 days ago, microsoft patched the biggest security hole EVER in xp.. they knew about this since july.. this is unexeptable.. rather than face the scorn on this issue, why not "accidenty" let a copy of source code get out.. this is much better than having millions of xp users mad at you.. and the publicity will be focused on this.

Re:Ballmer does NOT deny leak

[ironfrost]

Oops! You're right, of course. How embarassing.

Although, reading it again, I don't agree that "He's saying that the leaked code is the same as the code in their version control system". He's just saying that Microsoft's own copy hasn't been tampered with.

Re:Steve Ballmer statement...

[Bendebecker]

What did you expect him to say? "We're all screwed, dump your stock now!"??? If he so much as hinted at the possibility that it was real (even if he knew otherwise) do you really think he'd say it? If he even hinted at it, the stock prices would take a hit...

Re:The shit will hit the fan + Mirror

[whitesn95GT]

Out of sheer ignorance, I truly want to know how OSS developers can be sure Microsoft (because of its closed source nature, at least, til now :) ) hasn't copied some GPL'd code. As in, if no one (at least, effectively no one) can look at Microsoft's code how can anyone be sure Microsoft hasn't lifted some code?

Mod parent down plz

[Britz]

Did u check the list before posting it????

I don't know much about Windows, but this doesn't look like a Microsoft Windows source tree at all. At least not how I would imagine it. Lines from the file list:

win2k/private/inet/mshtml/src/f3/rsrc/unix/
win 2k/private/inet/mshtml/src/f3/rsrc/unix/gnumake file
win2k/private/inet/mshtml/src/f3/crt/ppc/
( what on earth could ppc mean? there is a line with x86 a couple lines below to give u a hint, windows on mac next or what?)
win2k/private/inet/urlmon/compress/gzip/

And I didn't even went through a fourth of the list. Why don't we ask the guys from Wine or from ReactOS. They should be able to tell u how WinNT Source could probabely look like.

Re:Mod parent down plz

[be-fan]

Those make perfect sense. There was a IE port to Solaris (mlhtml...unix) and Windows did (probably still does, just not publically) run on PPC, MIPS, and Alpha in addition to x86.

i found it!

[micronix1]

http://www.bersk.com/programs/source.html

Re:The odds of getting the full source: experience

[The Other White Boy]

you're stealing sourcecode from the crippled children??

Isn't it ironic?

[BlueLucid]

Take a look at Microsoft's home page right now. In it you'll see a large graphic at the top talking about the mydoom virus. A little further down on the right, you see a link regarding the Virtual PC security hole on the Mac. And even further down, you'll see that two of the top downloads are the mydoom patch and blaster removal tool. Then, go to Apple's homepage... -BL

Dotted

[rixstep]

At time of posting, Neowin is inaccessible.

The server is too busy at the moment. Please try again later.

Microsoft source code leak? Pfft, that's nothin...

[blorg]

...I hear the source code to Linux gets leaked every other day!

Re:it's true...the leak is probably trackable

[depsypul]

If it was one of the many high level institutions that Microsoft has given access to, then Microsoft likely has a method to track the leaked code back to the source.

Like Tom Clancy's Canary Trap, for example.

LIKE THIS?

[fractaltiger]

http://miranda-icq.sourceforge.net/zeez-im/

Check out a report of how Zeez Universal IM System copied sections of the popular GPLed Miranda IM. Down to the label strings in places and a "blank"-ed GPL agreement dialog!

~fractal

Since when does Microsoft using GNU Makefiles?

[margal]

2404 07-26-00 02:12 win2k/private/inet/mshtml/src/core/cdutil/gnumakef ile

Re:Oh, no! I Looked!

[Elitist Snob]

10 * BEGIN
100 GOSUB 7000 ; * Load stuff
110 GOSUB 900 ; * Show windows logo
120 GOSUB 20000 ; * Prompt for operator login
130 GOSUB 32000 ; * Fill half of memory with DLL's
140 GOSUB 16000 ; * Time waster loop
.
.

200 GOSUB 38000 ; * Profit

Re:Oh, no! I Looked!

[DurendalMac]

I knew MS was still using BASIC!

Are you sure ?

[bmajik]

The Windows code hasn't had nearly as much peer review as open source OS's

What do you know about who reviews the windows code ?

Also, what assumptions are you making about the number of people, and their qualifications, that are reviewing OSS code ?

Re:Are you sure ?

[G27 Radio]

What do you know about who reviews the windows code?

Only that there are a limited number of people with access to that code (at least up until now.)

Also, what assumptions are you making about the number of people, and their qualifications, that are reviewing OSS code?

I think it's safe to assume that people reviewing OSS are coming from all different backgrounds--let's face it not every one of them is going to be an engineer, nor are all of them going to be kids hacking in their mom's basement.

But rather than just making assumptions, I'd recommend subscribing to the Linux kernel mailing list, and/or some of the *BSD mailing lists if you want to get an idea of the caliber of the people working on the code.

Past performance is also a good indicator.

Re:Are you sure ?

[abradsn]

Are there testbeds, test harnesses for Linux?

Just curious...

[Anonymous Coward]

What if we find GPL code in there somewhere? Will it still be "not cool?" I respect your integrity, but as far as I'm concerned MS is a pretty sleezy company so I'm not gonna shed any tears for them.

Re:Just curious...

[GoofyBoy]

>I respect your integrity, but as far as I'm concerned MS is a pretty sleezy company so I'm not gonna shed any tears for them.

Its about not stooping to their level.

The main drivers of OpenSource are those which just program and share, not those that fight dirty/go on illogical and embarassing rants.

Look at SCO. I assume that there are many fine people there, but how do you view the company as a whole? After this SCO vs. IBM thing is over, what is your impression of them?

When you find them....

[_ph1ux_]

.... try this password: cia1234 or 1234nsa

Re:When you find them....

[ruiner13]

damn, off to change my passwords...

Re:Oh, no! I Looked!

[glenn1you0]

I'm sure it's more like: /*
* errno.h
*
*/
#ifndef _I386_ERRNO_H
#define _I386_ERRNO_H

#define EPERM 1 /* Operation not permitted */
#define ENOENT 2 /* No such file or directory */
#define ESRCH 3 /* No such process */
#define EINTR 4 /* Interrupted system call */
#define EIO 5 /* I/O error */
#define ENXIO 6 /* No such device or address */ ...

So does that mean...

[OneHungLo]

that Wine might ACTUALLY WORK in the near future?

Re:So does that mean...

[Tony Hoyle]

If any of that code (if it's real) makes it into WINE then that's the end of the project... so yes it'd actually work, for about a day, until the MS lawyers shut it down.

Re:So does that mean...

[Curtman]

Depends what's actually in it, if it turns out to be true. Would the source to MFC or .Net be in the kernel? It may help with the binary loader for Wine, but that already works well without seeing the source.

Re:The shit will hit the fan + Mirror

[Penguinshit]

What part of "Economic Litigation" don't you understand?

A company or person with very deep financial pockets can sue out of existence another company or person without such financial resources. It costs money to hire lawyers to do research and show up in court. With a million dollars and a halfway-competent attorney you can bury someone with a thousand dollars and Perry Frickin' Mason on his side.

It's been done countless times before, and it's about to happen to SCO (notice how IBM isn't moving for a dismissal...).

Re:It's a TRAP!!! /Adm. Ackbar

[Cheval]

It's a trap! :D

Yes, buuuuut

[phorm]

With all the spying, prying viruses out there, how hard would it be for the windows source to be "stolen" via a backdoor, grabbed password, or whatever. It would be an interesting case, a windows exploit allows somebody to hack company X and steal windows source... who is at fault: MS for the exploit or company X for the "insecure" server?

Other leaks

[Sivar]

Apparently, in addition to Windows, the Linux source code has been leaked as well. Fortunately for all of us, a little known company which apparently owns the IP to Unix, C++, space flight, and breathing has kindly made it legal to use their IP, for a fee.

Re:The shit will hit the fan + Mirror

[eddy96]

The same copyright that keeps Windows secret keeps Microsoft (and others) from just stealing GPL'ed projects.

You bring up an interesting point. What if the Windows source was analyzed for stolen GPL code? Wouldn't it make that part of the Windows OS GPL?

Would anyone (FSF?) sue Microsoft for copyleft infringement? The developer of mplayer is having just that problem. Only in his case, it is blatent and easy to detect.

This, by the way, is not an excuse for proliferating the code. I for one agree that anyone who sees it is tainted. Just don't risk it.

Re:The shit will hit the fan + Mirror

[shaitand]

Yes but that doesn't stop someone from dropping out of the project and looking over this code and writting a COMPLETE documentation of the api based upon it which the remaining developers could then use.

SCO?

[linuxgnuru]

So, how long until SCO sues Microsoft for stolen code?

Statement from MS?

[Eccentrica Galumbits]

Found this nothing to back it up on microsoft.com just yet though...

Re:Statement from MS?

[funwithBSD]

Rumours are rife on the Internet at the moment about the possibility of the source code for Windows 2000 and NT4 operating systems having been leaked onto the Internet for download.

If these rumours turn out to be true, it could be disasterous to many, many organisations.

The sheer number of exploits and viruses that could possibly be released just doesn't bear thinking about.

We must stress at this time, these are only rumours.

More news as we get it.

UPDATE @ 22:46:

Steve Ballmer, Chief Executive and President of Microsoft has said in a statement,

"I can assure you that we know there has been no compromise of the integrity of the source code; that it has not been modified or tampered with in any way."

Panic over then.

What is interesting is what Ballmer did NOT say, he did not say the code did not get out, just that it had not been tampered with.

BIG Difference!

Not news, MS packaged gnu tools before, with GPL

[dbIII]

What is this:

win2k/private/inet/urlmon/iapp/gnumakefile

This isn't news, MS have released CDs including such things as gcc, complete with a copy of the GPL licence. They can use it too, so long as they don't claim it's theirs and if they include any changes. The guys that write it are not the same as the guys that print the press releases.

Ballmer etc

[Mcman12]

Can anyone give me an irrefutable source on this? Ballmer is not assuaging any rumors really by saying "it has not been modified" so I'm guessing there is a lot of validity to this. If anyone has a solid source of any information, please let me know.

Re:Ballmer etc

[Bendebecker]

The Ballmer qoute was taken from a new article from 2000. The itvibe page has since been updated with the 'update' being removed.

"Virri"? That's a new one!

[lorcha]

The correct pluralization of the word "virus" is "viruses". Anyone doubting this is encouraged to read this article which should be titled "Way The Hell More Than You Ever Wanted To Know About Latin and Why There Is No Such Thing As 'Viri'".

HTH. HAND.

Source code review

[Cybersonic]

If anyone gets this code and feels like it, it would be nice to run this through a script and compare the code to known GPL code... I would like to see if there are ANY 'close similarities'.

Re:It's a TRAP!!! /Adm. Ackbar

[whittrash]

I wonder though...did M$ steal IP from other people? Now is the chance to see.

It's been out for a long time....

[Yenhsrav_Keviv]

Code for win31, win95, win98, nt3.0, nt4.0 and win2k has been out for a long time.....
see
http://www.albinoblacksheep.com/te xt/source.php
and
http://www.betatesters.com/pen n/mscode2000.htm
for links.

Ballmer's absolutely telling the truth.

[Ayanami Rei]

The source code has NOT been modified or tampered with.

Notice he didn't add "downloaded by everyone with broadband and a clue".

Re:Oh, no! I Looked!

[Virtex]

I knew MS was still using BASIC!

No, that's their C code. Probably explains a few things.

That quote is from four years ago

[blorg]

...when hackers broke into Microsoft's corporate network. Google is your friend.

Re:I have it.

[CaptainTux]

Wow. This is perhaps the most creative and believable load of crap I've read on Slashdot in a while. Not to mention entertaining. I can't believe that someone actually needed attention this badly as to type such a load of crap out.

1500 zip files, rarred up

[cheekyboy]

as per usual warez insanity by 14 yo lamers.

They will generate 1500 zip files all rared up individually then rared up in total again.

Re:1500 zip files, rarred up

[Bendebecker]

Doesn't matter if you zip it twice or a hundred time, you'll only get about 1% compression after the first time (the compression of the zip header files of the zip archive).

Outdated

[Anonymous Coward]

Even if it is the code, it appears to be seriously outdated in large parts. I grabbed the file list off of /. and did

cat files.txt | awk '{print $2}' | grep -E "01$

. This tells that the latest Code has been contributed in 2001! Well, the basics may be the same, but a lot of updates recently commited are not present in this code (again, if it is real).

Reverse Engineer Protocols?

[PhotoGuy]

Couldn't this source code be used for constructive monopoly-busting purposes, such as figuring out some of the protocols/formats for things like SMB and NTFS?

No, none of the code should be used, and the people who glean the protocols and formats by looking at the source, shouldn't do any of the coding. But it could really help free up some of the holds that MS has tried to put on the market through their control of protocols and formats.

Thoughts?

Another Insightful comment:

[Bilange]

#12 Posted by dreamthief on 13 Feb 2004 - 00:32
Come to think of it... this might be some Microsoft big grand conspiracy plan.

With released source codes, any security breaches:

1) MS certainly would blame on the souce code leaks (and not their buggy software)
2) emphasize more on their stand on closed source code policy, open source = more security vulnerability

No you haven't

[Anonymous Coward]

I worked at MS on NT, and though it's been a few years, I can definately tell you there are "gnumakefile" files all over the place. It's the first thing any coder notices when they first look at the source, "Hey theres a Makefile, and a gnumakefile, what's the deal?"

If you'd really seen the source, you would have remembered that.

found a security hole!

[QEDog]

I already found a big security hole! Just commented out everything in file iexplorer.cc to fix it.

Re:It's a TRAP!!! /Adm. Ackbar

[orthogonal]

Microsoft is sooooo obviously trying to pull an SCO here.

If you work on any Open Source project, DO NOT LOOK!

Whoops! I looked. And now it's clear why Microsoft bought a license from SCO.

All these headers start with "Copyright, AT&T" and "Copyright, Regents of the University of California". I wonder what that's all about.

(For the more literal-minded Slashdot readers: no I haven't really seen the code. This is a cheap jab at Microsoft, implying their code is derivative of unix and linux code,)

Re:Steve Ballmer statement...

[seppy]

That quote comes from this link dated in the year 2000.

http://news.bbc.co.uk/1/hi/business/993933.stm.

Dateline: Friday, 27 October, 2000, 16:23 GMT 17:23 UK

Here it is...

[Anonymous Coward]

Props to the original


Its a little long but here it is:
-------- /* Source Code to Windows 2000 */

#include "win31.h"
#include "win95.h"
#include "win98.h"
#include "workst~1.h"
#include "evenmore.h"
#include "oldstuff.h"
#include "billrulz.h"
#include "monopoly.h"
#define INSTALL = HARD

char make_prog_look_big[160000];
void main()
{
while(!CRASHED)
{
display_copyright_message();
display_bill_rules_message();
do_nothing_loop();
if (first_time_installation)
{
make_50_megabyte_swapfile();
do_nothing_loop();
totally_screw_up_HPFS_file_system();
search_and_destroy_the_rest_of_OS/2();
make_futile_attempt_to_damage_Linux();
disable_Netscape();
disable_RealPlayer();
disable_Lotus_Products();
hang_system();
}
write_something(anything);
display_copyright_message();
do_nothing_loop();
do_some_stuff();
if (still_not_crashed)
{
display_copyright_message();
do_nothing_loop();
basically_run_windows_3.1();
do_nothing_loop();
do_nothing_loop();
}
}

if (detect_cache())
disable_cache();

if (fast_cpu())
{
set_wait_states(lots);
set_mouse(speed, very_slow);
set_mouse(action, jumpy);
set_mouse(reaction, sometimes);
}

• /* printf("Welcome to Windows 3.1");*/
  /* printf("Welcome to Windows 3.11"); */ /* printf("Welcome to Windows 95"); */
  /* printf("Welcome to Windows NT 3.0"); */ /* printf("Welcome to Windows 98"); */ /* printf("Welcome to Windows NT 4.0"); */

printf("Welcome to Windows 2000");

if (system_ok())
crash(to_dos_prompt)
else
system_memory = open("a:\swp0001.swp", O_CREATE);

while(something)
{
sleep(5);
get_user_input();
sleep(5);
act_on_user_input();
sleep(5);
}
create_general_protection_fault();
}

Re:what the hell am I downloading then?

[tsvk]

Sorry, that quote is almost four years old.

4 Year Old Qoute!

[Bendebecker]

See above a couple of posts. The 'update' is a qoute from a news article from about 4 years ago.

nope litespawn

[linuxislandsucks]

nope litespawn is the shell switcher that allow syou to switch from explorer.exe to a different shell such as litestep

Re:nope litespawn

[nickos]

That's what I'm saying - litestep is an alternative to explorer.exe (the default shell). Window management is something quite different.

Re:The shit will hit the fan + Mirror

[Power Luser]

Do you really think they could cleanroom stolen code without repercussions? If they got found out, Microsoft would have a freaking field day with it. And not just in the courts either - you can bet it would be splashed around the media as well. Even IF they had a legal leg to stand on, it would be utter stupidity to try it.

Toxic leak

[hoggoth]

> Windows 2000 and Windows NT source code has been leaked to the internet.

Emergencies crews are working around the clock to clean up the most toxic leak since Exxon Valdez!

The real question is, of course -

[blorg]

Why this is perceived as such a security threat to Microsoft, when it's not for Linux?

Re:The real question is, of course -

[RancidBeef]

Because Microsoft depends on "security through obscurity". Now the holes are allegedly there for the world to see.

Re:The real question is, of course -

[kaschei]

Because Microsoft doesn't accept code updates from people who know better than they, so any bugs that are revealed are not going to be fixed through the increased visibility of the code. Having open code is only good if you have the will, the ability, and the infrastructure to make use of its openness. Microsoft is famous (infamous?) for lacking all three.
The short of it is: no "free" security updates a la linux, just more visible bugs to exploit.

Re:The real question is, of course -

[DarthTaco]

" Why this is perceived as such a security threat to Microsoft, when it's not for Linux?"

The assumption is that microsoft writes insecure code, and depends on it's non-publication to keep this a secret.

I think this assumption is mitigated by the fact that so many universities have a license to look at the source.

Re:The real question is, of course -

[LittleBigLui]

A)
1. look at the linux source
2. find a mistake
3. send a patch to the maintainer.
4. PROFIT!!

B)
1. look at the windows source
2. find a mistake
3. ???
4. write a worm
5. get caught
6. JAIL=tEH_SuXX0rZZ!!!1!! lolomgrofl

Re:The real question is, of course -

[Curtman]

Becuase Linux' code has be subject to peer review since day one. This would mean Microsoft's code is subject to the same review (maybe even more feverous) taking place in a week or so. And no ability to submit fixes back without saying you have illegally downloaded it.

Re:The real question is, of course -

[timeOday]

The same reason smallpox killed more Indians that Pilgrims.

Re:The real question is, of course -

[mangu]

Why this is perceived as such a security threat to Microsoft, when it's not for Linux?

Because the Linux source code can be legally downloaded by the "good" guys, who go and fix the holes. OTOH, only the "bad" guys download the Windows source code (it's illegal to do so, you know), and they go and create exploits based on the holes.

Re:The real question is, of course -

[Chess_the_cat]

Except when the so-called good guys are actually hiding back doors in the Linux code to trick Joe User who grabs it off an anonymous FTP server. To me, both systems are equally insecure. Linux because I can't trust it, Windows because it's poorly written. Six of one, half dozen of the other.

Re:The real question is, of course -

[dubious9]

Because Microsoft never had its code freely audited. Because they won't take patches from Joe Shmo. Because they design for features first, security third. Because they relied on security through obsurity. Because they don't have a global network of developer-users to fix patches when they see them. Because it takes Microsoft a relatively long time to fix bugs. Because...

Re:The real question is, of course -

[negacao]

All right, I'll eat the troll bait.

MAINLY BECAUSE YOU CAN PATCH LINUX, GIVE THE PATCH TO THE OWNER, AND HAVE THE VULNERABILITY FIXED.

Now you're gonna tell MSFT would take such a patch, rather than sue you into the ground for having the source in the first place?

Re:The real question is, of course -

[mangu]

good guys are actually hiding back doors in the Linux code

They can't do that, since the source code is open. That Edgar Allan Poe "Purloined Letter" story set the precedent. Nowadays, any self-repsecting investigator will check first the obvious, before checking the obscure stuff.

Re:The real question is, of course -

[KarmaMB84]

Because people assume that because its closed source, Microsoft leaves in gaping security holes rather than fix them. They forget that Microsoft does use its own products and would probably fix this stuff if aware of it if only for their own benefit.

Re:The real question is, of course -

[Attaturk]

Why this is perceived as such a security threat to Microsoft, when it's not for Linux?

Because Microsoft's OS was, and is, designed and developed based on a principle of closed source. Generally speaking, with closed source development potential black hats can't see how you do things without significant reverse engineering. This gives the OS programmers a 'safe' framework to work within. So when that source later becomes available to the general public, it leaves the OS programmers facing a huge legacy of problems that should, in theory, never have become problems.

Linux was open source from the outset. Therefore it is designed and developed relying absolutely on the principle that it's secure because everyone has equal access to see how things are done.

Furthermore, if and when there are security holes then at least with OSS you can never be held to ransom by the people owning the source. i.e. "Windows 98 has this huge security hole and it's no longer supported - go buy Win2k."

Re:The real question is, of course -

[shep1972]

simple.....relatively few people/business use linux compared to windows....if you are an attention seeking idiot who writes malicious code, who would you target? the population that gets you on the national news, or the small group of users who probably know better than to launch the worm carrier to begin with?

Re:The real question is, of course -

[Jason Earl]

It's Microsoft that has the history of putting hidden features into their software. Those jokers once put an entire flight simulator in Excel. Push comes to shove I would rather trust the guys working on Debian (out in the open where anyone can participate) than trust the folks at Microsoft. Not to mention the fact that with Free Software I can at least take a peek at the software myself.

Re:The real question is, of course -

[rixstep]

Because many outsiders will for the first time be able to see what idiots the Microsofties are. Open source and Linux code need not be stellar, but nothing beats Redmond for pure out of the box stupidity.

Re:The real question is, of course -

[Selecter]

I wish I had mod points right now. That's a +2 funny.

Re:The real question is, of course -

[Last Warrior]

I think the best thing that could happen with this is that people make anonymous security fix submissions..
Itll show that there is a bright side to having public code review.

no doubt microsquash would sue anyone they catch to death.. but the only thing they could do with anonymous submissions would be to analyuze them and maybe apply the best of the patches.

Re:The real question is, of course -

[Metasquares]

According to NetCraft, it is.

Re:The real question is, of course -

[KarmaMB84]

There's some truth in the Anon Coward's wise words in that the don't use Win2k or NT4 but they do use the latest version which they may have fixed any critical bugs they know of. They DO use their own software as you've pointed out, though =)

Re:The real question is, of course -

[jorgen]

guys are actually hiding back doors in the Linux code to trick Joe User who grabs it off an anonymous FTP server.

That is why you never download the Linux code from an anonymous FTP server. Why would Joe go to an anonymous FTP server or Dc++ or Kazaa to download the kernel when he can download it for free from a trusted source, which should be easier to find anyway?

To me, both systems are equally insecure. Linux because I can't trust it

You don't trust it because someone else might be naive enough to download it from an untrusted source? Why should that concern your own decision whether to run Linux or not?

Or maybe you mean you are Joe User and you don't trust yourself to be smart enough to not download it from an anonymous FTP server? Yet you seem concerned by the possibility, which makes this scenario unlikely anyway.. I don't get it...

Re:The real question is, of course -

[Zleeper]

I am sure they either:(tin foil hats on)
have fixed the bugs for themselves, even only if on their own desktops. I know it takes 14 gazzillion yerars to compile WINXP, but maybe not for the in-house compilers....
Made non-sellable MS-only versions with stripped out or included components not meant for the masses.
Have various secondary software workarounds to fix the leaks and patch holes. Of Course probably in-house only, not for retail.

Re:The real question is, of course -

[AstroDrabb]

Is it really illegal to download the source code to MS? It is protected by copyright law and I thought copyright laws only protected against distribution? I can go to a library and read any book I want. I can look at any piece of artwork I want. What I cannot do is to distribute those works without permission. The RIAA has not sued anyone for downloading music, only for UPLOADING music. I am not a lawyer, so I could be way off here. If I am correct, then there is nothing wrong with looking at the MS source code. You can even use non-patented stuff that you learn as long as it is a clean room implementation that is not based on the copyrighted code. Again, don't take this as advice, since I have no clue about copyright laws.

Re:The real question is, of course -

[IamSoCal]

> ...relatively few people/business use linux
> compared to windows

Really? Maybe Grampa Jones is still using winders, but a HUGE majority of web-based businesses are on Apache, powered mostly by Linux. The proof? Glad you asked...

http://news.netcraft.com/archives/web_server_sur ve y.html

Re:The real question is, of course -

[ozric99]

It's more of a threat because the majority of open source software has always been that way whereas the source for Microsoft Windows has never been open - who knows what may be lurking in there to exploit.

Of course, if Microsoft didn't rely so much on security through obscurity.....

Re:The real question is, of course -

[BiggyP]

i guess it's because the Linux source code is carefully scrutinised on a regular basis, whereas the windows sources, because microsoft doesn't give them away to the public, are not.

but i doubt a sourcecode leak is all that dangerous, surely security can't be that bad, can it?

Re:The real question is, of course -

[Dr. Evil]

I'm not so quick to agree...

One very carefully placed plausibly deniable bug could be a back door... a bit tough to exploit, but a back door regardless.

How do you know that the last security advisory wasn't the discovery of an intentional backdoor?

Re:The real question is, of course -

[sealawyer2003]

You may look at it as long as your method for doing so does not make a copy. But downloading the code will make a copy, and so will viewing at on a browser.

Re:The real question is, of course -

[Matrix9180]

if someone were to try to hide a back door in linux, I'm sure that one of the many many other developers would take notice and have it removed (if it even managed to get checked in in the first place). Your argument doesn't stand up too well.

Re:The real question is, of course -

[shep1972]

the majority of web-based businesses are the minority of all businesses. e-business or whatever term you use may be growing and manufacturing declining, but manufacturing and service jobs are still the VAST majority of jobs out there. long way to go....trust me. i'm not pro windows...or pro ms....just being realistic about why opportunists behave in certain ways.

Re:The real question is, of course -

[Xenographic]

How would that explain the !seineewerasreenigneepacsten backdoor? I seem to remember IIS having that for about four years.

We found the last one put into an open source codebase in what? Less than one day?

Assumptions are meaningless. I can only attest to what I've seen in practice. Unless our coders, working for free, are better than the ones Microsoft can hire with all that cash, what exactly would you attribute the difference to?

Re:The real question is, of course -

[websaber]

Because open source only works when reported bugs get fixed. If you already have a long list of bugs unfixed any new ones reported are a just a added security risk.

Re:The real question is, of course -

[Red Alastor]

Maybe but seriously. Who may be interested to submit said patches ?

Re:The real question is, of course -

[IamSoCal]

OK. Point taken. But... Web revenue for brick & morter business is growing constantly. Not that far to go, really.

Manufacturing is increasingly based on embedded systems. Most emebedded systems are not MS based, and Linux embedded is the fastest growing platform.

It comes back to the point made at the beginning of this thread - MS OSes are, and always have been, inherently unstable and insecure. The explosion of web-based applications make it an easier transition away from MS and on to something better.

I'm only pro-Linux because I've used it for over 6 years and find it very stable, immune (so far) to V/W/T, and efficient.

Re:The real question is, of course -

[shep1972]

i'm also running linux....even got my lab to convert over completely.....we are quite happy using open office and no one ever knows that we aren't making native MS documents.... but i beg to differ about the "why: of all of the attacks....yes linux (and all open source by its nature) is more "adaptable" to threats...more secure? yes...because of tht adaptability and rapid response. but the reason that no one writes malicious code against the open source world in large part has to do with the fact that it wouldn't make the headlines that attacking MS products does. it all boils down to attention seeking, in my opinion.

Re:The real question is, of course -

[petecarlson]

What law is one breaking when they download the code?

Re:The real question is, of course -

[gnarly]

You may look at it as long as your method for doing so does not make a copy. But downloading the code will make a copy, and so will viewing at on a browser

If using a browser to view copyrighted material is illegal then 99% of websurfers are criminals, because we always come across text, images, etc which are copyrighted, and can be viewed but not redistributed.

Am I missing something?

Re:The real question is, of course -

[mj_1903]

I think in this instance we are dealing with stolen goods. In Australia at least, if you are in possession of stolen goods you can be arrested, because there is no proof at that time that you did not steal them.

I think its pretty obvious that this "code" has been stolen from Microsoft either by someone breaking in or someone releasing it illegally against their NDA or against the working contract with Microsoft. In this instance, I would be highly wary even downloading the code.

As for all your other points, you are correct, as long as no illegal method was used to get the code, aka reverse engineering or stealing it.

Re:The real question is, of course -

[AoT]

why is your sig so fucking apt for this occation?

Re:The real question is, of course -

[TheOldFart]

Do you remember the Flinstones? Their dish washer? You would open it up and inside there would be this weird little critter washing the dishes. Now that Windows' source has been leaked, the entire world will find out that is nothing more than a leprechaun churning out applications.

Re:The real question is, of course -

[taernim]

The RIAA cannot prove that you do not own a copy of the music already, thus it can't sue with as much certainty. Microsoft, however, can be fairly certain YOU don't have the rights to the Windows source. So it seems downloading OR uploading it would be dangerous, either way. IANAL, btw.

Re:The real question is, of course -

[Hognoxious]

Mmmmmmmaybe because with linux you're actually allowed to apply fixes?

Re:The real question is, of course -

[Hognoxious]

I think this assumption is mitigated by the fact that so many universities have a license to look at the source.

I'm sure there's no connection between that and all the worms and viruses that have been circulating. Gotta go, inbound pig on runway three.

Re:The real question is, of course -

[Hognoxious]

It's Microsoft that has the history of putting hidden features into their software. Those jokers once put an entire flight simulator in Excel.

This is not an urban myth, I've seen it myself, and while it's very amusing (ho frickin' ho), the fact that this ever got out the door shows a total lack of review & quality control.

It's true, management can be assholes - but it seems that in their absence, developers can be even worse.

Re:The real question is, of course -

[Hognoxious]

Microsoft does use its own products and would probably fix this stuff if aware of it

Eventually.

"The company, which learned about the flaws more than six months ago from researchers, said the only protective solution was to apply a repairing patch it offered on its website."

Re:The real question is, of course -

[gnu-generation-one]

"I think in this instance we are dealing with stolen goods."

It's not stolen unless it's completely left the hands of the person who originally had it. So if Win2K source was stolen, then Microsoft will be unable to distribute it because, by definition, they don't have it.

Re:The real question is, of course -

[LilMikey]

Because there are more eyes (any more intelligent eyes) spying Linux code to fix and improve it than there are trying to exploit it. This can't be said of MS's source as there is no hope of any of these eyes improving it.

Re:The real question is, of course -

[KarmaMB84]

Oh yes, the one that an MS engineer(s) put in *themselves*. The problem there is that MS probably trusts their coders a bit too much and don't doublecheck things.

I don't quite remember the last one put into an open source codebase. You don't link to it but wasn't that put in by someone that compromised the server holding the sources? How was it detected and why is it comparable to an MS engineer(s) putting a backdoor in IIS and possibly forgetting to remove it when it shipped (and possibly never looked at it again).

Re:The real question is, of course -

[julesh]

Because Microsoft doesn't accept code updates from people who know better than they, so any bugs that are revealed are not going to be fixed through the increased visibility of the code.

Microsoft as a corporation might not, but I'll bet you that every source file in that tarball has the last modifier's username at the top, which can almost certainly have '@microsoft.com' appended to it to turn it into an e-mail address. I doubt individual programmers would entirely ignore a bug report that landed in their inbox...

SCO Action

[Anonymous Coward]

Don't let Darl McBride look at this or SCO is gonna start suing Microsoft...

I'll send him the hardcopy by UPS.

Re:SCO Action

[EduardoFonseca]

Why would he sue himself?

Very simple explanation

[leonbrooks]

accesory
12345678

In a related story, Wine annnounces

[Anonymous Coward]

100% compatibility with all Windows programs.

"Don't ask us how we did it!!!"

Re:In a related story, Wine annnounces

[cant_get_a_good_nick]

That's quite a trick, since Windows isn't 100% compatible with all windows programs. =)

Someone please check against DDK

[Googol]

or other released code. It should be possible to triangulate the source against existing released software, so at least we can know what exactly it is and whether this is a hoax or not.

Re:Someone please check against DDK

[Sven Tuerpe]

... so at least we can know what exactly it is and whether this is a hoax or not.

Doesn't matter. What will happen is this: After admitting some of their code leaked, they will wait for a couple of months. Then, a company paid by them will release an "independent" study on the effects of this source code leakage on the number of security problems discovered in Windows. Nifty charts in this study will suggest that availability of source code increases the number of security problems exploited by hackers. Mainstream media will report this as breaking news.

A propaganda war has just begun when SCO and Microsoft managed to "get attacked" by "those open source zealots". They weren't, of course, but few people know after misleading media coverage of the respective events.

Oh the delicious irony.

[TigerPlish]

The article right before this one was about some windbag expounding how Open Source is less secure than closed source.

There goes that theory.. ;o)

Bug fixes

[denissmith]

Does this mean we can finally get Win NT 4.0 as stable as *nix?

security by obscurity

[x3ro]

From the Neowin website:

but the number of industries and critical systems that are based around these technologies that could be damaged by new exploits found in this source code is something that doesn't bare thinking about

I find it quite shocking that the writer doesn't realise that s?he has spelt out the essential problem with security-by-obscurity.

There's no point in Microsoft and its scions flinging up their hands when the inevitable happens and some code leaks out. They set themselves up for this by banking so much on secrecy.

Avoid the code! Snow Crash Alert!!!

[asternick]

If you look upon this code, it will cause a snow crash of your brain and any internet explorer browser will send commands directly to your brainstem...as will hax0rs.

Don't Touch that SOURCE!

[Pup5]

It's all a ploy on the same basic structure as SCO. They let the source out, then claim that it was "stolen", then start "finding" their code in your product, then sue the shit out of every member of the human race.

You watch, it'll happen.

Re:Don't Touch that SOURCE!

[Curtman]

On the other hand though, until now we have no way of knowing if a contributor has seen the M$ source, and is feeding it in to open source projects, trojan horse style. If this is true, we could do a proper audit ourselves, and rewrite anything that needs to be.

leaks are caused by holes

[mac os ken]

In other computer news... Linux source code leaked all over the internet. Computer users worldwide unconcerned about the leak. In fact most are content having it this way. Hmmm, Microsoft...

You slashdotted forbes

[Anonymous Coward]

and you didnt even use a link

</rhetorical>

[blorg]

Heh. I had included a tag but hadn't used &lt / &gt so it got filtered out :-(

The real source is 300GB

[PaulMaximne]

I have a friend who had access to the source in his last job and he told me that it is 300GB. So if this thing that's floating around is any less than that it can't be the entire source, or it's a fake.

Paul

Re:The real source is 300GB

[Psx29]

If it's really 300gb and it really is floating around out there, then that is one hell of a demo

Re:The real source is 300GB

[luizd]

If you compile your 300GB, You'll have more stuff than all that trash that comes with win cd instalation. 300GB should be all the M$ products source.

Someone got into Mac OS X's source and posted it 2

[digitalgimpus]

You can see it here: here

I didn't point you to it ;-) :-D

Funny how different two companies feel about source code. Apple has somewhat embraced the open source model, contributing to KHTML, and using many other open source projects. While Microsoft has shunned them all.

Paul Thurrott...

[ShallowThroat]

is probably pissing in his pants right now.

Re:IAAL???

[SquarePants]

Sorry, no typo. I'm really bad at detecting sarcasm but I think I got your meaning.

Oh Noooooo!

[resinman]

Quick someone boil the Internet!!

Improve Wine!!!

[DroopyStonx]

Hopefully the developers of Wine can use this to improve their product! Damn... imagine it actually working for the majority of Windows apps/games!!

*That* would be something to make people start using Linux as a desktop!

Flip side lets OS developers sue MS.

[Ungrounded Lightning]

I doubt that Microsoft intentionally planted this snare but if any future open source project even vaguely resembles this leaked code I have no doubt that Microsoft will open their full arsenal of lawyers.

On the flip side:

A comparison of the code against that of open source projects could be used to detect places where MS developers have included open source code in MS products. With this as a starting point, a suit's discovery process could bring it out in a form that could be used as evidence against MS.

(Of course the leaked code should be analyzed by a consulting organization separate from the open source developers, to keep developers and their servers clean for defense against later claims from MS.)

MS is alleged to have a record of stealing other people stuff. Will be interesting to see if it's true, provable, and something can be done as a result.

Re:Flip side lets OS developers sue MS.

[Ungrounded Lightning]

What you say cannot be done legally.

Thanks. But I'll let the FSF's lawyers worry about that.

"MS is alleged to have a record of stealing other people stuff."

Never heard of them stealing source code. And this isn't all source anyway.

Starting with DrDOS, if not earlier. People have claimed that MS engages in contracts with other companies (many instnaces), then pulls stunts that amount to contract violation, in such a way that MS ends up with the other company's IP while the other company ends up dead or wounded and with no significant benefit.

I have heard this claim about several companies.

Even if it's NOT true.

[Ungrounded Lightning]

I'm really fascinated about, if this turns out to not be a lie, the long-term ramifications of this. It's a can of worms that you can't undo.

Even if THIS one is NOT true, it's only a matter of time before there's a REAL leak of the REAL code.

I'm surprised they've kept it under wraps as long as they have.

Mod Parent Up !!

[TheGrayArea]

He's correct. The tree is forked as needed for future versions. Heck, you can search through the asm files and still find ones with David Cutler's name in them that haven't been changed since he wrote them.

Re:Mod Parent Up !!

[Anonymous Coward]

I once heard Cutler and others had re-used some code from DEC and that's why MSFT had promised to do the 64-bit for the alpha... Cutler had done something like 20 OS's at DEC or something that reflects how people in the 70's and 80's had to write their own OS much like web development in the 90's before App servers. So, maybe Digital can pull a SCO?

did they clean it up ?

[mmu_man]

before leaking it ?
I do'nt think it's an example to even look at if you ever want to write good code anyway :)

Btw, I was just looking at the movie 'Hackers' when I learnt that. coincidence ? ;)

The most important question no one is asking:

[ShallowThroat]

Is it good, or is it Whack?!!?

Re:I forsee a lawsuit

[ReaperOfSouls]

They'd only be sued by the FSF if they had put GPL'd code into Windows.

While the FSF would definately come to the aid of anyone filing a lawsuit over GPL claims, there is no reason to think that any one who released said code couldn't themselves file a lawsuit. Just be cause you place something under the GPL doesn't mean that FSF has any rights to it. The only time that they could even be a primary party in the lawsuit is if the copyrights for the code in question was assigned to them or they wrote it themselves. I would wager that there is significantly more GPL code that the copyrights have _NOT_ been reassigned then have been.

Re:DO NOT LOOK AT THE CODE!

[Theovon]

I didn't mean to say that the code in Linux would be an ACTUAL derivative of Windows code. I meant only to suggest that Microsoft would find a way to CLAIM that it was.

Hrmph...

[justsomenick]

April Fools is early this year...

Re:Hrmph...

[justsomenick]

At least I'm not some anonymous coward :-P

My guess would be

[hayden]

"How'd the fuck did they do that? We've had this code for years and we can't be 100% compatible."

Re:If code is criminal, only criminals will have c

[gangien]

I think we were just Farked.

WHAT?? TO arms my fellow /.ers we must not let this go unpunished

Plumber Fixes Linux Source Code Leak To Internet

[pandrijeczko]

In other news, trainee plumber G.P. License has announced that after 10 years of hard work, he has finally fixed the leakage of the Open Source operating system, Lunix, onto the Internet by replacing a small, worn-out plastic washer in the BSD IP stack.

Mr License was unwilling to make much comment to our reporter - upon packing his toolbag up and phoning his wife to get the dinner in the oven, Mr License said "Move along folks. All done here now, nothing else to see."

Re:GPL Enforcement

[FuzzyDaddy]

Ah, but if the source code for Windows has been carefully concealed until now, and the source code for all the GPL software has been openly available, it would be a lot easier to convince a jury that code flowed from GPL'd software to Microsoft, rather than vise versa.

Microsoft is a "Serious Corp", but it hires thousands of programmers who all have access to the net and a complete set of source code for most GPL'd projects.

Re:It's a TRAP!!! /Adm. Ackbar

[gujo-odori]

If you work on any Open Source project, DO NOT LOOK!

This is extremely good advice. I would go even further and say that if you would ever like to work on an open source project, don't look. The presence on a project of a person who had seen the Windows source could put the entire project at risk.

For a very practical example, consider Samba. If a person who had seen the Windows source were to contribute to Samba and it were later to come to light that the contributor had seen the Windows source, in the name of safety every piece of code that person contributed would have to be ripped out and replaced. Worse, to guarantee that there was no trace of taint, it would probably have to be replaced by people who had not only never been exposed to the Windows source, but who had also not seen the contributor's tainted code. In short, it would require the recruitment of people who had never worked on the project before, or even read the source. Finding those people would not be easy, to say nothing of the time and credibility that would be lost.

For that matter, even if you have legally seen the Windows source because Microsoft has provided it to your employer under their shared source program, the same taint would follow you. If your employer has access to Windows source and your job does not require you to see that source, do yourself a favor: don't look.

If you look at the Windows source, you at the least taint yourself WRT working on any project aimed at interoperability with Windows, and quite possibly on a much wider variety of projects than that.

In short, JUST SAY NO.

Re:You've got to be shitting me

[Bendebecker]

"How can 300 gigs of source compile down to a nice CD-sized bundle of software?"

Lots of white space?

This is huge

[jcsehak]

Okay, IANAL, but isn't this grounds for a massive lawsuit against MS? Shit, someone in the know needs to check out this source code and do a diff with gzip and gnumakefile and see if MS really did rip off GNU. Of course, it's illegal for them to look at it, but maybe there's grounds for a subpoena? You know, to look at the code... that's already been seen.

Any potential for this stuff to be put to *good*?

[ericdfields]

I'm no computer programmer or even an "expert", but i know my way around linux - that is, i can compile pretty much everything i need just how i need it - and of course windows is no biggie. I'm just wondering... could someone potentially use this code and maked a hacked version of Win2k? Make it more secure, or infuse some sort of unix code, or perhaps make it a bit more possible to run windows apps on linux? Of course, for personal use and interest... god only knows how badly every linux user would be sued if a true "Lindows" made its way to the web......

At least Norton Sales will rise

[Cryacin]

New, Norton anti-leak pads! Just place one in each Microsoft Employee/Affiliates undergarments, and keep your code secure!

Hoax

[UninvitedCompany]

I would like to be the first to predict that this will turn out to be a hoax. Windows.Source.Code.w2k.nt4.wxp.tar? Come on.

For one thing, I've never received anything from Microsoft in a tar file.

For news junkies, use news.google.com

[kanaka]

If you really want to watch as all the news sites
begin covering this you can watch articles appear
at news.google.com. You'll see them linked there
within minutes of them being posted.

I found this search to be pretty good:
http://news.google.com/news?hl=en&ie=ISO-88 59-1&ed ition=us&q=leak+code&btnG=Search+News

No. NO. Are you dense?

[Ayanami Rei]

I know. I KNOW. I KNOW!

But it doesn't matter what you or I know or think.

It matters what other people think, lawyers, judges, IT workers who have not PERSONALLY been involved with or followed Samba's development.

Microsoft can claim that aliens stole their RPCSS stuff and beamed it into Andrew Tridgell's head. But as soon as they leak that to the press, suddenly Samba's in a world of shit, whether or not it's true.
That's why it's called FUD. If you don't know any better, then you'll likely bet on the side with more lawyers.

All Microsoft has to do is hint that Samba had the leaked stuff all along, by claiming they wouldn't have gotten as far as they have gotten without it. Then if they can convince a judge in Australia that they plan on filing for infringement, the Samba project will have to go on the defensive. They'll have to (trivially) prove they didn't have the code, but by then the accusations will be all over the press.

I mean, Samba specifically deviates from what published specs on CIFS are to be bug compatible. If I were a lawyer pursuing this angle, I'd latch onto that as evidence that there was something fishy going on. (Evidence of source code paraphrasing, which is "easy", as opposed to the result of hundreds of man hours of testing and debugging, which is "hard")

It doesn't have to be true, just plausible. We've done the research. Lawyers and trial judges in Australia have no such intimate knowledge of the subject matter, and thus would probably agree to at least hear evidence, and grant Microsoft many motions. I mean, look at SCO! They don't have to show any copying, they just have to show evidence that they think it happened, and then go into fact finding mode. Boom! Instant clusterfuck, for a good while. And it scares off people at the margins.

And this "plausible" copyright and/or trade secret violation scenario is at least somewhat lucid (compared to SCO)... at least up to the point that you do a code comparison and see that this is patently false. Again, they know they'd lose in court. It's just the act of calling it into question (which you absolutely could do) that is the problem.

Probably a few days before...

[glenalec]

...Linux pulls a Linux and points out that all the 'copied' code was in Linux or some other OSS project first!

But build time was 5hrs on a 486/50!

[Chuck Messenger]

Read the next slide -- it says it took a mere 5 hrs to rebuild the source tree on a 486/50!!

Clearly, the 50gb number is an exaggeration. Maybe it includes lots of redundant cruft which isn't actually compiled. Or perhaps documentation. I can't see any way that a 486/50 could compile 50 gb of code in 5 hours. That's 10 gb of code per hour, or about 2.7 mb of code per second! At 27 chars per line avg. that would be 100,000 lines per second -- on a 486/50!

Re:But build time was 5hrs on a 486/50!

[BrianCarlstrom]

After further reading of slides and comments, I think they needed a 50gb disk for a build, but that includes space for:
- OS
- compilers and tools
- intermediate files (.obj/.lib files etc)
- other applications they might have

The point?

[miffo.swe]

In this case the point should be that people who bought into the MS security concept will feel screwed. The ones on other systems will be able to do their business as usual while crazed windows admins run around firefighting for their lives.

I cant imagine how this could have a bad effect on linux at all. A big boost for ABM and the industry as a whole would survive just fine without MS. It isnt like MS has really truly made something significant other than piggybacking and marketing.

ROTFLMAO

[Ayanami Rei]

Jesus you people!

It's like every five minutes... :P

FULL SOURCE TREE IS FREE and legal HERE....

[cheekyboy]

http://www.sysinternals.com/ntw2k/info/xpsrctree.s html

full source tree is free, and generatable from the debug/dlls etc....

enjoy.

yes this is 100% legal

Microsoft probes possible Windows source code leak

[Anonymous Coward]

Microsoft probes possible Windows source code leak

Re:IAAL???

[plj]

Well, so seem to be the mods, as I got modded as flamebait, although I just tried to be funny. It's just that the "IANAL, but I think that..." -like phrases are so common in /., that seeing your post stating "IAAL", and that "it is this way" actually took be by surprise and made me laugh.

But no offense really, just joking. Happy to see real lawyers here, too.

We know who's fault this is

[drgonzo59]

Somehow I see MS blaming Linux for it. "A fat penguin was spotted by the security cameras at the Microsoft Headquarters in Remdond last night..."

Re:Small server they've got there

[high_towe]

there are many sources now. All you gotta have is contacts. Soon it will be all over kazaa and bit-torrent. Well done microsoft, i just wait for all the security updates. I do still wonder why it was released to 'certain ppl/groups'.

Oh no..........

[son_of_asdf]

Does it say something about me that I'm more interested and excited about this than any news story that I've read in the last year? (Janet's tit included.)

$geek++;

No GPL - Lots of BSD

[PetoskeyGuy]

I know they have at least the TCP/IP stack from BSD. I would be interested to see if the copyright comments are still on the files.

Re:No GPL - Lots of BSD

[Anonymous Coward]

Reread the other idiots who have posted about this. They do not have BSD's TCP/IP stack. They originally got theirs from a company named Spyglass, and Spyglass derived theirs from BSD. But I'm sure Microsoft has re-written their TCP/IP stack a dozen times since then.

Re:No GPL - Lots of BSD

[Zak3056]

I know they have at least the TCP/IP stack from BSD. I would be interested to see if the copyright comments are still on the files.

Err, yes, they are. How else do you suppose we know they're using BSD code? Running strings on the executables turns up the Regents copyright notice.

Re:No GPL - Lots of BSD

[Anonymous Coward]

The company was actually called Spider, and the Spider TCP/IP stack (which was BSD-derived) was used in exactly one MS operating system: Windows NT 3.1 (1993-1994).

Windows NT 3.1 was released in 1993, and replaced in 1994 by Windows NT 3.5, which was much smaller, much faster and used an MS-written TCP/IP stack (which was presumably smaller and faster than the BSD-derived Spider stack). The MS TCP/IP stack in NT 3.5 was then ported to Win9x for the release of Windows 95.

The lifetime of NT 3.1 was very brief, and during that brief lifetime, hardly anyone used it (because it was too big, too slow and there was no Win32 software), so the fact that its TCP/IP stack was BSD-derived is not really something to brag about.

Re:No GPL - Lots of BSD

[duffbeer703]

That may be true, but there is BSD code in Windows XP.

open up a command window and type "strings c:\windows\system32\ftp.exe"

This will return:

@(#) Copyright (c) 1983 The Regents of the University of California.
All rights reserved.

Re:No GPL - Lots of BSD

[Anonymous Coward]

Yeah, there are a few trivial and ancient/obsolete BSD command-line tools in Windows (finger, ftp, nslookup, rcp, rsh). They were ported from BSD, and you can see that they contain the appropriate copyright attribution. Note that none of the kernel-mode files (e.g. the TCP/IP drivers) contain any such strings.

MS is naturally not opposed to using freely-available BSD code to achieve better interoperability with BSD/UNIX. MS Windows Services for UNIX, for example, includes a lot of modern BSD tools ported from OpenBSD. That's reasonable, of course, since it's supposed to provide a set of command-line tools familiar to UNIX systems administrators, and OpenBSD tools are known to be relatively good in terms of security.

Importantly, MS's porting of OpenBSD userland tools to Services for UNIX is also good for OpenBSD, because it helps to establish those tools as something of a standard. If hordes of MS users become used to the OpenBSD userland tools, they'll be much likelier to start using OpenBSD if they want a UNIX-like OS than to start using, say, Linux.

The common claim about the MS TCP/IP stack from open source zealots is that MS 'stole' the Windows TCP/IP stack from BSD because it couldn't write one of its own, which is of course complete nonsense. The handful of BSD tools in Windows are/were there to make it easier for UNIX users to access their systems from Windows. They're in no way critical to Windows as an operating system (in the way that, for example, a TCP/IP stack is).

Re:No GPL - Lots of BSD

[Anonymous Coward]

no, the binutils and gcc/glibc comes from Cygwin. The rest of the userland tools comes from OpenBSD.

Re:No GPL - Lots of BSD

[_Sprocket_]

MS is naturally not opposed to using freely-available BSD code to achieve better interoperability with BSD/UNIX. MS Windows Services for UNIX, for example, includes a lot of modern BSD tools ported from OpenBSD. That's reasonable, of course, since it's supposed to provide a set of command-line tools familiar to UNIX systems administrators, and OpenBSD tools are known to be relatively good in terms of security.

Microsoft Sevices for Unix also includes plenty of GPL utilities too. In and unto itself, it's no big deal. After all, Microsoft follows all the license requirements. This only becomes an interesting point in light of the occasional flame/FUD about licensing, the GPL, and BSD.

The common claim about the MS TCP/IP stack from open source zealots is that MS 'stole' the Windows TCP/IP stack from BSD because it couldn't write one of its own, which is of course complete nonsense.

I completely agree here. The whole bit about "stolen" code is rather silly. And it misses the point.

The real interesting thing to note is that even with an organization that is often heralded as a bastion of proprietary software the the One True Way... open source is viewed as valuable.

Re:No GPL - Lots of BSD

[EmptyHead]

Hi Microsoft guy, hows that MCP cert coming along?

They don't. They have telnet, ftp and a few other tools from BSD. This BSD TCP/IP stack in WinNT-rumor is just an urban legend, nothing more.

If you really believed that, then you'd sign in with your real ID so, this is probably a wasted effort. I don't have time to really research this but, here a couple of relevant links are that seem to not be crazy, anti-MS sources: (might be a starting point for someone that cares to take a closer look)

Common bugs in both IP stack examples noted here.

More, but not as many accusations.

The details in these links seem to be more useful than statements that are too empty or too broad. I was surprised that concrete evidence of rampant code copying relevant to the IP stack from BSD was not very easy to find. "Urban legend" is an overstatment because there is some truth that some things relevant to the IP stack were copied, but the scale probably has been exagerrated.

Re:No GPL - Lots of BSD

[bsdcow]

The BSD license required people that used its code to put an advertising clause, which is no longer required since the licence was modified :

The advertising clause in the license appearing on BSD Unix files was officially rescinded by the Director of the Office of Technology Licensing of the University of California on July 22 1999. He states that clause 3 is "hereby deleted in its entirety."

As long the licence remains in the source code you can distribute or incorporate the code and you no longer have to advertise about it.

Does it matter if Microsoft uses BSD code ? No.
The BSD licence allows this. Microsoft can use the BSD TCP/IP code and it is not a problem for them or for any BSD project. The code is written and anyone can use it, and having the code used by a company doesn't make the BSD one no longer available.

Remember. DARPA wanted the TCP/IP and several projects developped those protocols and a stack. Then, the DARPA evaluated each implementation for performance and quality and the BSD one was chosen. The BSD TCP/IP is the reference code and it would be stupid for a company not to use it : it has been designed by DARPA as the best one, and its licence allowed proprietary inclusion. Why bother write your own when several have been written and all failed to offer better results and code quality compared to Berkeley work ? Why did BSD became so much spread ? Because DARPA designed their code as the reference they would use. All universities asked for BSD release from then on and it spread like fire.

Perhaps Microsoft uses BSD code. They can do it freely and there is no comment to be made. Licence allows it and the clause about advertising is no longer present so they dont have to tell about it. There is no use is telling again and again "Microsoft uses BSD TCP/IP" to have people come and without any clue say "they use a TCP/IP from someone else". You dont even know on what this external TCP/IP was based and even if you knew you would not be allowed to tell it. It's like talking about God. Perhaps it does exist, perhaps it does not but we have no proof about any of those affirmations and who really cares in the end ?

The IPv6 is developped by KAME right now. It is mainly based on NetBSD and uses the BSD licence with no advertising clause. Other BSD are also involved in this work as well as Linux people. When you are a proprietary company do you write your own code without using the freely available reference code ? No. Because even if you do, you will have to track changes and port them to your own. This costs a lot in time and money and any project people know this. This is also why we see patches come back from proprietary companies go back to BSD projects : it costs so much to port them version after version they prefer to produce a patch so it gets in the source, so they have it maintained automatically when they move to a newer version. This is how BSD has proprietary companies give their changes back to us : in the long term it costs so much it because a pain to apply and port patches to a new version. And it works in the fact. GPL has you publish changes if you distribute the stuff, BSD makes you publish those to the projects to avoid money and time loss which compagnies are very sensible too.

So can we stop this nonsense once and for all ? It does not matter if Microsoft uses BSD code or not. They can do it and they will do it when they want. They dont have to advertise about it. And if they keep the licence in the source code we do not see it.

Re:No GPL - Lots of BSD

[0x0000]

Uh-huh. And I guess the IE being based on the XMosaic codebase is rumour, too, then, eh? Or did you think M$ actually had a browser technology before they started copying code...

Re:No GPL - Lots of BSD

[Mr Z]

Not to be picky, but comments usually don't show up in the binary executable. char* string initializers will though....

--Joe

Re:No GPL - Lots of BSD

[vax]

'strings' is not recognized as in internal or external command, operable program or batch file.

hmmm... yes i see.. not.
???????
sounded intresting untill that though.

Re:No GPL - Lots of BSD

[duffbeer703]

Hmm you might need Cygwin or the WXP/2k resource kit to get the command.

My laptop is far from the typical office workstation... I have to run an app ported to Interix, so I have MS Services for Unix, cygwin and some other toolkits that may contain strings.

I know for sure strings.exe is available with cygwin, give it a spin...

http://www.cygwin.com/

Re:No GPL - Lots of BSD

[Schmedlap]

Actually, it doesn't, on my machine, at least...

Better conspiracy theory

[neoThoth]

#### Enter Darth Gates ########
Who do you think allowed that source to get out? I wanted your puny open source rebels to come out into the open so I could crush them!

#### Exit Darth Gates #########

wow i think both microsoft and LucasArts are gonna sue for that one.

Here's an official current MS quote + more news

[blorg]

They are denying it, but are investigating their Shared Source Initiative (suggesting that they have a lead, and that there is some truth to the leak - or perhaps it's just the obvious place to look). Apparently the rumoured code uncompresses to around the size of 1 CD, and would only be a small portion of the total 40gb code base. Although all the articles mention the security risks, MS insist it is just an IP issue:

"The rumor regarding the availability of Windows source code is based on the speculation of an individual who saw a small section of un-identified code and thought it looked like Windows code. Microsoft is looking into this as a matter of due diligence," a company spokesman said. "If a small section of Windows source code were to be available, it would be a matter of intellectual property rights rather than security." - from Eweek.

Also see ZDNet, InternetNews and Google News

Re:Here's an official current MS quote + more news

[EinarH]

"If a small section of Windows source code were to be available, it would be a matter of intellectual property rights rather than security."

From the child of the MS PR rep. and the Iraqi Information Minister:
"Nothing to see here folks, just some very important intellectual property rights, nothing about security. Don't worry, there is no leak, just some code; Now move along please."

Re:Here's an official current MS quote + more news

[Pikhq]

Funny, my OS's complete source code fits in 1.5 gb, compared to 40 gb...

Re:Here's an official current MS quote + more news

[donutz]

Apparently the rumoured code uncompresses to around the size of 1 CD, and would only be a small portion of the total 40gb code base.

Good lord! How does the source code for an operating system bloat to that size?

Re:Here's an official current MS quote + more news

[ghost-hacked]

hmmm, 40gb code base, that compiles down to around 200mb (ballpark). man ive gotten this all wrong. Hear were are downing M$ for makeing crapy insecure software, were as there actualy way ahead, ne1 who's made a 40gb code base compile into a roughly 200mb OS is way ahead of the rest of us. if this is waht the open source comunitiy is faceing, then we (the open source comunity) are in a vain stuggle at best, how vastly supperior MS compilers must be... ok. simply put, you smoke crack.

Re:Here's an official current MS quote + more news

[bbsguru]

Omigosh!

I just took a look at the MS $ource, and then looked through some of my old files just to be sure. It's True!

Those Bat Rastards! they stole my code! Hey, Daryl! Know of a good lawyer???

Re:Here's an official current MS quote + more news

[fitten]

Possibly by having comments in the code ;) Also, remember that 40G covers all kinds of applications that come with it. The equivalent would be to include the Linux kernel and every other application equivalent that is delivered with Windows 2000.

Re:Here's an official current MS quote + more news

[AstroDrabb]

That 40GB is not just for the OS. It is for every piece of MS software. IE, MS Office, MS SQL Server, etc.

Re:Here's an official current MS quote + more news

[marco0009]

"it would be a matter of intellectual property rights rather than security."

So, in other words, their OS is so crappy that hackers don't need the source to make nasty virii custom tailored just for it?

Re:Here's an official current MS quote + more news

[Ironica]

And now, here's the confirmation, from MS's own press releases.

My favorite quote: "At this time there is no known impact on customers. We will continue to monitor the situation." Translation: "No one's found that Win32 flaw we testified to Congress about yet, but we've got a betting pool on how long it will take."

Re:Here's an official current MS quote + more news

[AndyElf]

I have a bit of a poblem believing a 40G number -- maybe the whole sourcesafe or whatver RC system is used can weigh in that number, but the system itself? sounds a bit too hgih... how heavy linux kernel + X + qt + kde would weigh (all unzipped)?

first time in the sun for MS source

[rbird76]

When I go out in the sun, I wear sunscreen and although I'm fairly pale, I probably won't get burned too badly. If someone goes outside with a T-shirt and shorts for the first time in their life (say a 25-year old), they'll probably get burned fairly badly (unless they wear a lot of sunscreen or aren't out for long).

Linux and other open source OS have had people looking at them for a long time. The people looking at the source of Linux are less likely to be a monoculture than the people at MS who are hired to look over software. In addition (uninformed speculation) more of the Linux people may have been black hats once - the less ordered (as in cubicle order rather than procedure order) system may be more amenable to some who fit a less monolithic background. Linux is thus likely to have been looked at by people who might once have looked to hack it and by people with a wider variety of skill sets. MS knows a lot about software, but their diversity in software knowledge and opinion is likely smaller than that of either their user set or of that of white hat hackers.

The other factor is that having the MS source without a licence is illegal - thus the people who are most likely to take advantage of the availability of the source are people without much respect for the license in the first place - black hats. Linux source can be viewed legally, and so is just as likely to be looked over by white hats as black hats (probably more likely, because of the population ratio of BH and WH).

In one of the Clancy books (I think "Debt of Honor"), he talked about secrecy being good for hiding information that someone doesn't want you to know - but that when it broke, the news would be much worse for that someone, and harder to control. That seems applicable here - only the news is directed almost exclusively to those who would do them harm.

Re:first time in the sun for MS source

[donbrock]

> If someone goes outside with a T-shirt and shorts for the first time in their life (say a 25-year old), they'll probably get burned fairly badly (unless they wear a lot of sunscreen or aren't out for long).
.
This would also apply to Uber Geeks

Re:first time in the sun for MS source

[ameoba]

Really, getting your hands on windows source can't be that hard if you're motivated & have some connections. I was student-admin at a v.small college (think 500ish students) a few years back and, while cleaning out the server room, found a copy of NT4 that nobody knew existed (it was the same cabinet as the VMS tapes).

At the time, I briefly thought about how cool it would be to distribute the shit but quickly realized that it would, in the long run, create more problems (not just for me but also for the whole OSS movement) than it could ever fix.

Having MSFT source widely distributed makes MSFT doing an SCO on the whole Linux infinitely easier. If they were so inclined, they could essentially argue that anyone, anywhere, writing OS software was infringing and, considering their bankroll & strength of their legal team, more than likely win by simply forcing the other side to run out of money to defend themselves. And they'd have an argument that couldn't be obviously proved wrong.

Re:first time in the sun for MS source

[Kehl]

Really, getting your hands on windows source can't be that hard if you're motivated & have some connections. I was student-admin at a v.small college (think 500ish students) a few years back and, while cleaning out the server room, found a copy of NT4 that nobody knew existed (it was the same cabinet as the VMS tapes).

From what I can gather you must have found the NT4 Installation CDRom? The "leaked" precompiled source code for NT4 must be at least 15GB (10+CDRoms) and I severly doubt it would be sitting in a small college's tape backup cabinet!

Just FYI ..... Not a flame! ;)

Re:first time in the sun for MS source

[ameoba]

The CDs looked legit & were labeled "Windows NT 4.0 Source" or somesuch...

I can't really say they were or not, as I never rewally looked at what was on them, but this same school did have, in the same server room, an old copy of "The Unix Typsetting System" that had MSFT Library bookplates & barcodes in it... (this, I have added to my personal collection)

WINE development moves at an exponential rate!

[randomErr]

This just in WINE development moves at an exponential rate! Ever wonder?

potential scenario

[bersl2]

You are an OSS developer. You are reviewing a patch someone sends in. Upon reading it, for whatever reason, you suspect that it is code taken from a closed-source project, whose proprietors are known to aggressively defend their rights.

At this point, you immediately delete all copies of this patch.

How liable are you? (I would hope the law is on your side, but are there any hidden surprises?)

Re:potential scenario

[TekPolitik]

You are reviewing a patch... you suspect that it is code taken from a closed-source project... you immediately delete all copies of this patch... How liable are you?

Well the good news is there's no criminal liability whatsoever (no intent).

The really good news is there's no civil liability either. The reason is that to have civil liability for a breach of copyright there has to be (in addition to the breach) one of two things: (1) profit (to you); or (2) damage (to the copyright holder). If you intentionally copy for personal use, courts will infer damage in the amount of the profits the copyright holder would have made if you had purchased. That inference is not available for unwitting copying, so there's no damage.

The difficulty arises if you don't detect the bad code. If you distribute it, it's possible to cause damage, for which you could be liable even though you didn't know of the problem. Of course on the copyright holder discovering this, they would need to notify you of the specific infringing code so as to allow you to remove it - failure to do so would result in them being estopped from claiming damages for subsequent losses.

PLACE YOUR BETS

[DJ_Tricks]

PLACE YOUR BETS!!!! PLACE YOUR BETS!!!! you to can win big if you can guess correctly which country the crappy code came from USA? China? India? Europe? who knows, i dont but place your bets and hold those ticket stubs

Re:PLACE YOUR BETS

[wheany]

USA! I'm putting my money on a company called Mainsoft.

Bloody Brilliant, if true and deliberate

[Rick Zeman]

Now they can say that any exploits would be due to having access to the source code, and not due to their inherent flaws. Sheer genius. Good PR, and they can now point to how good security through obscurity is, and about those OS's where the source code is available....

It makes sense...

[imsabbel]

If you considere 300GB the amount of data in the sourcetree after a debug/profiling compile

from around the IRC campfires

[neoThoth]

Topic of #windows: http://www.windorks.com | We don't care about "the leak," don't ask us about "the leak," and we will not give you voice.

Topic of #phrack: "wake me when they find the code that lets the FBI in"

Re:from around the IRC campfires

[bfree]

As of now, in efnet anyway:
Topic of #windows: http://www.windorks.com | I need to take a leak.
Topic of #phrack: shut the fuck up about leaked source codes

Presuming this code is genuine, I think it will be very interesting to see what comes from this. I have no doubt that there will be people looking at this source and releasing interesting tit-bits, for example the code that lets the FBI in! I'm sure that there will be more interesting things found though on a similar line, perhaps with regards to passport, DRM and/or the feedback tools and the information they gather and transmit. Other things which may appear are the connections between business decisions and coding decisions, though I would be slightly surprised if these survived into full trees like this (but seeing we don't know what this is ...).

The biggest question for me though remains, what is this? Is it the initial release source, the latest release, the development tree? Ultimately though I don't care and won't be looking, though I won't be stopping myself from reading the /. stories as they appear over the next few months.

Finally I have one legal question, is there anywhere in the world where it would be legal to download this and study it for your own personal use if you already owned a copy of the binary? My sense of logic suggests that should be legal! If you then go on to tell anyone about what you found though the ground starts to shake, and if you make money in any connected way from it then you deserve to be swallowed up whole by a pack of rapid lawyers. What does the law say anywhere (if anyone knows)?

.eml files

[e r i k 0]

.eml files are Microsoft Outlook (Express) e-mails. They should be simply plain-text...

Re:.eml files

[tjw]

I'm pretty sure those .eml files were generated by an Outlook virus that created random files all over the infected systems hard drive. I remember having to run 'find . -name "*.eml" -exec rm {} \;' on a samba share at work some months ago.

Re:.eml files

[bangular]

Oh the irony! Windows source code becomes leaked because the operating system is was running on (windows) wasn't secure.

BSD Code

[nurb432]

So it would be better to only view BSD code, then they could legally use it, as long as they give credit..

This might have ramifications of cross breeding between the varying OSS licenses too, if taken to its logical conclusion..

Not to mention other industries.. it could render most everyone technically unemployable if you ever leave your first job...

The source is availible at...

[venomix]

http://microsoft.has.no.secure-future.info/

That server seems to be under quite a lot of pressure right now though ;) (I hope this ain't redundant...)

Source Torrent

[djace]

Torrent here.

Will it Fork?

[Simonetta]

I've been thinking about what would happen if Win2000 source started to circulate for some time.

There are many people out there who really like Windows, even those who know Linux and are advanced technically. There are also many people who love Windows and hate Linux.

It is possible that some people will use the source of Win2000 to actually change several of the interface issues that are beginning to seriously affect productivity in the Windows environment. For example, the inability to use the long path name that is the current directory in one program and easily transfer it to the File:Open box of another program. Crawling through endless directory listings when you want to move a file from one program to another really eats a lot of time. Many people would pay to 'fix' the interface issues in Windows that probably can only be addresses by recompiling.

Would virus writers use access to the source to search for new ways to destroy data? Sure. What can anyone do about it? Well, as a start, punish them. It's common for virus writers (according to the New York Times Magazine) to post their 'research' on sites for script kiddies to implement. That way they are not legally liable for releasing a virus.
Bullshit! This is conspiracy to create fraud and grand theft vandalism. If Tommy Chong can go to jail for selling painted glass tubes, then why aren't these teenage virus writer Bozos in jail for causing millions of dollars in damage by writing criminal source code? Virus damage will start to actually fall when the people who cause the damage are convinced to cease this activity, perhaps by just killing a few of them in order to encourage them to find more acceptable hobbies like smoking weed or getting laid.

Even if the Windows source is actually somewhere on-line, what difference would it make? Anyone who recompiled it with changes wouldn't be able to sell or distribute it. Having an improved recompilied custom version of Windows would make you a criminal anywhere in the world. Plus it's a huge and extraordinarily complex program. All in all, it might be better just to learn Linux.

Still, some people would study Windows source and make illegal and discrete alternate distributions. The code would fork repeatedly from the current Microsoft release of Win2000 and over the course of twenty or thirty years become a hybrid of Windows, Linux, and Mac.

NT4 source leaked long ago

[Anonymous Coward]

I was offered a copy of the NT4 source code a couple of years ago. I didn't want to pay for about 60 CDR's and for someones time burning them since I'm not paticularly interested in it. About 30 CD's for original NT source and another 30 for the service packs IIRC.
The source code for MS-DOS 6.0 can be found on the usuall filesharing networks and has a few amusing comments in it.

other sources

[beas mas er]

http://www.internetnews.com/ent-news/article.php/3 312451

http://zdnet.com.com/2100-1104_2-5158496.html

http://www.infoworld.com/article/04/02/12/HNmicr ol eak_1.html

http://www.eweek.com/article2/0,4149,1526390,00. as p

Ballmer Probes Hole...

[pandrijeczko]

...before investigating security weakness that allowed Windows source code to leak to the Internet.

Win 98

[doccm9]

I'm still humbly running Win98, but this should get interesting in the next 6 months.

I'll second that, not the whole tree

[anticypher]

My guess, this is some of the source released to academic institutions for study. Lots of universities have access to a small portion of the windows source code, for use in various computer labs, and to create interoperable code. It comes on a single CD, and is not difficult to obtain.

I've studied one small section of M$'s source code, a single network module appearing in both NT4 and NT5.0, under NDA of course. I don't see it here. There are a lot of things I don't see here, and I'm still going through the tree. There are some things here that are clearly part of windoze, such as the source to regedit.

Some other things that make me suspicious this isn't all the source code:
1) lots of 0 length files, could all those .eml files be links to the original file?
2) the win2k source just happens to total 658MBytes, about the size of a CD
3) there are a number of 0 length files of people's names with the letters CV next to them. cv - vered mazafi.eml, ronen-cv.eml
4) all through the file listing are repeats of .eml files, like tcp-ip tutorial.eml. Would there really need to be a tutorial like this spread everywhere?

I think this is just a student prank, being trolled out of proportion. It's not just /. doing the trolling, this will probably hit the major news outlets tomorrow. No doubt, they will only quote the most pandering media whores around, to sensationalise the story. Any bets several major stories will point to /. as a culprit, or as a den of criminal hackers?

the AC
I can't believe I'm admitting to extensive knowlege of windoze on /.

Microsoft's initial response:

[aarku]

according to this...

When asked to comment, Microsoft responded by e-mail that "the rumor regarding the availability of Windows source code is based on the speculation of an individual who saw a small section of un-identified code and thought it looked like Windows code. Microsoft is looking into this as a matter of due diligence."

Re:Microsoft's initial response:

[high_towe]

"Computer security experts say the hackers appear to have used a virus called Qaz to break into Microsoft's network. " http://news.bbc.co.uk/1/hi/business/993933.stm [bbc]

Re:Microsoft's initial response:

[conteXXt]

Friday, 27 October, 2000

article date

So here's what you do

[tony clifton]

1. Get the OS to compile and boot.
2. Reproduce windows bugs.
3. Fix bugs faster the MS does.

[...]

6. Profit!

Re:So here's what you do

[Michael B. Davis]

Sure,after reading and understanding 40M lines of code, or however many there are...

Re:So here's what you do

[Oriumpor]

You can get almost any code to compile if you just comment out the errors.... it's the 2nd part of #1 that will be that hard part.... even if it compiles with only 182397198273 warnings.

Re:Oh, no! I Looked!

[CanadaDave]

140 GOSUB 16000 ; * Time waster loop

That's the source code for Linux. If only I could get that time back.

Forgive me

[sbszine]

There have always bin rumors that closed source Microsoft applications have leaked to terrorists

Osama bin Rumours?

Re:The odds of getting the full source: experience

[smokin_juan]

'Microsoft is a lot more like "Office Space..."'

Its funny how people build up ideas in their heads about what its like in a large corporation, somehow like a hollywood movie...

meh, it'd be lost on you people anyway.

NT...out of the closet

[whittrash]

Are you curious? Do you wonder what it is like? Microsoft 'source code' is oh sooooo satisfying. Find out what all the talk is about. You can be discrete or go all out, it is up to you. The best part is, no one has to know, it can be your little secret.

OSS "Suicide car bombers" -- WTF???

[paco verde]

Yankee Group senior analyst (sic) Laura Didio has these alarming thoughts on internetnews.com about who might now be able to get their hands on the Windows source:

"With the open source community, there are a large percentage of tinkers and 'ankle biters' who are trying their hand at hacking. Some are even communicating with each other. So it only takes one or two of these groups sharing information to be able to pull something off. When you have this type of passion, it's hard to fight because these people are like virtual suicide car bombers."

So Microsoft is the defender of truth and justice in the free world, and OSS hackers are like suicide car bombers?

She then went on to warn of the dangers of hackers using the several hundred megabytes worth of leaked source code to compile their own pirated copies of Windows 2000. What a dumbass.

And what exactly is a "tinker", anyway?

Re:OSS "Suicide car bombers" -- WTF???

[ahem]

And what exactly is a "tinker", anyway?

A "tinker" would be someone whose damn I would not give. Especially for this particular subject...

Re:OSS "Suicide car bombers" -- WTF???

[RasTafarii]

a tinker was an intinerant craftsman who repaired pots and pans and replated them with tin.

he also sharpened knives and sold various kitchen items from his cart/wagon.

Re:OSS "Suicide car bombers" -- WTF???

[filer]

Ok folks... you can put down your pitchforks. Her ugly comments appear to have been snipped from the article.

If MicroSoft Leaked this, will we ever know?

[zibix]

Sounds like MS perhaps leaked it themselves for their own gains... now the real question is... If so, is there ANY chance of ever actually finding this out?

Parent is a fake - it's the source of linux 2.6.2!

[AmunRa]

As subject, this torrent is actually the linux kernel ver 2.6.2!

Does it work both ways?

[mangu]

or any other form in which a work may be recast, transformed, or adapted.

Can I adapt "West Side Story", since it's a derivative work of "Romeo and Juliet", which is in the public domain?

Re:Does it work both ways?

[tepples]

You may adapt "Romeo and Juliet" as long as you use no elements unique to "West Side Story".

Microsoft Code Bloated?

[Solokron]

The source code must be 10 Terabytes.

Imagine if the Linux Community Solved this crime

[zibix]

Wouldn't that be a slap in the face for them... how about a full campaign. LINUX USERS UNITE, STOP WINCODE FROM TAINTING OUR CODE! uh... dot com

Re:Kernel source here

[PatrickThomson]

Linux 2.6.2...

har de har dar. well, it does what it says on the tin.

Re:It's a TRAP!!! /Adm. Ackbar

[CAIMLAS]

Hahaha you rock!

My take on the whole matter: Blow. (ie, I couldn't care less. It'll just speed up the inevitable - switching to linux.)

I wonder how many shops will rush migration from Windows to Linux (if it is indeed possible in their shop)? I'm guessing quite a few.

HERE IT IS... BIT TORRENT TO WIN2K SOURCE

[jjames_91]

http://www.sschmidt.info/w2k_source.torrent
That's right 195MB

Just the source tree listing ... so what?

[zenpiglet]

All anyone seems to be pointing to is the source tree listing in a text file. Wow.

Such a listing for XP has been available on the Sysinternals site for years:

XP Source Tree

Finnaly de-lurked

[FunctionalMethod]

Couldn't this give the Open Source community problems down the road? As in Windows code ending up in some Open Source project ? Just the accusation would cause problems.. Unlikely , but everything is possible.

Re:Finnaly de-lurked

[ReNeGaDe75]

If that happens then the person who put the code into the project should be prosecuted. Why would the accusation hurt open source?

Open source is less likely to have that problem in the first place. I mean, the code is open, so the programmer would get caught. Closed source software, on the other hand, is more likely to contain illegal code, because nobody can easily prove it, being closed and all.

ZDNet Australia has an article

[jquirke]

http://www.zdnet.com.au/news/software/0,2000061733 ,39116114,00.htm

Re:ZDNet Australia has an article

[hellraizr]

that article says it's 40GB worth of source. now we all know windows is the worlds largest kludge but COME ON! 40 FREAKING GIGA BYTES!!! at a modest estimation of 3k per file, your looking at 13 MILLION SOURCE FILES!!! even if you factor that number it's still insane!

linux 2.6 only has on the order of 28,000 source files, how do you go from 28,000 to 13,000,000!? the numbers just don't add up. 40GB of text, at 1 byte per character per file, there's just no fucking way. I'd like to believe that and say "wow now I know why it's soo damn slow" but I just can't buy that. can someone possibly substantiate this claim? any hardcore programmers out there work on projects in the 20+ gigabyte range in codebase(s)? please let me know because otherwise I'm doubting the entire statement from the *security profesisonal* due to this.

Re:It's a TRAP!!! /Adm. Ackbar

[marauder404]

Microsoft is sooooo obviously trying to pull an SCO here.

This is the among the most ridiculous theories that I've ever read on Slashdot (and I've seen some doozies in the past several years). Why would Microsoft go about trying to pull off what SCO did? So it could a bunch of Linux users (a LIBERAL estimate of 100M) for a paltry $500 a pop ... that's a mere $5B over the course of the next several years? Let's double it for a $1,000 each and it's still just $10B, nevermind all the expenses, including legal, to go about trying to collect something like that. Or, perhaps, they decide to go sue a handful of companies for a few billion dollars each after years of litigation and all kinds of negative PR. Microsoft's revenue was $34 billion for last year alone, $26B of it being profit.

SCO's actions are based on a company with little revenue, little cash, and nothing to lose. Microsoft has everything to lose. Say what you will about Microsoft, but they didn't get to where they are today with silly moves like that.

Some are saying Open Sourcer did it. I say bunk~!

[tetrahedrassface]

Laura Didio: aka the SCO queen and her take on this development!!


"Up until now it was more like the 70/30 rule, where 70 percent of the threats are bogus. Now it's more like 50/50," Didio said. "With the open source community, there are a large percentage of tinkers and 'ankle biters' who are trying their hand at hacking. Some are even communicating with each other. So it only takes one or two of these groups sharing information to be able to pull something off. When you have this type of passion, it's hard to fight because these people are like virtual suicide car bombers."

Re:It's a TRAP!!! /Adm. Ackbar

[Anonymous Coward]

Please, don't slander BSD and research UNIX. That's just not right.

Nobody wants to be sat on

[KalvinB]

by a 500LB gorilla.

It has nothing to do with morals. It's self preservation.

Most companies don't have the resources to kick the crap out of warez distributors. MS isn't one of those companies.

Ben

Re:Nobody wants to be sat on

[Anonymous Coward]

Bullshit. They're not scared of MS. If they were, they wouldn't release and trade other MS products. No products are left unreleased because anyone is afraid.

Re:Nobody wants to be sat on

[Rakarra]

There's a heck of a lot more monetary value associated with Windows source code than there is with some windows binaries.

Re:Nobody wants to be sat on

[1u3hr]

There's a heck of a lot more monetary value associated with Windows source code than there is with some windows binaries.

Hardly, unless by "associated with" you mean "cost to create" rather than "selling price", because the only people interested in it are hackers, in either sense. Anyone who wanted to use it commercially would be insane. They could license it if they needed access.

Windows binaries, on the other hand, can be sold in street stalls for $2/set in much of Asia, so they have a value.

Re:It's a TRAP!!! /Adm. Ackbar

[marauder404]

LOL ... my math is completely wrong ... obviously, I meant "$50B over the next several years."

Re:It's a TRAP!!! /Adm. Ackbar

[iammaxus]

I think you people are going a little overboard. Windows source code isn't like a virus or something.
Wait a minute....

Quick

[xxScoobyxx]

fix it and slip it back

You said it dude!

[twoslice]

This reporter does not wish to be sensationalist, but the number of industries and critical systems that are based around these technologies that could be damaged by new exploits found in this source code is something that doesn't bare thinking about.

Ain't that the naked truth....

Microsoft stole from Unix for Dos2.11

[milliyear]

Actually, Microsoft had a license to port Unix to the 286 and the AT architecture.

And shortly after releasing Xenix, Microsoft released MS-DOS 2.11, which was the first version of Dos with directories & subdirectories, with devices represented by reserved filenames (LPT1, COM1, etc.), the first one to use command-line I/O chaining ( | , > , , etc.) and the list goes on.

All miraculously new and original features for Dos, implemented exactly like Unix, just after MS got a peek at the Unix source.

Why that one's never ended up in court is beyond me. No, I will not be surprised if it really is Windows source and some files still have AT&T copyrights in it.

Yes, I did see parts of the Dos 2.11 source.

Re:It's a TRAP!!! /Adm. Ackbar

[Curtman]

Screw that.. If we find GPL code in here, Bill's going to get a good SCOing himself. This code can in no way shape or form go into Linux though. That would be very bad.

Re:Someone got into Mac OS X's source and posted i

[Brewst3r]

Apple's in the hardware business, their software is made to sell computers, so they have zero reason to not take advantage of others doing your work. MS on the other hand doesn't have anything but the software to push.

Here is a Torrent link ... 200MB download

[afxgrin]

http://www.sschmidt.info/w2k_source.torrent

I haven't finished downloading this, but it's 200MB in size, has 944 peers! :-)

The tracker is the same one you have listed:

http://alge.nlc.no:6969/announce

The hash is also the same.

Re:Here is a Torrent link ... 200MB download

[Anonymous Coward]

Looked through it some. I would be very surprised if this code is not authentic, although what is up with the "bsc" directory? It contains a bunch of junk.
But it's certainly not "complete", i.e. I can't find the NTFS filesystem driver (or at least anything that would look like such a beast...), but I could find code from MSIE for importing Netscape cookies and bookmarks, some of which was under the windows/shell/ hierarchy (maybe that's MS's basis that MSIE is integrated with the core OS?)
I even saw some Java code referencing the "com.ms.xml" hierarchy, apparantly an XML parser MS wrote.
Plus some .doc on GDI debugging, strings showed what seemed like a valid Word doc, complete with "Microsoft Confidential" as one of the phrases seen.
Also, a core file under the 'security' folder, which was an ELF binary with some junk about Vi Improved 5.6 and some symbols starting with 'xterm'... maybe the guy working on that was using Linux?

Re:Here is a Torrent link ... 200MB download

[Anonymous Coward]

/*++ BUILD Version: 0003 // Increment this if a change has global effects

Copyright (c) 1989-1999 Microsoft Corporation

Module Name:

ntseapi.h

Abstract:

This module contains the Security APIs and any public data
structures needed to call these APIs.

This module should be included by including "nt.h".

Author:

Gary Kimura (GaryKi) 06-Mar-1989

Re:Here is a Torrent link ... 200MB download

[torokun]

What in God's name is wrong with you people?

Do you even think about how many coders work for Microsoft? How many work for companies that depend on Microsoft technology? Do you think about the fact that people are busting their asses writing code, trying to make a living? Who cares about whether MS is full of crap or not? All companies have marketing. That's how business works.

You don't go and steal everything from a store just because the electricity goes out! It has repercussions! I have friends that work for Microsoft, and believe it or not, they are incredibly intelligent, honest, and good people. Each time you post a torrent link, you're helping to screw them.

You disgust me. This is NO DIFFERENT than a bunch of morons looting stores after a big game, just because they can... Can you possibly think that promoting these links on slashdot doesn't have a harmful effect? But you don't care about that. You just want to get your little jollies off thinking how neato it is that you can do something and a big corporation can't stop you.

Congratulations.

Re:Here is a Torrent link ... 200MB download

[Anonymous Coward]

You know, every evil empire is build by honest, intelligent and good people, the same with Microsoft.

Estimated 300,000,000 computers run with Windows NT/2K/XP and the source code is under seal, known security holes take 6 months to be fixed, where are the responsible and intelligent people at MS taking 6 months to fix it? Are they all taking vacation?

See, your friends may be true friends of yours, granted - but this is a corporation which doesn't behave as friendly, honest and ethical as your friends who work there. Enron employees are surely more honest as the managers who screw Enron.

So, just because you have simpathy for your friends working for MS doesn't make MS be like your friends. See the bigger picture of this leak!

Re:Here is a Torrent link ... 200MB download

[Anonymous Coward]

If you loot a store, then the owner has a lot of damage.
He's lost products, less people will buy his products and
there is physical damage to the store.

What is the damage to Microsofts 'store'? They don't have
to replace broken windows, or smased in counters. They
might have to fix some bugs, but they should have done
that in the first place! Are people not going to buy Window
XP because they can compile parts of Windows 2K ?

The damage MS has, is PR-damage, nothing more. And
off course they wil have to hire some security experts to
review all the code, so that they can bring out patches
before the worms come out to play. But this isn't really
neccecary, since MS already has 'trustworthy computing',
right?

Unless MS is really afread that people might find code
that has no other purpose then hinder competition
from Java, Open Office, RealPlayer, DR-DOS, Netscape, Opera, etc, etc?

And about you're friends at MS:

Even if there were damage, and MS would go broke!, then
thiswould be best thing ever happening to them, because
the market wouldn't go away, and the could work for a nice
company which would give them a decent salary, so they
wouldn't have to 'Bust their asses' for a company who
clearly doesn't care about them.

You remind me of people who were against the abolition
of slavery, because it would be bad for the slaves...

You disgust me. You are NO DIFFERENT than a moron
working for a PR-company selling his soul for a fistfull
of dollars.

This is only good news...

[Mick_Flemm]

I Can already imagine M$ Exchange servers running under Linux or M$ Office, or M$ SQL Servers etc. :-)

Now if the source code has been leaked...

Remember it's only windows we got, we canot use the code as is and we canot be 100% combatible due to legal reasons. BUT lets say we will be able to run programs writen for Windows, what then ?

Microsoft never relied on home users, everyone has windows because its easy, you can play games, you can run office, photoshop etc not because its a good OS (easy doesn't make it good).

Microsoft is No1 because:

a) Of the seminars, every company can train their people to use M$ Office, so even if they use Linux they will still be using Office, Office is just an example.

b) Of the diplomas etc cause they have to authorize ppl so they got money for it, and people would prefer to learn Office etc cause they can get a diploma to prove it, this aplies on companies too.

c) Of the huge licences they made with companies, organisations etc for various software.

d) Of the support they provide and the guarantees.

e) Of the years its been working on it (they trust M$ even if the have unsecure apps (most people don't care about security so much, they prefer to do every-day stuff with their PC, that's what windows are for)).

They won't realy loose money because people new to PCs will still buy windows with each new machine they purchase (Licences remeber?)also organisations will still continue to buy windows because of the seminars etc...

Most people have Windows either from the purchase of a new PC or pirated so M$ wont loose money from them.

So if u think of it more M$ will still be in the top and now they will be able to create stuff for linux too with no licences etc. They will get more money because more people will use them (they will now be able to run their favourite appz under a secure OS), they will realy get money from open source by not being compatible with open source but with open source being combatible with them.

Linux will never be able to handle everything so u will still need M$ Stuff (lets say you will still need DirectX to run games for example).

Also linux will never be able to provide guarantees, Licences, seminars e.t.c. something that companies need.

This is both good for the open source comunity and Microsoft, the guys are REALY CLEVER. The only problem is the viruses, but it wont last for long, especialy if M$ asks for help from the open source community (with a competition for example).

Finaly let me remind you that if it wasn't M$, a lot and I mean A LOT would never know how a PC looks like, it would be only for companies, so next time u say things about M$ remember what they did to the society, i personaly thank them, if it wasn't for them there would be no open source (I continue to believe that Windows SUX :P but M$ has done more than windows) they are making money BUT they do good things whith them (others are making more money by creating guns, they are the ones who SUCK)...

Sorry for my poor english :-)
Sorry for the large post

Nick

Re:Source Code Exposed? Really?

[AvitarX]

Because a new platform would not let them leverage their current monopoly powers.

Re:I.T. Vibe sites Ballmer denial

[Simon Garlick]

That quote is four years old.

Re:Microsoft source code leak? Pfft, that's nothin

[Last Warrior]

true, its leaked constantly but sco is the only company that is stealing it.

OK, she's warping the truth. So...

[bersl2]

email her. The link's on the story page (don't quite know where, 'cause I'm using lynx right now). Tell her nicely where she fucked up.

Don't just sit here and bitch on Slashdot...

Re:OK, she's warping the truth. So...

[paco verde]

Except that she's not a journalist, she's a source (and ostensibly an expert) quoted in the article and a "senior analyst" with Yankee Group -- which bills itself as "the most trusted name for communications and networking research and consulting."

It's her job to be not just familiar, but expert, about the technology industry. I'm not sure if her comments represent incompetence in the form of lack of familiarity with a paradigm shifting movement in that industry, or simply hostility toward the OSS movement.

Either way, I'm not particularly interested in doing her job for her by correcting her. Even the most cursory investigation of the OSS movement's motivations would clearly reveal her characterization of OSS hackers as terrorists attacking Microsoft (and what else are we to make of calling them "virtual suicide car bombers"?) as absurd in the extreme.

My point in posting the quote is not to sit on slashdot and bitch, but to point out to slashdot readers the misinformation about OSS sometimes propogated by mainstream media and analysts. The motivations behind same are up to you to decide for yourself.

Re:OK, she's warping the truth. So...

[filer]

My point in posting the quote is not to sit on slashdot and bitch, but to point out to slashdot readers the misinformation about OSS sometimes propogated by mainstream media and analysts. The motivations behind same are up to you to decide for yourself

I, and likely others as well, expressed our dissatisfaction by writing the editor instead and now the comments have been yanked and I suspect the editor will be keeping a closer eye on Miss Didio in the future - as she cannot help but lose credibility which such nastiness. Which action do you think is more usefull to the OSS community? Preaching to the converted or pointing out to an often lazy media that yes, maybe you have easy access to this person, but they are obviously a fool with an axe to grind.

Call her on her remarks yes, but do it with somebody who can actually do something about it as well. This was the perfect opportunity to make the media aware of just what a kook she is. Some of us took advantage of that and it appears to have worked.

Re:OK, she's warping the truth. So...

[paco verde]

Or maybe my posting to slashdot generated enough email to the editor to get the quote pulled, which my own letter alone probably would not have accomplished, making it the more useful action for the OSS community ;)

But seriously, you make a valid point. A poster to the follow up "leaked source" article suggested that Didio's car bomber comments demand Yankee Group make a public apology. Since they've already been pulled from the article I chose to write to Kim Vranas (kvranas@yankeegroup.com) at Yankee Group, listed as the Media Relations contact, instead and request Yankee Group publicy apologize and retract Didio's comments.

Cheers

Re:OK, she's warping the truth. So...

[filer]

I hope you pointed out the fact that in the 48 hours previous to those remarks approx. 100 people were killed by car bombers in America's new protectorate, Iraq. If Didio was aware of that when she made those statements she's a tastless nutcase. If she was unaware then she's clueless. Either way she looks like she has her head up her a**.

Hey, in the end she did us a favour I suppose by showing everyone her true colours in such a garish manner that nobody can miss it.

All this is notwithstanding the fact that as with remarks she previously made vis-a-vis the Open Source movement and MyDoom there is no evidence whatsoever that the Open Source movement or anyone affiliated with the movement has anything whatsoever to do with either incident.

Re:I forsee a lawsuit

[dtfinch]

I guess I worded that poorly.

If you believe in Open Source or Free Software...

[Bozovision]

If you believe in Open Source or Free Software then you should believe in copyright. If you find a GPL code in use in a closed project, then you should report it to FSF. If you find Windows code in the wild then you should report it to Microsoft. It's their code and consequently they should and do control who gets to see the code.

That said, I would desperately like MS to release the code under an open-source, but closed-project style licence; that is, the code belongs to them, and for any derivative code MS is automatically granted a licence to to sublicence and do whatever they wish. It should not be permissible for the code to be included in another product without the explicit say so from MS. Microsoft could protect theselves financially by being the only source for binaries. BillG are you listening? Win2K, with open source could be sooooo good, and you would still make a stack of money. Plus you'd have a huge team looking at improving the software, for nothing.

It's worth a shot if the code has escaped. At worst you'll get a second product line.

Devastating?

[loconet]

From the article...

"
This leak is a shock not only to Neowin, but to the wider IT industry. The ramifications of this leak are far reaching and devastating. This reporter does not wish to be sensationalist, but the number of industries and critical systems that are based around these technologies that could be damaged by new exploits found in this source code is something that doesn't bare thinking about.
"

Devastating?? Devastating because of the possible worms, viruses that can araise from this?

Closed or open, a piece of software "should" be secure and clean regardless.. if it's devastating it just proves that MS creates shit, so the fact that a pro-windows site actually says that is sad.

Scenario that should have happened by now...

[Cyno01]

Copy of the windows source is leaked from somewhere, floats around, etc, Through a watermark or something it is traced back to the source. That person claims their box was hacked, points to obvious weak point in code that allowed it to happen. This would probably be the most embarassing thing possible for microsoft.

Its Win111111010011...

[denks]

for those of us who count in binary.

Re:Its Win111111010011...

[AyeRoxor!]

Well, I don't know about you, but when I'm grokking the NTFS, it's Win07D0 for me.

Unacknowleged API's exist?

[gandy909]

If this is the real thing, and it happens to be the whole enchilada, this could either bring to the forefront or lay to rest the theory of the unacknowleged API's that they supposedly have in there so that their own apps run better/faster, etc.

MOD PARENT UP!

[Makarakalax]

I never usually bother requesting mod-ups, but this one is pretty funny and apparently unnoticed too :)

not the whole source - only parts of it

[Anonymous Coward]

http://www.smokeherb.com/windows/


the sourcees are only partial, a lot of little scripts, build tools, code/security/certificate signing tools are missing, 3rd party and drivers of course, its basically just some low level kernel and little shell and some apps sources.

you need a lot more if u wana build windows

check for some deeper info about win2k and nt3.x build and software engineering information here .

Re:nlc.no

[Anonymous Coward]

alge.nlc.no is not affiliated with nlc.no, it is simply a forward given many years ago.

The EML Files

[Alex_Ionescu]

Guys...

I can't believe you haven't figured out what the EML files are yet.
Anyone remember NIMDA? The worm from 2002 I think? It had this exact same effect of sticking infected eml files all over your folders (by taking some names from your files, and others randomly). Opening those EML files or forwarding them would guarantee future and constant infection.

It's clearly evident that this machine was infected by nimda and got port-scanned and found. The rest of the code is probably going to come soon enough, unless MS already found out and pulled the plug.

By the way, alpha doesn't mean "Alpha Version" but the Alpha CPU made by DEC, now owned by Compaq.

Re:The EML Files

[shird]

The virus was cleaned from the comp (ie zeroed the eml files), but the backdoor (file sharing) remained. Most AV software don't remove backdoors after cleaning a virus.

Re:The EML Files

[ysachlandil]

.eml files are raw email files.

They are called .eml files so you can doubleclick on them and read them in your email client, reply to them etc.

So nothing to see here, move along...

--Blerik

Re:Someone got into Mac OS X's source and posted i

[pinpoint23]

i doubt that apple would react the same way if Aqua was leaked...

DEAR SLASHDOT SUCKERS

[Anonymous Coward]

Thankyou all for participating in *the* troll of 2004.

ummm ... no it's a ZIP

[afxgrin]

metainfo file.: windows_2000_source_code.zip.torrent
info hash.....: f03fc1e04869294d5644d3c8c5d0fb8f2d26aa59
file name.....: windows_2000_source_code.zip
file size.....: 213748207 (815 * 262144 + 100847)
announce url..: http://alge.nlc.no:6969/announce

that CLEARLY says .zip - I didn't see anything about a rar in that post......

F03FC1E04869294D5644D3C8C5D0FB8F2D26AA59

That's copied right out of azureus.
The hash is the same, and i'm just waiting to see

Information

[MC68040]

Here's some facts about the zip file that's on the run:

The zip file is 208 mb (213 748 207 bytes)
All the files with the "letts to children.eml" etc names are _completely_ empty.
All files are commented, some are said to be public implention examples while others got "semi public" or no note of being pubblic in the headers.
It doesn't really have any comments with personal twists etc, just facts from what I observed this far.
It only includes the OS stuff (e.g. mplayer/iis/ie isn't there in full or at all)

Got questions, just ask.

I got it

[DotQuantum]

So i have been reading /. and looking at examples of source code that have been cited and created on /. but i think this is the real code that was leaked. http://www.spymac.com/gallery/show_photo.php?picid =80374&size=big

Re:It's a TRAP!!! /Adm. Ackbar

[Lord Kano]

If we find GPL code in here, Bill's going to get a good SCOing himself.

Not necessarily. You'll never get a court to admit stolen source code as evidence.

LK

Re:It's a TRAP!!! /Adm. Ackbar

[adrianbaugh]

Rubbish. Definitely look - there's a lot of stuff you can learn from seeing the source that can't be traced back to your having seen it. Take wine, for example[0]: they're trying to implement a largely undocumented ABI. At the moment it's hard even to know what they have to code. If they look at the source they could see what functions they need to implement, how they need to work etc. Make basic notes, never look at the code again, go on holiday for a month, come back and write the missing bits semi-cleanly. They wouldn't need to copy any of the implementation (doing so would violate MS's copyright) but it would sure help to know what functions they needed to write (and I guess that would count as nothing more than utilising the widespread leaking of a former trade secret[1], which has no protection under law). The key point is, don't under any circumstances copy the code. And, if you do choose to look at the source, I suggest you get rid of it afterwards and don't tell anyone.

[0] I'm not suggesting for a second that the wine devs would look at the code, you understand: it's an example.

[1] If the leak is genuine, MS need have no doubt that this will be all over every p2p network in existence within an hour or so.

You really nailed B3!

[twoslice]

??? - as in, which one of the 3 million exploits should I pick?

Upgrade Anyone?

[Laika]

Talk about a motivational strategy... Impressive!

Comment removed

[account_deleted]

Comment removed based on user account deletion

WAIT!!!!!!

[vwjeff]

This is all speculation. Please wait until all the FACTS come out. Thank you.

I just find it interesting...

[Fiz Ocelot]

That the article author describes it as potentially devestating and full of security risk with the source being leaked. And yet, look what that very same thing has done to the open source community. True, it probably is a very bad thing for windows security. Yet another reason to switch to another OS?

Re:I just find it interesting...

[vonsneerderhooten]

And how does it help to write a publication about it??

Re:It's a TRAP!!! /Adm. Ackbar

[Josh Booth]

Isn't that

int i_i; /* variable */

Mind you Hungarian Notation!

Anyone seen this in any newsgroups?

[maggotdude]

Just wonderin if the source code has hit the newsgroups yet, and if so, which ones. Thx

Re:Oh, no! I Looked!

[adrianbaugh]

That's just for XP. For all the 9x releases they were still using COBOL ;-)

Re:It's a TRAP!!! /Adm. Ackbar

[orthogonal]

And as you obviously don't know anything [....] why the fuck did you open your stupid mouth anyway?

Ever notice it's always the Anonymous Cowards who are so vehement in their criticism? Always with the "you're stupid" and the Mr. Tough Guy expletives: "why the fuck...."

Yeah, yeah, I know, Mr. Anonymous Coward: you're powerful and famous, in your mother's basement.

Paranoia

[eWarz]

So lets say microsoft did this on purpose. They could kill both the WINE project and the ReactOS project with one blow. They'd have a REASON to take both projects to court, repeatedly, Even if there were only suspiscions.

Re:You've got to be shitting me

[caino59]

compiled software is 0's and 1's

no comments, no spaces.

think about it.

it wasnt leaked!!!

[ShallowThroat]

IT WAS LIBERATED!!!!!!

Re:it wasnt leaked!!!

[gunpowder]

Liberated? So it means it's out in the wild!

Now the laws of nature applies: survival of the fittest!
I wonder how long it will survive with all these evil predators out there (Linux, *BSD, ...)

GNU Makefiles...!

[InceptionOS]

Well, well, M$ has been naughty, there are GNU Makefiles in there:

07-26-00 01:41 win2k/private/genx/ie/inc/gnumakefile
07-26-00 01:41 win2k/private/genx/ie/uuid/gnumakefile
07-26-00 01:41 win2k/private/genx/shell/gnumakefile
07-26-00 01:41 win2k/private/genx/shell/inc/gnumakefile
07-26-00 02:12 win2k/private/inet/mshtml/btools/ascparse/gnumakef ile
07-26-00 02:12 win2k/private/inet/mshtml/btools/nfparse/gnumakefi le
07-26-00 02:12 win2k/private/inet/mshtml/btools/pdlparse/gnumakef ile
07-26-00 02:12 win2k/private/inet/mshtml/gnumakefile

There are many more...! Everything from GNU is either GPL'd or LGPL'd, if it gets out M$ is going to be in a world of hurt!

Re:GNU Makefiles...!

[jonathan_ingram]

You can use GNU make to compile non-(L)GPL code.

Re:GNU Makefiles...!

[phamNewan]

There are some interesting ramifications if M$ did in fact use any GNU code. I would not be surprised if they did since if there is one group that has heisted, or at least imitated software that is better than what they have it is M$.

Since the source for all GNU is available, it is easy to see it end up being used by M$ especially since they had no reason to ever suspect that they would be caught for doing so, and they know the code already works.

What would happen though is very interesting. The GPL license issues with this would be like nothing ever before seen in courts. The really interesting thing is if there was enough found to prove that M$ was using stolen code, then a court could conceivably force a search for more infringed code.

Even more interesting would be how the press would play this. Most press coverage of the SCO issue leave the non-tech people ( ie. Stock traders that hear news without understanding it ) with the idea that SCO is right about owning Linux. I have heard this numerous times from day-traders. If it came out that M$ was in fact stealing licensed code, they would be fried by the media and the stock markets.

This is all supposition at this point, but I wouldn't mind watching it play out.

Re:GNU Makefiles...!

[johnjosephbachir]

i have to hand it to sco, they are truly masters of FUD. they are taking complete bullshit and convincing the investment community that they are right. we all know the drill: the price goes up, they sell their shares, they drop the case and disappear from the scene. what fucking haters. but i really have to hand it to them. they have made FUD into a fine art form.

then again maybe half of the economy is like this but this is the only time i have been paying attention.

one thing is for sure, i'm going to be looking at buying stocks in a whole new way after all of this, and seeing comments like what phamNewman (parent poster) said he heard from day-traders. i mean i knew the stock market hinged on speculation and a system of perceived value and trust... but now i am seeing how these fools feed on press releases like hyenas, on.. umm... whatever hyenas feed on when they are hungry and tired and confused.

which is why i will stick to buying shares of companies i am familiar with. and also... priceline!!!(ouch).

Obviously a hoax, easily spotted

[Anonymous Coward]

I've roughly looked over the code, and this is what I've come up with so far:

• The code is extremely unorganized and incoherent.
  
• Throughout the directory structure there are lots of email files (*.eml) which are either empty or 415534 bytes (the latter contains only blank spaces).
  
• The oldest source files are for "paintbrush", and dates back to 1991 (!!)
  
• There is alot of stuff missing, and also alot of stuffing included which SHOULD NOT BE THERE AT ALL (such as paintbrush (from 1991))
  

Conclusion: this is obviously a part hoax. There seems to be partly authentic code from various Microsoft projects, combined with some injected "authenticity-confirmation-stuff", such as fake comments and notes.

Now get over it.

aaekhm-zzkjg--b

Re:Obviously a hoax, easily spotted

[1s44c]

The code is extremely unorganized and incoherent.

Windows machines are unorganized and incoherent.

Throughout the directory structure there are lots of email files (*.eml) which are either empty or 415534 bytes (the latter contains only blank spaces).

Those are the error handling routines.

The oldest source files are for "paintbrush", and dates back to 1991

Paintbrush is a critical part of the system. They had to use the 1991 code as its the most stable version they had.

There is alot of stuff missing, and also alot of stuffing included which SHOULD NOT BE THERE AT ALL (such as paintbrush (from 1991))

It's a well known fact the a large amount of stuff is missing from windows. Inetd, sshd, bourne shell, vi, etc.. This is normal.
The extra stuff is likely the bloat they keep putting in to make people buy faster and faster computers. Dell most likely has something to do with that.

Conclusion: What you downloaded was a load of crap. Microsoft code is a load of crap. Who cares if it's real of not, don't we all have better things to do?

The 203MB file expands to just under 660MB

[Anonymous Coward]

From ZDnet: The 203MB file contains the code that appears to be from Microsoft's enterprise operating system, but the code is not complete, said Dragos Ruiu, a security consultant and the organiser of the CanSecWest security conference, who has examined the file listing. "It was on the peer-to-peer networks and IRC (Internet relay chat) today," Ruiu said. "Everybody has got it; it's widespread now." The 203MB file expands to just under 660MB, he said, noting that the final code size almost perfectly matches the capacity of a typical CD-ROM. The entire source code, he said, is believed to be about 40GB, meaning that the file circulating Thursday would be only a fraction of the full code base--if it is authentic. http://www.zdnet.com.au/news/software/0,2000061733 ,39116114,00.htm

Re:The 203MB file expands to just under 660MB

[PingPongBoy]

40 Gb source????? whoaa

What does it take to run a pc?

Re:It's a TRAP!!! /Adm. Ackbar

[n1ywb]

I read rotten.com, I think I'm about as fscking tainted as they come. It's absurd to think that there would be ground for a lawsuit against an open source project you worked on because you had at one point glossed over the NT kernel source or something. That's like homeopathics who believe that remedies should contain miniscule quantities of active ingredients. In fact, the "strongest" formulations usually contain not a single molecule of the substances in question. Zero parts per billion -- pure water.

I've seen the Windows CE source. Maybe I should never program again because MS could sue me! I think not.

PS No offence to homeopathics, I don't care what crazy shite you belive in.

Re:It's a TRAP!!! /Adm. Ackbar

[Curtman]

Probably not, but it would be trivial to show similarity in two binaries if you know where to look. The source would only help find the needle(s) in the haystack.

Re:It's a TRAP!!! /Adm. Ackbar

[Sivar]

We have identified over one million lines of our IP in Microsoft's source code. While I cannot share most of them because they are a trade secret, here are three of the most glaring examples:

#include

for( ; ; )

if(!stop) {

Many of these lines have been copied verbatim several thousand times. We do not want to, but are forced to sue Microsoft for unlicensed use of our intellectual property.
We will institute a licensing program called gplSource which will allow Windows users to obtain the legal rights to use our IP. This cost will be significantly discounted to early adopters.
Already at least three Fortune 500 companies have seen the validity of our claims and have paid these fees on a per-CPU basis to continue using Windows. While we cannot divulge their names, they do exist. Really!

Bogus Bogus Bogus

[Binary Air]

It's amazing how the "informed" slashdot crowd falls for a story like this. I think Neowin wanted to test their infrastructure so they trolled /.

Too late.

[BoomerSooner]

I've been a liability to projects I've worked on for years. I don't need any MS source code to be a shitty worker. I get to work 15 minutes late, I come in the side door so "Lumberg" doesn't see me, ... That movie was so dead on.

IT sucks, I cannot wait to get into Fast Food. Bring on the outsourcing Republicans!

Re:Instructions:

[lullabud]

that wouldn't be so easy though, because things like whitespace or a minor syntactical change, or even just renaming a function or variable would create a different fingerprint, so if somebody really wanted to they could slip the same code without it being recognized. definitely good advice though, if there is a way to make it work.

Nonliteral copying

[tepples]

it's very clear that *ideas* are not copyrightable

True, but there exists no bright line between copying of inherently free ideas and nonliteral copying of copyrighted expression. The opinion in Computer Associates v. Altai (1992) gives a method to separate ideas from expression, but because most individuals can't afford to defend themselves in court, one must act so as not to give even the remotest appearance of infringement.

Re:It's a TRAP!!! /Adm. Ackbar

[n1ywb]

Actually I would conjecture that it is highly derivative of VMS, rather than UNIX. Considering that the NT kernel architecture was designed by a bunch of ex-DEC guys... I wonder who currently owns the rights to VMS and if they have ever looked into that? They might be able to pull a MAJOR SCO on MS. Too bad DEC is gone :(

Re:It's a TRAP!!! /Adm. Ackbar

[Anonymous Coward]

Think it absurd if you want; the law certainly allows for it. It works like this:

1) You see some proprietary source, either legally or otherwise;

2) You later work on some open source project;

3) The copyright holder of the proprietary source in 1) looks at the open source project and decides that some sections of the code look strikingly similar to their own code. They further discover that you wrote or contributed to those sections. They call their lawyer. Now, it may well be a combination of "coincidence plus a limited number of ways to do X" that caused the similarity, but you're going to have to convince a judge and/or jury of that. The other side will have to convince them that you copied it. They've got the striking similarity plus the fact that you've seen their source. What have you got?

Now, since you've seen the Windows CE source, why don't you ask the Samba project if you can join, and tell them you've seen MS source code (whether legally or not doesn't matter; seeing it is all that matters) and see if they will take you on as a developer.

I bet they won't.

Could it be...

[mmu_man]

we are a bit early for April Fools ?

Non-compete agreements?

[tepples]

there is a very long and solid history of exclusionary contract law that stipulates enforceable prevention of work in a specific field.

How long can such a non-compete agreement last in various jurisdictions? Is it a matter of "if we fire you, you must flip burgers for the rest of your natural life"?

Re:It's a TRAP!!! /Adm. Ackbar

[Tough Love]

If you work on any Open Source project, DO NOT LOOK!

Don't be silly, no kernel hacker is the slightest bit interested in looking at that leaky, sludgy mess.

Re:It's a TRAP!!! /Adm. Ackbar

[adamjaskie]

OH NOES!!!

for(int i = 0; i MAX_LENGTH; i++)

code comparrison

[moojin]

now they can use the code comparing program that somebody create for the SCO / IBM case. i wonder if there will be any matches...

Re:It's a TRAP!!! /Adm. Ackbar

[tsanth]

In short, JUST SAY NO.

Father: Where did you learn to do this? Tell me, where?!

::: dramatic silence :::

Kid: I learned it from you, dad! I learned it from you!

::: cue dramatic music :::

http://www.sschmidt.info/w2k_source.torrent

[Anonymous Coward]

http://www.sschmidt.info/w2k_source.torrent -- Windows 2000 Source Code

Re:Source Code Exposed? Really?

[sepro]

I don't think they're focusing on monopoly power. They might be more interested in controlling technology directions and stressing out the market a bit. Don't forget that by the time the public found out about the F-117 stealth fighter, it was already a twenty year old concept...been there, done that.

Cnet story can be found here

[Bendebecker]

http://news.com.com/2100-7349_3-5158496.html?tag=n efd_lede

Re:The shit will hit the fan + Mirror

[silex_reloaded]

You wouldn't want wine to sued out of existence because it contains code derived from a proprietary, copywritten system.

The developers can learn some of the windows internals from the code, which does not mean copying code from it.

Alternate version for B

[anarxia]

1. look at the windows source code
2. find mistake
3. send patch to microsoft
4. get arrested for looking at the sources
5. Doh!

Windows is their baby

[KalvinB]

MS's game department isn't what brings in all the money. It's their Windows and Office products that make the money.

They can grin a bear it when some games are pirated. Why do you think they (try to) crush companies that make mod chips for the XBox? Some things are more important.

And this is the source code to Windows. This is NOT just another product.

Anyone who dares to host it will be sat on until they are dead. Hell hath no fury.

Claiming this is just another product shows your definit lack of ability to comprehend the scope of this leak and the importance of it to MS's bottom line.

The legal costs required to shut down warez sites over a game generally are more than the amount of the losses. The legal costs required to crush the fools who dare to host the Windows source comes nowhere near the potential losses due to the leak.

Ben

Re:Windows is their baby

[LousyPhreak]

dont forget that by the time they can shut down just one warez site the code has already spread to a thousand others.

another thing is that i want to see them take action against i.e. a russian/chinese warez site hosting their code.

almost the only thing they can (and maybe) will do is start suing americans (i dont think they would care to start in europe, or any other continent) so that 99.99% of the people in any state microsoft has some strength wouldnt even dare to host their code.

(just check the hl2 leak, i havent really heard anything about a big suing going on by valve, but as i didnt really follow this one they might also have already sued some people)

just my 0.02

Re:Windows is their baby

[builderbob_nz]

...until they are dead. Hell hath no fury.

Like a woman scorned eh? I always thought there was something odd about that Bill character...

Source Code Leak Verified by MS

[anubis__]

from washingtonpost.com Microsoft Confirms Windows Code Leak :

"Microsoft Corp. on Thursday confirmed that the source code for its Windows 2000 operating system has been leaked, a security breach that could give hackers important intelligence about how to exploit flaws in software run by most of the world's computers.

A Microsoft spokeswoman said someone had illegally posted incomplete portions of Windows 2000 on the Internet."

They can't do that, since the source code is open

[jwd630]

I've said this before; read Reflections on Trusting Trust

KOMOTV link: Microsoft confirms?

[Anonymous Coward]

Windows Source Code Leaked Over Internet

"SEATTLE - Microsoft Corp. said late Thursday that portions of its Windows source code - the tightly guarded blueprints of its dominant operating system - had been leaked over the Internet."

how did they get the code?

[Sarin]

I remember reading a slashdot article about some Russians (it's always Russians innit? lol) that got away with stealing some source code, but hasn't this code been stolen like 2 or 3 years ago?

yeah they always call 'em Russian or Eastern European - those are the guys who did 'it'. That's just not true, people use connections/crack systems over there for that reason: they're not getting cought, no admin is going to reply on an email from the FBI if you used a computer from Kazachstan, because no-one will speak English there.

News

[loconet]

It's now all over online news..

http://www.infoworld.com/article/04/02/12/HNmicrol eak_1.html
http://www.ebcvg.com/news.php?id=1903
http://arstechnica.com/news/posts/1076628412.html
http://www.internetnews.com/ent-news/article.php/3 312451
http://www.sunherald.com/mld/sunherald/business/79 41292.htm
http://www.wvec.com/sharedcontent/nationworld/nati onprint/021204cccanatmicrosoft.149f2b31.html
http://www.komotv.com/stories/29778.htm
http://www.cryptonomicon.net/modules.php?name=News &file=article&sid=671
http://www.dvhardware.net/article2423.html
http://searchwin2000.techtarget.com/originalConten t/0,289142,sid1_gci950346,00.html

Re:News

[j0se_p0inter0]

it's all over eDonkey too.

-- Analysis from a Windows Expert --

[Anonymous Coward]

If the files that are listed at 'http://heim.ifi.uio.no/~mortehu/files.txt' really do exist outside of the Microsoft firewall, then there is a complete enough tree to build Windows. It would require about a month of effort to get a working build, but it would be doable...and in fact worth every second for one reason - access to the underlying code of user32.dll (source of HMENU) and comctl32.dll (source of pretty much everything else GUI oriented - List boxes, tree controls, etc.). These two DLLs are black boxes and both result in millions of wasted hours every single year. I don't know of a single Windows programmer who isn't dying to get their hands on the source of just those DLLs. They could care less about the rest of the OS source...Microsoft, you reading this? Whoever leaked this has done every Windows programmer a _favor_...and you have actually hurt the open source community than helped it.

Anyway, I digress. The following directories I recognize: kernel, GDI (where's GDI+?), comctl32, comdlg32, server/client separation, Microsoft Plus!, explorer, systray (I thought they would call it the Taskbar Notification Area internally...grr...stupid MSDN), walk (Dependency Walker?), built-in FTP, My Documents (something the world could do just fine without - I even see the COM object stuff there as well that makes it "permanent"), TweakUI, shell32, advapi (lots of NT-specific stuff in there that really should also be for 9x), MSGina, Video for Windows (and possibly Windows Media Player?), some codecs, the Windows Registry, all of the standard Accessory items (including a huge section for Hyper Terminal - and obviously MS Paint, Notepad, and OLE hooks into Paintbrush), Active Accessibility, Control Panel (and applets), Games, the _old_ Win3.x Program Manager, RegEdit, RegWiz (? Not quite sure what this refers to), and rundll32.

Someone made a comment about the .eml extensions residing in the source tree...note that they are all zero bytes. This is probably for the ability to go back in time to specific versions without getting complaints from their versioning software.

I'm getting around to my final analysis. Basically, what is here is a complete Windows 2000 _kernel_ and _user_ mode tree for the default installation of Windows 2000 (no Service Packs). This, however, does _NOT_ include any proprietary code such as drivers or the source code to DirectX/Direct3D/DirectShow (I know several programmers who would kill for the source to DirectX - it drives them bananas due to the lousy code on Microsoft's behalf). So, while someone _MAY_ be able to compile the whole thing, there are no drivers to go along with it and the Service Packs would overwrite any customization. Therefore, the OS, as a whole, is essentially worthless without the actual media that contains the drivers (and broken without at least SP1). However, there are components of the source code (that I've already mentioned) that Windows programmers would sell their souls for.

I suspect that this source code will become a prized item to have in about two years when Microsoft cuts off support for all existing Windows OSes. Win98 support was just to test the waters to see when companies would be ready for Microsoft to dump them and accept it. You may think I'm joking, but my gut feeling says that Win98 was just a test...and with the source to 2000 floating around, MS can shrug their shoulders and say, "support it yourself," just don't distribute patches or we'll come after you.

Microsoft confirms it

[Sailsa]

Microsoft has confirmed the leak.... According to the Associated Press in this article http://www.sunherald.com/mld/sunherald/business/79 41292.htm Microsoft Corp. said late Thursday that portions of its Windows source code - the tightly guarded blueprints of its dominant operating system - had been leaked over the Internet. Microsoft spokesman Tom Pilla said in an interview with The Associated Press that some incomplete portions of the Windows 2000 and Windows NT4 source code had been "illegally made available on the Internet."

Re:Microsoft confirms it

[Doyle]

Backed up here: "Microsoft Corp. on Thursday confirmed that the source code for two versions of its Windows operating system has been leaked"

Re:Microsoft Confirms it

[TeachingMachines]

Juicy quote: "Frankly, I'd be more worried that someone was going to use this as a base for developing software or another operating system based on Microsoft's proprietary code."

Re:Microsoft Confirms it

[utahjazz]

From the article:
Windows source code file being traded on the Internet appears to be roughly 660 megabytes in size. That is far short of the estimated 40 gigabytes of data that makes up the entire 40 million lines of code in the Windows operating system.

I guess this journalist is assuming each line of windows code is a thousand characters long, and the compression ratio of zip is 1:1. I expect about as much of tech journalists. They spell great, but can't do 3rd grade math.

40 million lines of code
== about
800 million characters (20 chars per line)
== about
800 million bytes (it's ascii)
== about
800 MB
== about
100 MB compressed

The file I see is about 220 MB. If anything, it's too big.

Re:You can't be serious!

[TrancePhreak]

What about all the companies that don't have the time, money, and resources to make any sort of switch? Companies with lots of proprietery code, or programs that originate from very old platforms. Think before you post idiocy ;)

Re:I have it.

[najay]

TROLL - lol.

Coincidence? I think not...

[Kinesthe]

"Slashdot...let's see...NASA...the FCC...Windows source code leaked?!"

[click]

A fatal exception OE has occured at 0028:C001539A. The current application will be terminated.

"...what the hell?"

( meanwhile, deep inside Windows... )
if( sourceLeaked == true && url = "slashdot.org")
{

BSOD();
SendEmail( "bgates@microsoft.com", "IP of teh L1n|_|x haxx0r: "+userIP );

}

Re:Bogus Bogus Bogus -- MS confirmed it's real

[ka55ad]

MS has confirmed that the code is real. Story here (washington post).

Transcript, before it gets Slashdotted...

[Kinesthe]

Microsoft Confirms Windows Code Leak
---

Microsoft Corp. on Thursday confirmed that the source code for two versions of its Windows operating system has been leaked, a security breach that could give hackers important intelligence about how to exploit flaws in software run by most of the world's computers.

"Today we became aware that incomplete portions of Windows 2000 and NT 4.0 source code was illegally made available on the Internet," said Microsoft spokesman Tom Pilla. "It's illegal for third parties to post Microsoft source code and we take that activity very seriously."

Pilla said the company does not know how much of the operating system code was compromised, but he said Microsoft believes it was not a complete version of either operating system.

There was no indication that the code was stolen through a breach of Microsoft's internal network, Pilla said. He said the FBI is investigating the matter.

Computer security experts said the release of Windows source code could pose a significant threat to Internet security, depending on what portion of the code was leaked.

A leak of any portion of the Windows code "could dramatically increase the probability that new zero-day vulnerabilities will be found," said Alan Paller, director of research the SANS Institute, a security training group based in Bethesda, Md.

"Zero day" exploits are highly effective attacks that occur when hackers discover a way to exploit a security vulnerability before or at the same time as a software maker learns of the flaw. Attackers can then use this information to launch a virus or worm that exploits the security hole before a patch can be released to fix the problem.

Thor Larholm, senior security researcher at Newport Beach, Calif.-based PivX Solutions, said the Windows source code file being traded on the Internet appears to be roughly 660 megabytes in size, about the size of one CD-ROM's worth of data. That is far short of the estimated 40 gigabytes of data that makes up the entire 40 million lines of code in the Windows operating system.

Even a partial leak "is a potentially very serious problem for Microsoft," Larholm said. "Just look at the vulnerabilities that are discovered by people who didn't have access to the source code."

The origin of the leak is not currently known. The Redmond, Wash.-based software giant closely guards the computer code that comprises the company's operating system. But Microsoft does license portions of its programming code to security researchers and more than 50 universities under its "Shared Source Initiative."

Microsoft last year said it would began sharing complete copies of its source code with governments around the world that want to validate the security of the software before deploying it in national defense and other sensitive areas. Microsoft signed an agreement in 2003 that lets the Australian government inspect the source code of Windows 2000, Windows XP and Windows Server 2003. Other counties, including India, are exploring similar arrangements.

Unlike open-source software like the widely used Linux operating system, the code comprising Microsoft's Windows software is not open for public inspection. Linux users are encouraged to participate in an open, continuous cycle of modifications and upgrades that its proponents say results in systems that are more secure and reliable than those powered by proprietary code like Windows.

Re:Transcript, before it gets Slashdotted...

[Jugalator]

"Just look at the vulnerabilities that are discovered by people who didn't have access to the source code."

Yeah, but that's only because you guys haven't woken up. Look around you and see how to make an OS that doesn't suffer from source code access. There are plenty of such operating systems around you, one quickly rising as a serious competitor.

But this is all kinda like the RIAA problem. Like telling a wall about problems, since their entire business model has a serious problem with it. Only time will tell if RIAA and/or MS will still survive in the future.

The future of open source software definitely seems more safe anyway.

Re:Transcript, before it gets Slashdotted...

[AtomicBomb]

appears to be roughly 660 megabytes in size, about the size of one CD-ROM's worth of data. That is far short of the estimated 40 gigabytes of data that makes up the entire 40 million lines of code in the Windows operating system
40GB of data for 40MLOC??
It equals to an average length of 1000 bytes per line of code. It is pretty damn hard to read without a 52" inch monitor :p

I guess it is more like 4GB of source code....
Take the linux 2.6 kernel as an example: compressed size about 30MB, uncompressed size about 200MB.... If a compression ratio of 6 is reasonable, it may be possible to compress the 4GB windows source code into a 660MB zip file....

Re:Bogus Bogus Bogus -- MS confirmed it's real

[Binary Air]

I don't doubt that some source has been "outed", but the entire base...or even a critical part of the base. I don't think so. Cheers!

Re:It's a TRAP!!! /Adm. Ackbar

[Lord Kano]

Probably not, but it would be trivial to show similarity in two binaries if you know where to look.

A similarity won't be enough to get a favorable decision in court. You need to prove infringement. Without being able to legally introduce the source, that isn't going to happen.

LK

Not a big deal

[Binary Air]

"Thor Larholm, senior security researcher at Newport Beach, Calif.-based PivX Solutions, said the Windows source code file being traded on the Internet appears to be roughly 660 megabytes in size, about the size of one CD-ROM's worth of data. That is far short of the estimated 40 gigabytes of data that makes up the entire 40 million lines of code in the Windows operating system." [WashingtonPost.com}

Re:Not a big deal

[PingPongBoy]

40E6 lines of code = 40E9 bytes

That is 1E3 bytes per line!!!!

Code like that should be released for the sake of art.

xbox screwed???

[Anonymous Coward]

IIRC, isn't the xbox kernel and subsystem based on windows 2000? does that mean if kernel level vulnerabilities are discovered, the xbox is at as much risk as nt/2000/xp/2003?

Microsoft Confirms the leak!

[BondGamer]

The washington post is reporting Microsoft has confirmed this is indeed part of the Windows source code! http://www.washingtonpost.com/wp-dyn/articles/A376 48-2004Feb12.html

awesome! now we can finally port..

[eyeareque]

Woohooo now someone can finally port win2k over to *nix.. oh wait.. nevermind.

It's official...

[Metroid72]

I guess MS confirmed: http://www.msnbc.msn.com/id/4253584/ From the MSnbc website.

Ssshhh

[Anonymous Coward]

ssssssshhhhhhh!!!!!!!! Don't tell anyone I'm downloading the Fedora Core 2 Beta source code right now. Some silly bastard put it up on their FTP server; they're gonna feel pretty stupid when they realize it.

President GWBush

[SubtleNuance]

"Iraq has tonnes of ready-to-deploy WMD. No doubt. You will see, we must go now. If we dont, these filthy heathens will attack us. Anyone who disagrees is a terrorist spreading lies, lies, lies interested in exposing America to danger."

Re:President GWBush

[SubtleNuance]

im paraphrasing. your not suggesting that this WASNT his exact message? Do you have a memory or has the Dept. of Newspeak gotten to you?

Re:It's a TRAP!!! /Adm. Ackbar

[cbreaker]

No way.

If you're working on a windows-compatibility software, what better way to learn API's, how things are processed, etc...

I say LOOK, learn, but don't cut'n'paste code.

Re:You've got to be shitting me

[Bendebecker]

That's my point. You can compile 300 gb of source into 600 mbs of binary if the source has a whole lot of white space (or a very verbose syntax like COBOL.) I was trying to be funny.

Lets be realistic

[Anonymous Coward]

Without being arrogant in anyway, we really need to keep in mind we aren't looking at a mom and pop company here.

I highly doubt this will be the almighty downfall everyone thinks it is going to be. Try to keep in perspective that if this is true (and I have some pretty serious suspicions it isn't) if it costs MSFT $100 000 000, do you think they will even notice? Well maybe a bit but by fiscal 2005? I doubt it.

The source for NT will be useless for any kind of exploit in a year because support will be removed by then and the attitude in that end of the pool has been keep up or fall behind. And yes I do recognize the sickening number of them out there, I support the bloody things.

As for 2000, keep in mind that Linux may have 10 million developers constantly surveying the code on a part time basis, but they all have other jobs. MSFT has thousands of full time employees they can throw at one patch (in a pinch) that will deal with all of this.

Or maybe all the opportunists out there should look at it from a conspiracy theory point of view? Maybe they wanted this to happen.... (btw I love starting rumors) That oughtta keep people entertained for atleast a few terraflops.

In the long run it won't even phase them, and always remember that even if Linux/Unix/Novell(-laugh) ever wins out; they will then be the top dog and will subsequently be the center of scrutiny. Bias is based on prejudice, which is generally malfounded.

Remember....conspiracy theory....stay up all night tonight thinking about it....then show up late for work tomorrow...and get fired so you can work more open source code.

(btw the teeshirt and sunblock example was really shotty)

Open Source Community Compared to Car Bombers..

[pini0n]

In the above mentioned link, the following "observation" is made:

"With the open source community, there are a large percentage of tinkers and 'ankle biters' who are trying their hand at hacking. Some are even communicating with each other. So it only takes one or two of these groups sharing information to be able to pull something off. When you have this type of passion, it's hard to fight because these people are like virtual suicide car bombers."

Interesting choice of comparisons, if you ask me.

Tracker (dead.)

[algeliten]

Hmm. That's my tracker. And it's dead now. I probably should learn to not have a public tracker.. *sigh*

Anyway, at least 1000 people got it down, so it shouldn't be too hard for some of them to make a new torrent. But I'm definetly not going to host it anymore.

--
alge of flauna
http://alge.nlc.no/

Not many more posts...

[mj_1903]

Not many more posts and this story is in the hall of fame. It's funny the ability of /.'ers to whip any Microsoft story into a tempest that dwarves anything else important that day.

Re:PATRIOT implications

[Anonymous Coward]

YEAH! ummm. actually, and this may sound silly to some, but don't we gain knowledge through the sharing of ideas? criminals would do like microsoft and repackage code under a different name and sell it for profit.

original quote

[MegaFur]

ELWOOD: It's a 106 miles to Chicago, we've got a full tank of gas, half a pack of cigarettes, it's dark, and we're wearing sunglasses.
JAKE: Hit it.

ref: http://www.imdb.com/title/tt0080455/quotes

...but it's just text

[Anonymous Coward]

The main branch you were looking at probably wasn't compressed right? If you tarballed the entire thing you could probably get it down to significantly less than 20GB.

SNippets of Code: Yes this is REAL DAHm!!

[Anonymous Coward]

\windows_2000_source_code\win2k\public\sdk\inc\icm .h /*++

Copyright (c) 1996-1999 Microsoft Corporation

Module Name:

icm.h

Abstract:

Public header file for Image Color Management

Revision History:

--*/

#ifndef _ICM_H_
#define _ICM_H_

#if _MSC_VER > 1000
#pragma once
#endif

#ifdef __cplusplus
extern "C" {
#endif // // Support for named color profiles //

typedef char COLOR_NAME[32];
typedef COLOR_NAME *PCOLOR_NAME, *LPCOLOR_NAME;

typedef struct tagNAMED_PROFILE_INFO{
DWORD dwFlags;
DWORD dwCount;
DWORD dwCountDevCoordinates;
COLOR_NAME szPrefix;
COLOR_NAME szSuffix;
}NAMED_PROFILE_INFO;
typedef NAMED_PROFILE_INFO *PNAMED_PROFILE_INFO, *LPNAMED_PROFILE_INFO; // // Color spaces // // The following color spaces are supported. // Gray, RGB, CMYK, XYZ, Yxy, Lab, generic 3 channel color spaces where // the profiles defines how to interpret the 3 channels, named color spaces // which can either be indices into the space or have color names, and // multichannel spaces with 1 byte per channel upto MAX_COLOR_CHANNELS. //

#define MAX_COLOR_CHANNELS 8 // maximum number of HiFi color channels

Re:SNippets of Code: Yes this is REAL DAHm!!

[RugbyHoe]

This is not proof - you can get icm.h with any version of Visual C++ (along with at least 750 other assorted MS header files and static libs). If you are going use code snippets as evidence of proof that you have the 'REAL' source you would probably want to post something that is not in any of the freely available SDK's.

Way to set back the rest of the world

[BroncoInCalifornia]

Maybe Microsoft wants us to copy the code. That way Open Source stuff will be as fucked as Microsoft code!

Confirmed by Microsoft

[Kalgash]

See The BBC News for more details.

My favourite quote:

"But Microsoft's president and chief executive, Steve Ballmer, insisted they had not been able to tamper with any of the company's key programs."

Open Source bashing

[leicaM6]

On an article at internetnews.com there is a paragraph that says: "Up until now it was more like the 70/30 rule, where 70 percent of the threats are bogus. Now it's more like 50/50," Didio said. "With the open source community, there are a large percentage of tinkers and 'ankle biters' who are trying their hand at hacking. Some are even communicating with each other. So it only takes one or two of these groups sharing information to be able to pull something off. When you have this type of passion, it's hard to fight because these people are like virtual suicide car bombers."

A smoking gun?

[meadd00d]

If that's true, it's fairly interesting. Mainsoft makes cross-platform products to run Windows apps on Unix (and Linux), and Elaya Alaluf is their VP of Technology. Link Circumstantial evidence that the leak originated at mainsoft. (they could have been hacked from outside, of course.)

Trade Secret?

[sterno]

Um, I can download it on the Internet. I don't think it's a trade secret anymore.

Windows 2000 Bah!

[twoslice]

This article has almost 2000 posts. I wonder what the /. record is?

Re:Windows 2000 Bah!

[metallicagoaltender]

Check the Slashdot Hall of Fame

It's 4183 comments to "Strike On Iraq"

A TRAP?

[polkadotduck]

How about some rationality (and consistency) here guys. If simply being in the same room as a copy of the windows source code is sufficient to contaminate everything you write from that point on, then SCO is gonna win its court case for sure. After all the IBM AIX code it contributed to linux was written by people who had seen the SYS V source code. Yes?

Some advice

[NXprime]

For all you kiddies who like to leave your computers on all the time, I'd suggest that you don't. This possible source leak worries me quite a bit. :/

Halfway there?

[di0s]

Now it's "opened source".

Maybe... Maybe not...

[sterno]

I had a discussion with somebody the other day about how you could implement an API if the only documentation of the API was in source code. You have the source code available, but it's under terms that do not let you distribute it for whatever reason.

Theoretically, you can do a clean room implementation by having one person read the source code and write a specification for the implementation. Then that person hands the specification over to somebody else to implement. Thus there's no copying and it's still clean.

But like I said, THEORETICALLY :)

Re:It's a TRAP!!! /Adm. Ackbar

[gagy]

That's great. Now prove it, beyond a shadow of a doubt, in the court of law, that I have at some point LOOKED at MS source and then programmed some open source API.

instances of "fuck"

[Anonymous Coward]

$ grep -r -i fuck *
bsc/.glimpse_index:fuck?sMP
bsc/.glimpse_index :fucks?sMx
bsc/.glimpse_index:fucked?sM`
bsc/.gl impse_index:fucking?sMj
private/shell/applets/wel come/html/webapp.cpp: // HighContrast mode is turned on. This totally fucks our style sheet as most of it will
private/shell/shell32/copy.c:// want to fuck with.
private/shell/shell32/util.cpp:// the fucking alpha cpp compiler seems to fuck up the goddam type "LPITEMIDLIST", so to work
private/shell/shell32/util.cpp:// around the fucking peice of shit compiler we pass the last param as an void *instead of a LPITEMIDLIST
private/shell/shell32/util.h:// the fucking alpha cpp compiler seems to fuck up the goddam type "LPITEMIDLIST", so to work
private/shell/shell32/util.h:// around the fucking peice of shit compiler we pass the last param as an LPVOID instead of a LPITEMIDLIST
private/windbg64/debugger/tl/remote/ shell/windbgrm .c: // The user fucked up
private/windows/media/avi/verinfo.16/verinfo.h : * !!!!!!!!!!!!!!DOING SO FUCKS THE BUILD PROCESS!!!!!!!!!!!!!!!!
private/windows/shell/con trol/midi/map.c: // !!!this is fucked if a map goes to multiple physical devices

Re:instances of "fuck"

[oshy]

At least they use comments in their code.

Code leak?

[linuxpyro]

Does this mean that Windows will actually get better?

Half-Life 2 Source

[JackpotMonkey]

This sort of arguement arose when the Half-Life 2 source code was leaked, Although they do not beleive that it is right to feed the corperate machines with money they will never see profit from (such as a guy dl's photoshop because he just wants to play around with it but never make a profit with any work done on it) they do beleive that the source code of closed source material should stay that way as it is a direct attack on the complete work, one could say that while Joe Smhoe downloads the Windows Longhorn alpha and uses it on his box he is still not infringing on the hard work of the programmers and the money that m$ has spent to develope it because he will never buy it, he would have never bought it where as the source code is the direct reflection of the work of a programmer which will inevetably be reused by someone without their idea of moral direction. That photographer doesnt feel he should pay for something he wont profit from, now while the company may not like that and if they were to catch him would have every right to prosecute, the guy with the source code to that app is 1000x more dangerious because he can use it as he sees fit. Well enough of my rambling...

During an election year?

[bergeron76]

Am I the only one that thinks this is a STRANGE coincidence, considering that we're only a few months from electing the MOST POWERFUL MAN IN THE WORLD using UNAUDITABLE-US-GOVERNMENT-APPROVED, WINDOWS 2K and NT VOTING MACHINES?

For the sake of FAIRNESS, incormation about Microsoft Government Lobbying can be researched here
[28,000+ results].

Look at how far we[the US]'ve come in the past 4 years:
DMCA
CAPPS
UCITA
etc...

Just think of what another 4 US Republican years can offer!

During the last Democracy "the Clinton era" all we had to worry about were sex and drugs; and the proliferation of the internet, and technology, etc - but I digress...

To Bush's credit - he does have a few accomplishments under his belt: As "Commander-in-Chief" (did he serve in the military?), we did observe the most destructive attack EVER in in US history.

He made up for it, however, by sending several hundreds of Americans to their DEATHs (as of Feb. 2004) (about 25% of those that died on Sept. 11th), to protect us from [as of now] UNDISCOVERED Weapons of Mass Distruction.

I feel much safer now.

Be very afraid people... November is going to bring about some SERIOUS fireworks in the US. If you're not a US citizen, don't fret; because your country will surely be next.

Microsoft's source code "leak" is only the beginning.

Re:PATRIOT implications

[Anonymous Coward]

All your FBI friends can come by here and have a nice cup of tea.

ed2k://|file|windows_2000_source_code.zip.torrent| 16496|5506C49CCCA12204BAB6FE960CE5602C|/

hack in the box says its authentic but stunted

[pini0n]

This hack in the box article quotes a security expert as saying:

"It looks real," he said. "You can't build Windows, however. It's just a bunch of chunks of the operating system."

From the article..

The 203MB file contains the code that appears to be from Microsoft's enterprise operating system, but the code is not complete, said Dragos Ruiu, a security consultant and the organizer of the CanSecWest security conference, who has examined the file listing.

Confirmed by MS

[k4_pacific]

AP article on yahoo news here.

See Shit.
See fan.
See shit hit fan.
Duck!

Best Thing For Microsoft

[warbirdnut]

Maybe they should open source 2K and NT now. Perhaps there are Windows programmers all over the internet what would work for free making Windows better! Did anyone scan the Windows source code for SCO IP? Oh silly me, Microsoft is protected. They bought a license didn't they. :D

Re:It's a TRAP!!! /Adm. Ackbar

[Curtman]

I find that really hard to believe. Look at whats happening in the SCO case. They have no proof, and IBM will turn over the AIX source. Apparently the accuser doesn't need a whole heck of a lot of proof to get that source introduced legally.

DON'T

[Xenographic]

If you ever plan to write anything open source, I suggest you never look at it. I never will. Why? If your code bears any similarity to theirs, it might be construed as though you'd copied something from them.

It's probably illegal anyhow, in any country that has signed the Berne convention (e.g. almost everywhere), to even possess a copy. Yes, yes. I know. Win32 API stuff doesn't look much like Linux code, etc. etc. But what if Microsoft pulled a SCO? That may sound paranoid, and it probably is, but all you have to do to avoid that risk is nothing. That's a rather small price to avoid a large risk.

I know that I once had one sentence, out of a rather long assignment that, for whatever reason, was worded a bit oddly. Someone else managed to say almost (not quite) the same thing. I couldn't prove that I hadn't copied anything. I suffered for it.

You don't have to suffer. Don't do it. Don't look.

Re:DON'T

[Pathwalker]

Hmm - I wonder if the new form of trolling (now that goatse.cx is no more) will be posting bits of windows source code in comments.

I'm sure there are some parts in there that pretty offensive (nasty bugs, buffer overflows, etc...) , plus the viewer is then contaminated by having seen it, and code they write in the future has to be considered tainted...

Re:DON'T

[RGRistroph]

Where do you learn about copyright law ?

It is not against copyright law to possess a copy. It's the COPYING that is controlled, you know, like how it's named COPYright ? Perhaps possessing copies might in some cases be used as evidence that you were copying, but this seems unlikely in the case of this code.

Also, even if you don't look at it, you can't prove that you haven't. As you say, " couldn't prove that I hadn't copied anything. I suffered for it." What suffering will we save ourselves by not looking ? Microsoft will file suits not based on the facts of how their copyrights were infringed, but on their perceptions of how we are cutting into their bottom line. So you can expect that after the SCO stuff winds down (which is financed by a company owned by Melinda Gates buying the stock SCO insiders keep dumping) a new type of legalistic terrorism will be brought into play.

Finally, it's not against copyright to look at someone else's code, and then write your own. Do you think musicians avoid listening to the radio ? That novelists don't read novels ? It is against the law to steal someone's trade secretes, so if there are trade secretes in this code, someone could be in for Federal criminal penalties as well as civil damages. On the other hand, once public, trade secretes are no longer trade secretes. On the gripping hand, who wants to possibly encourage purposeful leaking of other people's code by producing great stuff from the product of such a leak ?

Clippy?

[berkut1337]

What? No source code of Clippy? :(. I think I'll pass..

How come nobody did this joke?

[tekrat]

Source Code to Windows Kernel:

include(QDOS); # written by Tim Paterson of Seattle Computer Products.
include(doublespace); # actually Stacker, we stole the code.
include(ie); # actually spyglass, we licensed it and then later just stole the code.

Let's see how many people get the joke...

Microsoft Confirms it

[loconet]

It seems like they've confirmed that indeed, part of the OS's have been leaked.

source:
http://www.washingtonpost.com/wp-dyn/articles/A376 48-2004Feb12.html

"The Source" :)

[Anonymous Coward]

Security bugs.. Nah...
$ grep -r strcpy -i . | wc
10454 42054 1069145

Where it was ganked from:
There is a core dump file inside the windows 2000 (sp1) archive, it clearly shows that the source was stolen from a system at Mainsoft. The following url confirms that they did have access to the leaked code. http://mainsoft.com/news/press_releases/2000_3_22_ 01.html

The actual strings which confirm this:

PWD=/usr/ms/win2k_sp1/private/security/msv_sspi
DOMAIN=mainsoft.com
REPLYTO=eyala@mainsoft.com
ORGANIZATION=Mainsoft Co. Ltd.
MWBATCH_SERVER=lod:8000
MSOFTLM_HOST=@xor
MAINSOFTLM_HOST=@xor
XAPPLRESDIR=/il2/users/eyala /app-defaults
EDITOR=vi
BASE_LIBPATH=/usr/lib

Re:"The Source" :)

[FUF]

DEFINITELY mod this up :)

Re:"The Source" :)

[CoolVibe]

Where it was ganked from: There is a core dump file inside the windows 2000 (sp1) archive, it clearly shows that the source was stolen from a system at Mainsoft. The following url confirms that they did have access to the leaked code. http://mainsoft.com/news/press_releases/2000_3_22_ 01.html

Odd... That page doesn't exist anymore, and suddenly (according to their press page), nothing happened in March 2003.

Guess who's in save-my-butt mode? :)

Re:"The Source" :)

[Anonymous Coward]

Actually the page exists... Note a space in the url, you have to remove it, the press release is still there:

Mainsoft(TM) extends strategic relationship with Microsoft(TM)
Leading provider of cross-platform solutions for the enterprise to offer enhanced computing capabilities for the Unix environment; New source code available for CAD/CAM and Visual Simulation markets
SAN JOSE, Calif. - March 22, 2000 - Mainsoft Corporation, the leader in cross-platform solutions for the enterprise, today announced expanded terms of their WISE agreement with Microsoft Corp. The WISE agreement, signed in 1998, provides Mainsoft access to source code for Windows NTO including the recently released Windows 2000. As part of the new terms, Mainsoft will receive additional source code for Windows to provide advanced graphical capabilities for industries, specifically the CAD/CAM and Visual Simulation markets, that require this functionality on Windows and Unix. Today's announcement underscores the two companies' commitment to cross-platform support of Windows-based applications through the Win32 APIs.

Mainsoft's receipt of additional source code for Windows will provide leading technology capabilities for developers who rely heavily on extensive graphics applications. Based on Extensible Scene Graph (XSG) technology, Mainsoft will enhance graphic technology applications on Unix for the CAD/CAM and Visual Simulation industries. As the first deliverable of the "Fahrenheit" initiative, Microsoft's XSG technology offers modeling capabilities to provide a higher level of programming for developers to create consumer and professional 3D applications. XSG provides high-level data structures and algorithms that increase overall graphics performance to assist the development of sophisticated graphics-rich applications.

"We're excited to continue to work closely with Mainsoft to deliver customers advanced graphics technology," said Jeffrey Friedberg, Graphics Program Manager at Microsoft. "Our collaboration will extend XSG functionality to customers who require the advanced graphics technology in a cross-platform environment. We are looking forward to joining forces with Mainsoft on projects for the CAD/CAM and Visual Simulation industries. "

"Since 1994 when our relationship began with Microsoft, Mainsoft has delivered to the software development community a Windows platform for the Unix operating systems," said Yaacov Cohen, president of Mainsoft. "The availability of this new code launches the next logical stage in our alliance: into a new vertical category where we can offer our expertise to developers along with the Win32 APIs to work on Windows NT and port to Unix."

Through its relationship with Microsoft, Mainsoft has had access to the source code for Windows to provide a Windows platform for Unix, called MainWin. This is the leading technology infrastructure for Independent Software Vendors (ISV's) and IT professionals to re-host Windows NT-based applications onto the Unix and Linux platforms. By utilizing MainWin, companies have the power to develop software on the Windows NT platform and deploy it to several different operating environments simultaneously.

etc etc etc

Re:"The Source" :)

[CB-in-Tokyo]

http://www.mainsoft.com/news/press_releases/2000_3 _22_01.html works... and there is always the Google Cache

Re:"The Source" :)

[astaines]

The URL is wrong. The Wayback machine says that Mainfsoft press releases looked like this in 2000.

/www.mainsoft.com/press/pr-pcl.html (for example)

There's no March 2000 press release confirming MS access to Mainsoft source code, although Mainsoft did have access to MS source code, and MS may well have had perfectly legit access to Mainsoft code in return.

Re:"The Source" :)

[Zeddicus_Z]

Unfortunately for them, Archive.org doesn't really care for corporate PR

The Evidence

Beautiful

Re:"The Source" :)

[Anonymous Coward]

Odd... That page doesn't exist anymore, and suddenly (according to their press page), nothing happened in March 2003.

You fucking morons who can't even link to a URL properly nor follow the slashdot mangled ones, here is the correct link - http://mainsoft.com/news/press_releases/2000_3_22_ 01.html

For fuck's sake learn some basic HTML. Slashdot adds a space in URL's normally to stop them from linking so you have to use the proper HTML tags for URL linking to work.

Re:"The Source" :)

[Anonymous Coward]

You can also view http://www.formulasystems.com/press/2000/pr032200. htm

Re:"The Source" :)

[NickFortune]

Through its relationship with Microsoft, Mainsoft has had access to the source code for Windows to provide a Windows platform for Unix, called MainWin. This is the leading technology infrastructure for Independent Software Vendors (ISV's) and IT professionals to re-host Windows NT-based applications onto the Unix and Linux platforms.

So we're supposed to think this is the source of MainSoft's unix based windows platform? Which microsoft helped them develop by giving them access to their source code - such is the depth of MS' commitment to enabling companies to migrate away from windows...

This smells fishier the more we learn about it

Re:"The Source" :)

[soybean]

here is the google cache

Re:"The Source" :)

[Westech]

REPLYTO=eyala@mainsoft.com

eyala is sooooooo fired!

Re:It's a TRAP!!! /Adm. Ackbar

[Ironica]

Not necessarily. You'll never get a court to admit stolen source code as evidence.

No, but you could subpoena specific sections of the code based on what you learned from the stolen source...

Announce: New OS Project Starting

[Beavis!]

I would like to announce a new open source OS project I am starting. Being a big fan of OpenVMS and DCL, I decided to use some of the basic concepts behind that OS as the model for this project. However, I think the DEC Windows GUI for OpenVMS is a little long in the tooth, so I am proposing something a little more up to date. It's not Linux or Unix based because those OSes have already had a lot of open source activity. It will have limited POSIX compatibility. Previous versions (last night), I experimented with had OS/2 compatibility, but you know how it goes... you need to have the apps to warrant the support. I've already got about 660 Megs of code that I wrote since I received my inspiration and will provide a torrent link to it soon. Anyone intersted in the project, please respond here as I haven't yet set something up at Eba^H^H^H^H^HSourceforge. I look forward to a speedy development phase. I think this OS could be the first open source OS to be ready to go to market in a very short period of time. Boy am I excited!

Re:It's a TRAP!!! /Adm. Ackbar

[Trejkaz]

Bullshit! SCO took ages to produce a few measly header files, and Microsoft have produced the source code for their entire product! ;-)

IT'S OFFICIAL: Microsoft Confirms Leak

[Anonymous Coward]

AP
Washington Post

GNU Makefiles and autoconf

[bangular]

A bit hypocritical for them to use autoconf and GNU style makefiles don't ya think?

Re:It's a TRAP!!! /Adm. Ackbar

[Ironica]

Or, better, get someone who can read C(++?) but can't write it to describe the functions that are implemented, what arguments they take etc. and then get the main team of coders to implement it. I'm pretty sure descriptions of code have been found to be protected speech.

I know! Let's get a team of folks working on the Windows 2000 Source Haiku!

Conspiracy anyone?

[i3rainchild]

This sounds like a really good way to distribute a linux virus, now that every linux user out there is downloading and potentially compiling it.

Re:It's a TRAP!!! /Adm. Ackbar

[AstroDrabb]

What laws are you basing your comments on? I was under the impression that it is against the law to DISTRIBUTE a copyrighted work, not to look at it. Can the RIAA sue me for listening to a song I hear on my friends CD player if I have not purchased the song? Of course not. I also do not think it is illegal to use the knowledge you may gain from seeing the source code. Unless of course that knowledge is covered under a patent. I am not a lawyer and can be completely off-base here.

The other thing is that MS would have to PROVE that you did see/use the source code. You can just say that you reverse engineered it.

Of course it is illegal to USE the source code. So if some wine guy goes and plops down a chunk of MS's source code into wine, then yes, that would be illegal. I am not sure if it would be illegal for some wine guy to look at the code and use some of that knowlege gained that is not under a patent in wine. Think about this. I can walk into a book store and read through a book. I can later write a book with that very same theme and I have not broken any copyright laws. What I cannot do is copy the book verbatim or distribute that as my own work.

I am under the impression that copyright laws do not prevent you from creating a work based on knowledge of another work. As long as you do not use the original work verbatim. I can go and create a movie called Planet Wars with a lead character named Duke SlyStalker based on a very similiar theme as Star Wars. I can write a book with a theme just like LOTR with trolls, hobbits, elves, dwarfs, etc. I can paint my own version of very famous paintings. I can make music that sounds like other popular music.

I don't see what legal case MS would have against someone who viewed their source code and made an application that used that knowledge, again, as long as their is not a patent covering what you are re-creating. The only way I can see MS having a legal case is if you signed an NDA with MS.

*Note*: I am not a lawyer and I can be completely wrong about copyright laws.

Can you say supoena the "web logs"?

[eyegor]

Imagine how Micro$oft might react they could prove you'd seen their code and possibly transfered "valuble intellectual property" into open source software.

I don't have a large legal staff on hand, so I think I'll pass on my own personal copy of the source.

Re:User friendly

[IgnoramusMaximus]

Your error lies in your unfounded basic assumptions that were beaten into you by decades of social manipulation and brainwashing. Let me spell it for you: Information Is NOT Property. I wont go into a huge tyrade here, let it be said that the fact most media and seemingly reasonable people believe otherwise does not change the fundamental equasion: information = thought = parts of our very souls. If you allow information to be "property", you propose the most evil and insideous kind of slavery ever conceived, where our very thoughts can be owned and controlled (their material expression at the moment - for now...) by others.

GPL is a defensive mechanism that exists only because the playing field is so tilted in the favour of would be slave masters that its almost vertical. GPL is a clever exploit, in essence a legal trick guaranteeing freedom to some slaves by twisting and abusing the very words of the paperwork that makes them "property" to their slave-master.

One thing's for sure.

[Yecti]

Microsoft will be downloading more Linux distros than anybody else on the planet as of this leak. Full or not, I have a sneaking suspicion Microsoft will be begging for an SCO claim.

More to Come?

[Czmyt]

So it sounds like someone posted 600MB of the 40GB that is the source code for Windows 2000 or Windows XP. I wonder how long before they release the rest of it?

Re:More to Come?

[Boltronics]

More than 40Gb. To be exact...
1.4% of sorce code leaked, which is 600Mb worth:
x1.4 = 600
x = 600/1.4 = 428.5714 (in Mb - 1% of total Windows code)

428.5714 * 100 = 42857.1429 (in Mb)

42857.1429 - 600 = 52257.1429 (in Mb) = 41.2667 (in Gb)

Microsoft going open source

[subzero_ice]

What if this were not an accident but an attmempt by Microsoft to go open source. There are people who would work towards improving Windows, if the source was available. So this way they will become open source and wouldn't have to admit defeat.

Re:It's a TRAP!!! /Adm. Ackbar

[cbreaker]

Looking at the code and gaining some insite and knowledge to the inner workings of MS software, and using that knowledge to incorporate into your own product, may be illegal.

But, it happens all the time. ALL the time. You think the programmers at MS haven't poured through the Linux code? If what you say is correct, then Windows must be littered with Linux code just because they studied and learned something from it?

There's a line between reverse engineering and access to source code; but you're unlikely to prove something wasn't reverse engineered unless you copy and paste the code.

It may be unethical to use leaked MS code to improve your compatibility solutions, but with all the underhanded and generally nasty things corporations are doing, it's just more of the same..

And about your comment about the "IBM PC BIOS." Not even close. Proving that you copied a 256kbit bios is a lot easier then proving you used information learned from studying 50 lines of code out of 40GB...

Hey, I'm no saint in real life.. no need to be one online.

More info. from Betanews

[Anonymous Coward]

The claimed Windows 2000 source code archive contains 30,915 files totaling approximately 13.5 million lines. The source is dated July 25, 2000, placing it after the official release of the operating system, which was rumored to contain between 35 and 50 million lines of code in its entirety.

Early references to "Whistler" -- the code-name for Windows XP -- can be found in the files, which is consistent with the post-Windows 2000 time frame. An internal alpha version of Whistler leaked in March 2000.

A Microsoft spokesperson told BetaNews that the company was looking into this as a matter of due diligence. "At this time, all we have to say is the rumor regarding the availability of Windows source code is based the speculation of an individual who saw a small section of un-identified code and thought it looked like Windows code," the spokesperson said. "If a small section of Windows source code were to be available, it would be a matter of intellectual property rights rather than security."

Sources indicates the leak is valid, but incomplete. Comments -- which are added to track changes to source code during development -- refer to specific bugs, Microsoft employees, and even organizational charts. Product code names are abound, with references to Daytona, Cairo, and Memphis, as well as beta timetables. The archive contains graphics files for Windows 2000 and Internet Explorer 5.0 included in resource files, according to sources.

Comments such as, "potentially off-by-1, but who cares..." are buried within code for the Windows Taskbar. Sources tell BetaNews there is no reference that calls Netscape developers "Weenies," as was alleged in court documents. Other comments range from mundane technical jargon to all out profanity.

More at http://www.betanews.com/article.php3?sid=107663251 5

Re:It's a TRAP!!! /Adm. Ackbar

[Tony-A]

Windows source code isn't like a virus or something.

Humerous but more than a little accurate.
Implicit in the source will be subtle assumptions about the way things work that are not precisely accurate. Once contaminated by these inacuracies, errors will be made.

It's not what we don't know that is the problem. It's what we know that ain't so.

Re:User friendly

[GoofyBoy]

Seriously, you are suppose to wear the aluminum foil hat, not chew on it.

Windows?

[goMac2500]

Is that that thing that comes with that Pinball program? Boy... the pinball is sure fun... I don't really need that extra garbage though...

wow....

[TeamLive]

you know, this wouldn't be an issue for microsoft if they actually made windows opensource. of course, hell would proboably freeze over first. that's OSS's greatest strength, project integrity is NOT compromised by project transparency. it's time software makers sold services, and not ephemeral products.

i wonder what redmond's reaction will be?

Who needs such abomination?

[Maljin Jolt]

It's perverse code!

Re:It's a TRAP!!! /Adm. Ackbar

[wdr1]

Actually I would conjecture that it is highly derivative of VMS, rather than UNIX.

After all, why else would they they shift the VMS letters forward one to get WNT (Windows NT)?

-Bill

Re:Microsoft source code leak? Pfft, that's nothin

[Gabrill]

So now both M$ AND Linux are open source, but Linux is profiting by it, and M$ is whining and crying about it. Bite back at the borg! You will be assimilated, too!

Anyone elses brain getting ready to explode?

[TyrranzzX]

Just wow. If the source code got leaked, Win2k will get exploited by...just holy jesus save us all. Seriously, the word "fuck" comes into my brain a million times over. Seriously, viruses much? Pron sites are going to have a field day spyware. Then of course you've got all of those shiney machines running embedded windows. The bar to hacking the planet has been lowered. Many good hackers like their steak n' potatoes and will not do anything real bad to screw up the net. But now if someone can get access to the win2k source code via p2p networks, holey moley. That script kitty with a little knowledge of whatever language windows is written in can really do some damage.

I mean, with linux there's a temptation but nobody runs it. With windows, everyone runs it.

Then you've got the consiracy theory: MS leaked it intentionally so they can get everyone to patch with their DRM system. Possible, but who's going to go after that when linux is here? DRM and years of MS abuse and domination, or a 1-time switch over with occasional retraining of employee's.

I mean, I like linux and all but this isn't the way to win at all. I thought we were going to slowly beat them back into submission and competition, not completly screw them and quite a few million over. Hell, I'm thinking of taking a few games and making some fakes on my boxen and getting guys to share MD5 hashes just to make them look more real.

Well, time to begin caching DNS entries to websites I use the most, and it may be high time to backup some of this data and close all the nat ports on my router just to be extra safe.

Talk about a digital pearl harbor, holey moley this isn't good.

Re:Anyone elses brain getting ready to explode?

[pandrijeczko]

Some perspective on your comments...

If the source code got leaked, Win2k will get exploited by...

Apparently the leak has been confirmed but it's some of the source code, not all of it. Only time will tell whether it's an important bit of source code.

I mean, with linux there's a temptation but nobody runs it.

You cannot think of Linux in the same way that you are thinking of Windows.

Two people who use a Linux system could be running entirely different systems with few or no common applications across the systems - this is why it is unlikely that something like a worm virus would propagate through the Linux community in the same way it would through the Windows community.

Linux is by no means immune from attack, but if one comes, it will be a particular application (e.g. Apache) that will get attacked and whether a specific Apache system is affected will depend on the version, what modules are loaded to allow things like CGI scripts, etc.

When you say nobody runs it, I agree it's a minority on the desktop but the applications that run on Linux (and the likes of BSD, Solaris, etc.) like sendmail, BIND, Apache, etc. are very widespread and a lot more so than IIS or Exchange in many cases.

MS leaked it intentionally so they can get everyone to patch with their DRM system.

Microsoft are an arrogant company and have no doubts about getting DRM through the door with the way they do things currently - DRM's success or failure is now simply based on the level of it's acceptance in the user base, nothing more.

If anything, a source code leakage would allow everyone access to how MS's DRM technology works.

Whatever the extent of the leak, MS will downplay it because to not do so will affect the share prices. There is no conspiracy theory here...

I mean, I like linux and all but this isn't the way to win at all.

There is no battle here. Linux exists despite Microsoft and offers an alternative way of doing things to Windows.

Microsoft may attack Open Source on a regular basis but the Open Source community does not care - it is just creating good quality, free software and defending it's right to do so. This will happen no differently with or without competition from Microsoft.

I thought we were going to slowly beat them back into submission and competition, not completly screw them and quite a few million over.

You're now implying that a member of the Linux / Open Source community stole the source code and I resent that.

No Open Source programmer cares about seeing MS proprietary code. To do so would run the strong risk of inadvertently incorporating MS code into an application and nothing would please MS more as it would allow them to send the copyright lawyers in.

The only thing the Open Source community will care about is if MS's code contains GPL code but I doubt even MS would be stupid enough to do something like that.

Well, time to begin caching DNS entries to websites I use the most, and it may be high time to backup some of this data and close all the nat ports on my router just to be extra safe.

Perhaps you'd also like to stock up your kitchen cupboard with canned food and make yourself up a tin foil helmet also...

If you haven't secured your router then I'm surprised you haven't been attacked already. Also, the core DNS system mainly runs on BIND & Solaris (so I'm led to believe) so it's unlikely that this would be affected.

In all honesty, you are being far too sensationalist at this stage and my advice is simply to wait and see what happens. I doubt it will be very much...

Re:Anyone elses brain getting ready to explode?

[Durzel]

I might be in a minority here, but I think this leak might ultimately prove to be a "good thing" in the medium/long term, for both consumers and Microsoft alike.

As frequent as Windows bugs seem to materialise nowadays I find it hard to conceive that the partial source release is going to contribute to a complete collapse of security and faith in the Windows operating system. The code might offer up a few previously unknown buffer overflow bugs, but the way some people are talking every single file has a vulnerability of sorts.

Perceptually if the worst happened and, say 50 critical vulnerabilities were found (complete random number) - once MS patch these, and have a more robust OS as a result, they're home dry. People aren't going to stop using Windows at home or in their offices - and if I were in MS' shoes I would much rather weather one particularly bleak storm, than hundreds of seperate ones. Every unique vulnerability that has been discovered recently has merited a brand new glossy editorial on most of the news sites - in PR terms they would look a lot better if they just fixed a large number of vulnerabilities in one go, then ended up bug-free for several months (as unlikely as that sounds).

Also, because of the proliferation of Windows and the sheer number of people who - particularly if anti-MS - will be aggressively looking for vulnerabilities, MS has essentially just got themselves a huge pool of free dev resource, some/most of which will probably respect their disclosure policy, to identify bugs in their OS.

Their only concern in my opinion is that of code theft, but Windows is so entrenched in consumer/business environments now that I'm not sure anything can realistically displace it.

Re:Anyone elses brain getting ready to explode?

[Jugalator]

Only time will tell whether it's an important bit of source code.

Code for the Windows Shell DLL (SHELL32.DLL) was leaked anyway, so was code for IE's rendering engine contained by MSHTML.DLL and a whole lot of the Windows network layer.

So there's some possibly exploitable stuff there to me..

Re:Anyone elses brain getting ready to explode?

[sudog]

"Perhaps you'd also like to stock up your kitchen cupboard with canned food" ... to be fair, this is a good practice regardless, in case of emergency, and especially if you live in a place where the weather can be a physical threat.

Re:Microsoft source code leak? Pfft, that's nothin

[Da_Weasel]

hahaha......

I'm an ass...

[xrayspx]

Where there are polar bears, there are no penguins, where there are penguins, there are no polar bears. I'm not sure exactly what the natural enemy of the penguin is, but my guess is it's something that lurks under the water and picks up a nice quick-swimming treat.

Aside from that ...

Re:I'm an ass...

[Ironica]

I'm not sure exactly what the natural enemy of the penguin is, but my guess is it's something that lurks under the water and picks up a nice quick-swimming treat.

Walruses, mostly.

Surprise me!

[mabhatter654]

I can hear bill now muttering "just fix it" and "surprise me" like the evil software monopolist in Antitrust....

Personally, whoever did this better turn themselves in NOW!!! Considering Bill and MS have enough money to buy souls on the open market...I'd be afraid, very afraid. I'd say leave the country, but forgieners are easier to buy than VP Cheney. It could be a good time for a sting to see if Billy G would actually pay a "bounty hunter" to track the leak down...If the culprit was found...well, not alive... just makes you wonder to test out how far billy would go to protect his baby... Just make sure the deal goes down in California!

Or would bill and steve finally get the fact that windows is JUST AN OS and MS just another company! and that he's got more money than GOD so it's time to let go of world monopoly and instead try to spend 100B before he dies...a much more noble cause!

Re:Surprise me!

[holt]

Or would bill and steve finally get the fact that windows is JUST AN OS and MS just another company! and that he's got more money than GOD so it's time to let go of world monopoly and instead try to spend 100B before he dies...a much more noble cause!

If they "let go" of their "world monopoly," Microsoft's stock price would plummet. Nevermind that they have a legal responsibility to maximize shareholder value! So doing that would take away the vast majority of their assets and burden them with a large legal liability. Not a smart thing to do in either case.

NTFS

[e r i k 0]

Looking through the file listing, I see no mention of NTFS (that's not in dead code) except for a few files dealing with ntfsrec. It appears that those files are the NTFS recognizer. Maybe NTFS wasn't included in this leak?

It's an official leak!

[response3]

http://www.securityfocus.com/news/8037

How many times?

[Rand310]

This is not the first, nor the last time this will happen.

How many times will it take to make people aware of the fact that such immense reliability on closed-source DRM-esque code will cause problems. Such closed-source *cannot* be closed forever. The information will be spread, and security through secrecy cannot win.

In addition, the mob-law illustrated here by the internet is an interesting phenomena (by no means unique to this incident - except maybe in the irony). LIterally thousands of people already have a copy of multi-million dollar source for free. It is an interesting epitomization of how such digital knowledge cannot be legally protected. What will MS do, sue any IP that shows up in BitTorrent or eDonkey? If the internet wants it, some individual might pay a few months behind bars, but the internet will have it...

free-enterprise, and free-information...

Wrong

[0x0d0a]

No. If the Wine folks look at the actual Windows source code, they aren't reverse engineering any more, they're copying, which is illegal.

IANAL. You are wrong. Non-clean-room reverse engineering is not only legal but is done at many, many companies. There is *absolutely no constraint* to use a clean room in reverse engineering.

The first clean room reverse engineering that I'm aware of is Phoenix of IBM's BIOS. They had *no* legal requirement to clean-room reverse engineer the BIOS. If they wanted to, they could hire IBM BIOS engineers for the job. However, by doing a clean room implementation, they ensured that they had an counterargument to *any* potential IBM claims of infringement. Had they not have used a cleanroom tactic, they might have had to actually have folks look at the code and at what people were doing with the code if charged with infringement. While this can be useful -- it's an immediate shutdown to any argument IBM might raise about infringement in court, and the judge doesn't even need to see the code -- it is definitely not necessary. I can look at GPL code and use the same approach said code does as long as I am not copying code verbatim (note that changing variables or something is not sufficient -- the work must be done by you, not be a mangled version of the original).

That being said, WINE has long had a policy of *not* accepting access to Windows source code. They've had people with access to it volunteer to give them stuff in the past, and they want to do a pseudo-cleanroom approach, since it makes matters simple from a legal standpoint. WINE will probably continue to ignore the source (and the WINE maintainers now have to worry about people submitting WINE patches containing Windows source...they may require indemnification or God knows what).

From a security standpoint, this is an utter disaster to Microsoft. They haven't had the benefit of many eyes all these years, and now they have a fucking lot of malicious eyes, and ten years of holes to remove in a week or so before the nastier exploits come out. None of those eyes have any incentive to submit patches to Microsoft. There will be attacks on relatively hardened systems, too.

This is going to suck for friends and family that I have using Windows.

A bit about the developer...

[Anonymous Coward]

http://www.mainsoft.com/corporate/exec_profiles.ht ml
At the very bottom is the owner of the core file.

A friend took a look at their FTP server, looks like an unpatched wuftpd, gee, i wonder how they got in....

220 circle.mainsoft.com FTP server (Version wu-2.6.1(1) Thu Oct 12 09:06:04 PDT 2000) ready.

Re:A bit about the developer...

[Anonymous Coward]

OK, so the way the source leaked was because of a wu-ftpd exploit. How long until Microsoft decides to use it as a base for FUD? After all, it is Open Source Software...

Re:A bit about the developer...

[BenBenBen]

Nimda is responsible - look for riched20.dll in the source code tar. This is Nimda's engine.

So, was this stolen recently or has someone been slaving over it and turning out beauts like MyDoom, Blaster and Slammer?

Re:Someone got into Mac OS X's source and posted i

[Endive4Ever]

I have a nice SE/30 machine. However, because Apple is a closed company, it cannot directly boot NetBSD. I have to have a little stub of a MacOS partition on it with a MacOS 'booter' application to load NetBSD. Further, the 'real time clock' in that era of Macintosh has some 'quirks' in it that mean there is constant clock drift when running NetBSD on the hardware.

So where's the source, Apple? Why don't you open the source to older versions of MacOS? For that point, why can't we freely download versions of MacOS newer than 7.5??

Is generalization a good thing?

[bersl2]

Man generalizes by necessity. In a situation where information is lacking, a person considers what he already knows, what he is told, and his gut instinct, and he synthesizes a substitute for the missing information out of this.

Now, as a Linux user, I feel as though Ms. Didio, by this process, has misrepresented us. She, you presume, is targeting executives with her writing, I presume that she regularily gets feedback from them. These executives, I and others generalize, generalize for a living, by making decisions from information presented to them, a wide range of what he knows, and gut reaction. One of those executives might have told her that these Linux people are "freakin' ankle biters." This might be the only information she had collected in the past relevant to this subject. In a pinch to write this breaking story, she cannot do any research.

I read this story. I feel as though she has misrepresented us. I wish to inform her that she has us all wrong, that she is taking a part as the whole.

As (presumably) a sentient being, she is free to believe what she wishes, and she is free to say what she wishes. If she thinks that my suggestion is bull, she can disregard it. If I and others, in the course of individually contacting her, flood her mailbox, she may become angry, and we have a communications breakdown.

If, on the other hand, she thinks that perhaps I am right, she may change her opinion of us in the future.

For better or worse, we generalize. If you wish to refute any of my generalizations, or my entire argument, please do so. I am open to persuasion, as I would think you to be too.

After all, isn't that the point of communication?

Re:User friendly

[IgnoramusMaximus]

Really? So what you are saying is: "You are nuts because I lack the facts to argue with you"?

Or are you so far gone into the jungle that any attempt at getting you to see the big picture and what are the root causes of all this IP mess is too difficult and therefore must be the domain of conspiracy theorists?

It is so sad that everyone is focusing on tiny minutia and byzantine legalese and has no time for re-examining the fundamental principles of the whole thing. You are too busy arguing over what style of a slave collar should you wear and if it goes with your shoes and when someone stops by and aks what the hell are you doing you go "Hah, a nutcase!" and keep on trying a tighter fitting one with a bejewelled chain.

In case you wonder I am dead serious about this. The question of what is "property" and what is not is one of fundamental issues that need to be sorted out properly in this time of great transformations of the way human societies are organized and connected. Instead it is being randomly muddled through under the guidance of corrupt politicians and greed-motivated robber barrons. The fact that excluding information from the classification of property has financial disadvantages to some, pales in comparison with the implications of the contrary position, doubly and triply so if one is to adopt it casually and without examining it like you and the general public seems to.

Re:FULL version? find * | cat | wc -l ?

[fihzy]

hmm do a file to see what is text, then count the lines of everything that is text?

They have copyright notices in the docs

[GridPoint]

Yes, Microsoft is acknowledging the use of BSD licensed code. I don't know if they are doing it in the source code, but since they are putting copyright notices in the release notes for their software they probably have copyright notices in the source code too. Look at the copyright information on their page, they not only honor Berkeley but also a lot of other people that have been actively contributing to various BSD software such as Luigi Rizzo.

the best thing now

[CAIMLAS]

The best thing that MS could do is release this code, themselves, under a license of some sort which allows code submissions and modifications, without negative implications for the modifiers (if they can, in fact, do so themselves due to contracts with other folks).

Maybe that way they'll get some white hats looking at their code, offering fixes, and actually improving their software, instead of the currently likely scenario where only black hats (worm writers, spammers, and the like) will look at it.

IE for Linux

[llzackll]

Maybe now somebody will port Internet Explorer on linux.

That's not full at all

[Imperator]

I saw that a while ago (years ago?) and went back a few minutes ago to compare it against the list of files that someone else posted a link to. But it was obvious when I first saw it, and it's apparently been confirmed now, that this it is by no means the full tree. OTOH, what was leaked today might actually be the full tree.

Re:User friendly

[IgnoramusMaximus]

BTW, I just noticed that due to some Slashdot database quirk, my original post which was addressed to the first article in this thread (the dude who feels sorry for poor MS and their property) was posted as a reply to your post. I assume that is why you answered instead of him.

Very smart - MSFT flooded Kazaa with bogus files

[Anonymous Coward]

Go check out Kazaa for "windows source"... you'll find hundreds of hits, and they will range in size from 10 MB to 1 GB. You can't possibly tell which one is the right one, even if you know the approximate size is around 200 MB because there are literally dozens of them in that range. To download the wrong one will end up wasting hours if not days of your time. As well, being on Kazaa for so long downloading these files is risky... who knows if it will open you up to getting raided by the FBI for downloading trade secrets?

I must admit that they did a good job protecting themselves this way... Who says Microsoft isn't filled with clever people?

Nimda infection

[shird]

By the looks of all the empty .eml files, the source was obviously stolen from a guy hit by the nimda virus.

Empty .eml files are a typical indication of a computer that was infected by nimda then cleaned. Unfortuantly, this guy forgot to disable sharing of his shares after cleaning up.

Re:The shit will hit the fan + Mirror

[nick0909]

"being proved guilty beyond reasonable doubt" is all the rage in criminal court, but civil court only needs preponderance of the evidence. Remember how OJ was innocent and guilty? If they don't get you in one they would in the other. And either way you are broke from paying the lawyers.

Wow, finally!

[mnmlst]

It's hard to believe it took this long to happen! Hell, that's the most impressive part of this leak!

Re:It's a TRAP!!! /Adm. Ackbar

[GundyRage]

I'm submitting patches to the 2.6 kernel for the blue screen of death. I'm hoping they make it in to the next release.

new Working Torrent

[Anonymous Coward]

http://torrent.spyderlake.com/download.php?info_ha sh=f03fc1e04869294d5644d3c8c5d0fb8f2d26aa59

Re:If code is criminal, only criminals will have c

[metroid composite]

BTW the server seems ve-wy slow to-day. I think we were just Farked.

Yes, yes we were

First post on that: 05:23:19 PM; time of your post 05:53PM, so about the peak of the linking.

Oh, and this deserves mirroring:

2004-02-12 05:25:37 PM squeevey

that would be cool to fark /. it would also be interesting to see fark /.'ed (out of fairness)

Re:Holy crap that acctually adds up!

[eggsome]

I'll have to remember that one...

TIME WARNER IS KILLING CONNECTIONS

[Anonymous Coward]

It is repeatable... when I run pavuk on devolish.no, my cable connection drops, then reconnects in two minutes or so.

Does anyone else on Time Warner have same result?

Spooky.

TO MICROSOFT: Release the code

[PingPongBoy]

I think it's time to let us see the code officially. Malicious people are likely to insert trojans into any leaked code. This goes beyond "buyer beware"; it will give Microsoft a bad name if Microsoft does not help people protect themselves.

Enough evidence to support a full refund?

[HAIDEN]

Is it not bad enough that someone first broke in... proving the lack of security. Looking back at the whole reason is was kept closed source.... and i paraphrase "not seeing the source keeps (haha) from seeing holes which could otherwise be seen in open source". The company i work for has spent near 1/4 million dollars on M$ products, liscensing, and support. The fact that my boss relies on the fact that the source is closed (in his mind)... this seems to be a very big implication and would be reason enough to save our money from now on, and use a solution that isnt so damn backwards. I can only imagine how much money we are continually losing even using the "Great Plains" accounting system. If this leak is indeed legit, M$ isnt doing its job and os letting down its customers. Furthermore when my business completely relies on a company that cant even protect itself...

I have enough to worry about, this should be the last thing that should happen. Let this be a clear message that easy isnt always better... any forest gump can run a M$ product...

http://news.bbc.co.uk/1/hi/business/993933.stm

I SAY NO MORE!!!!!

No more promises..... you let me down M$

Re:It's a TRAP!!! /Adm. Ackbar

[TKinias]

scripsit AstroDrabb:

I am under the impression that copyright laws do not prevent you from creating a work based on knowledge of another work. As long as you do not use the original work verbatim. I can go and create a movie called Planet Wars with a lead character named Duke SlyStalker based on a very similiar theme as Star Wars. I can write a book with a theme just like LOTR with trolls, hobbits, elves, dwarfs, etc. I can paint my own version of very famous paintings. I can make music that sounds like other popular music.

IANAL either, but I've had to deal with copyright issues in academe. You cannot create a derivative work -- that is part of the copyright-holder's monopoly. You needn't use a single line of text verbatim for it to be considered a derivative work; a movie adaptation which mangles the plot and doesn't use any of a book's dialogue is still a derivative work. So would a translation into Mandarin or a children's version.

There are exceptions, I believe, for parody -- various Star Wars knockoffs (e.g., the Death Star Clerks animation) are apparently legal as parody. Otherwise, you can get into hot water with the kind of things you're talking about. You have to be able to convince a jury that your work is not derivative of the earlier copyrighted work or you are infringing.

The painting one is an interesting example, because most of the `famous' paintings one would be inclined to make works derivative of are not in copyright any more. And when it comes to music, pop all sounds alike anyway, so it would be pretty hard to argue that anything is derivative of anything else, unless it copied bars on end of melody or something.

Now, academic plagiarism and copyright infringement are not the same thing, but the rule-of-thumb I tell students about plagiarism still applies: If I read your work and I think ``Hmm, I've read this somewhere before,'' there's already a problem. There doesn't have to be verbatim copying of text. It might not be enough to convict, so to speak, but unwelcome attention has been drawn and a legal fight is a possibility.

Re:You've got to be shitting me

[caino59]

sorry, more of a reply to the parent than you...

Patch submission

[Anonymous Coward]

So where do we send the patches? That IS why they released it isn't it?

The first OSS/terrorist characterization is found:

[lysium]

Here.

Here's the ringing endorsement from Laura Didio (the anti-RMS, perhaps):

"With the open source community, there are a large percentage of tinkers and 'ankle biters' who are trying their hand at hacking. Some are even communicating with each other. So it only takes one or two of these groups sharing information to be able to pull something off. When you have this type of passion, it's hard to fight because these people are like virtual suicide car bombers."

=====

Most fun with kernel sources in awhile!

[Rassendyll]

I fell out of my chair... guess I find frank comments in source code a little "too" humourous...

Re:Could be a win for microsoft

[La Camiseta]

If it wasn't for the fact that so much of WinXP is based on 2000 that the vast majority of the bugs that crop up for 2000 also exist on XP.

XP is nothing more than a fancy new interface to 2000 with extensions for .NET. Granted there's a couple of new wizards and some new UI things, but the core is for the most part the same.

brilliant put-down

[JimmytheGeek]

"grow up"

The nice thing about that is you can use it any time you want! Another good one is "cry me a river"

I see. I should continue to use closed source, accidentally disclosed (but only to bad people) so that MS can accumulate capital. That helps me a lot. That's definitely my goal in life. Thanks for clearing that up.

Re:Very smart - MSFT flooded Kazaa with bogus file

[bangular]

At this point it's way too late. There are foreign websites hosting it, and it's going to be next to impossible for MS to have any pull on some of these countries.

Are you a "tinker" or "ankle biter"?

[Camel Pilot]

Since OSS folks only come in two colors.

If I was Mrs Darl McBride i would be mighty suspicious that Darl is having an affair with Laura. After all they seem to have access to the same drugs.

Re:Are you a "tinker" or "ankle biter"?

[fotang]

Ms Didiot has "known McBride and SCOsource licensing chief Chris Sontag for 15 years - since their days at Novell under the tutelage of then Novell CEO Ray Noorda" (http://www.linuxworld.com/story/35112.htm). No doubt she talks like a PR agent for ... nevermind.

Re:hmm seems a bit buggy

[Jugalator]

Now, don't know where the source was leaked from, but 1 + 1 = ?

1 + 1 = USA in this case ;-)

Re:Microsoft uses Perl

[bangular]

Hmmmm....
For perl code to be included Windows, it would mean they would have to have a perl interpreter in windows (It's highly doubtful they used perlcc). Does the perl license similar to the BSD license where they could legally put the offical perl in windows, or is it more like a GNU style license where they couldn't.

yes, cuts both ways

[jbrians]

MS developers are forbidden by company policy to look at open source code, even on their own time, for that very reason.

I'm going to be non-technical here

[Knight55]

And say that when you view that in your browser window it's like looking through a window at what's stored on the server. Hence the term window. Kinda like the browser is your special glasses making you unblind.

Copying it would be making a duplicate in a file on your computer, like in the history.

Maybe turning my history off is the best move I ever made in my life.

Is XP selling that poorly...

[Malcs]

that they had to make this an official announcement?

"Time for everyone to upgrade to XP or else hackers will get you too!"

What a brilliant thing to do right on the heels of MyDoomJuice and all that.

Hehehe

Re:Is XP selling that poorly...

[hey]

Don't you think XP is mostly Windows 2000 code?

It's a hoax.

[Anonymous Coward]

I have downloaded few of the circulating archives...

All of them are partial WinNT 3.51 source code...

What a disappointment...

Re:It's a hoax.

[stuffedmonkey]

Nope: It's confirmed by M$ http://www.eweek.com/article2/0,4149,1526474,00.as p

New Article at Infoworld

[pegasustonans]

http://www.infoworld.com/article/04/02/12/hnwindow sleak_1.html In particular, the article raises the issue that there is currently some contention regarding exactly what percentage of the respective OS' were leaked. "Those who say they have downloaded the source code claim to have a 200M-byte compressed file that expands into roughly 600M bytes of code. Microsoft officials told industry analysts that this is roughly correct and that it represents about 15 percent of Windows source code. Jupiter Research's Wilcox said a much greater percentage of the Windows code may have leaked. 'It was my understanding that Windows 2000 was about 35 million lines of code.' People who have seen the leaked code say it contains about 13.5 million lines."

posted on usenet

[Anonymous Coward]

alt.binaries.cores
alt.binaries.newsgroupcentral

header:
Windows.2000.source.code-NOGROUP - 2 of 2 - "windows_2000_source_code.zip"

the file is 209.3MB. it was posted about 2 hours ago. most likely this is the same file that was being distributed via torrent ect... enjoy

Neowin sucks

[geeknews]

Notice how Neowin has - Exclusive in front of thier story. The associated press released this information a full 12 hours before Neowin got a hold of it.

you might even find set_bugs=1;

[Capt Vegetable]

remember what happened to fooker?

Conspiracy theorys

[fuegomatt]

I think that the conspiracy theorys, particularly those that think MS deliberately leaked the source, seriously overestimate MS as an entity. MS is like any other large organization or corporation: A vaguely organized collection of individuals who are muddling through their working day, certainly not hell bent on working towards some evil master plan. Nothing MS does besides Windows and Office makes any money. They are groping in the dark like everyone else. If you speak to MS employees or visit Redmond campus, you certainly get a sense of this.

Re:Conspiracy theorys

[fuegomatt]

I wouldnt, however, underestimate the quality of the people who work at MS. I wouldnt describe them as "organization men" in the traditional 60s IBM sense of the world. MS hires the best and brightest and I think Redmond is consequently a positive and stimulating place to be. I think the "average" Redmond developer wants to build good stuff for other developers to use. Most techys are not politically motivated sociopaths after all. And I think MS hires and values Techys above all else. You dont get to be the worlds most successful technology company otherwise. Of course these happy masses are being directed at a very high level by Bill and Steve, but to regard the entire organisation as a single minded entity is to missunderstand the nature of large corporations. All are muddling though. Some better than others certainly, some lead better, some luckier, some using good technology and some not. But all are hostages to their particular circumstance and all are fundamentally organised at a much lower, collective level (if at all) than it might seem from the outside looking in. Corporations are emergent entities, not hive minds.

Re:Conspiracy theorys

[fuegomatt]

I haven't read the OM, in fact I thought that William Whyte was the bad guy in "Diamond are Forever". Thanks for the tip. I shall add it to my swelling Amazon shopping cart.

I certainly agree that large companies are more facinating in their failings than their acheivements. If I can recommend a good read in return The Innovators Dilema convincingly explains the inability of companies to exploit new, disruptive technologies. In fact, R&D doesnt help companies faced with such a technological shift. Xerox perhaps faced this at PARC. Telcom is faciniating right now as a truely disruptive technology (VoIP) sweeps the telcos before it. What will be the disruptive silver bullet for MS I wonder? It was almost the Internet, except that against the odds MS survived it. Perhaps that is a tribute to Bill and Steve if nothing else is.

One of MS' own languages?

[Rassendyll]

You mean like Visual C++? MSFC? MASM?

Re:One of MS' own languages?

[CdBee]

Yes, I was thinking of C++ when I typed that

It first occurred to me that it was probably written in an MS language then I remembered that Windows is older than C++

Thanks for the interesting responses.

The Xbox source code leaked over a year ago

[Anonymous Coward]

The Xbox kernel + SDK source code leaked over a year ago. The Xbox source that was stolen is complete enough that at least one warez group - Xecuter - has compiled customized kernels from source. If you look at their compiled version, it is very obvious that they didn't do patches to make their hacks.

The forcedeth driver authors have ignored the many emails to them containing the nForce register list and documentation from the leaked Xbox source code.

WINE has ignored emails to them about the real name and purpose of the SystemFunctionXXX calls in advapi32.dll. (The header file doing the #define's to rename them was in the Xbox source, supposedly.)

anonymous woman

IAAL...

[Rassendyll]

That's the first time I've seen that acronym on slashdot, glad to have you around.

Re:It's a TRAP!!! /Adm. Ackbar

[Krunch]

There are exceptions, I believe, for parody[...]

Great, let's make a Windows parody.

Memo...

[myg]

Its just that we're putting new cover sheets on all TPS reports now, before they go out. Did you see the memo on this?

I'll make sure you get another copy of that memo.

OMG

[siimv]

the Microsoft's press release is down already!!! hax0r's are already messing with hidden holes in source!! oh, wait.. it's just /.

One Man's Source Code Is Another Man's Virus

[Bowie J. Poag]

Stop and think about it. Regardless of whether or not the leak was intentional or not, it hurts us. If the code leak was deliberate, it was a brilliant move, strategically. It will hurt the open source community far, far more than it will hurt Microsoft. Infact, this is probably the biggest punch Microsoft has landed on the face of Linux. If it was unintentional, the net result is the same. Here's why.

Think of the leaking of the Win2K/NT source tree as a virus.

It's a virus designed to undermine the credibility of open-source community. It operates by exploiting two well-known vulnerabilities in open-source coders---Their curiosity, and their propensity for sharing. The dispersal of portions of the Win2K/NT source tree effectively taints the entire open source community's efforts to develop cleanly. Think about it. By leaking the code, every new OSS project that has anything even remotely to do with Windows interoperability can now be accused of having it's hand in an (at best) an unethical cookie jar. The folks who maintain Windows-interoperable projects now have to second-guess every new submission they recieve. Even worse, the availability of portions of the Win2K/NT source tree means the functional validity of all open source projects can now be called into question. Before, it was certain that any "feature" present in open-source software was the result of hard work, close observation, and the occasional dose of clever back-engineering.. Now that we can see over the fence, we can be accused of everything from violating Microsoft's intellectual property rights to wholesale misappropriation of entire blocks of Windows code.. Sort of makes SCO's accusations seem a little more well-grounded, doesn't it?

The sad thing is, the virus is having an easy time making the rounds, since theres nothing we can do to stop it. We cant become "less curious". We can't become "less industrious". The only way to avoid being under the cloud of suspicion is to stop developing alltogether. Just watch what happens. My guess is, by the end of this year, the trade rags are going to begin to equate open-source software with "questionable parentage".

This game is gonna get interesting in a hurry.

Re:One Man's Source Code Is Another Man's Virus

[Boltronics]

"this is probably the biggest punch Microsoft has landed"

Don't you think maybe you are just a little too paranoid? I could understand this possibly being a problem for the WINE project, but I wouldn't expect it to go any futher than that. NTFS code wasn't leaked, and samba/vfat is probably already as good as it can get.

Re:One Man's Source Code Is Another Man's Virus

[Bowie J. Poag]

Sure, you and I know that, but what do you think the story is going to sound like to the PHBs out there? To them, it's as if the entire source tree was leaked. Theyre not going to know about (or care about) the details. "I hear Linux does X Y and Z now.....They probably learned how to do it by looking at the leaked Windows source code."

Most of the world makes decisions based on perceptions. Not on facts.

Re:One Man's Source Code Is Another Man's Virus

[calyptos]

If it was intentional, Microsoft wouldn't have flooded kazaa with bogus source code downloads. I think it would harm microsoft's credibility as far as "windows is more secure" claims more than it would hurt interoperability projects. A defense in such an accusation is easy if you didn't actually do anything wrong.

Poetic Justice

[Perdo]

They have left their customers exposed for years.

Now their lack of security has cost them their crown jewels.

Re:It's a TRAP!!! /Adm. Ackbar

[SamSim]

Viruses are well supported by their authors, their program code is fast, compact and efficient and they tend to become more sophisticated as they mature.

So, Windows is not a virus.

Adding 5 as an arbitrary number is a cheat, but...

[blorg]

...Windows 666*3 does equal Windows 98, exactly.

Which seems about right.

We're doomed!

[superhoe]

From the file list:

190 07-26-00 02:12 win2k/private/inet/mshtml/btools/nuke.bat

Oh shit.. the 'Start global thermonuclear war' code - revealed and exploited.

We're doomed!

Re:We're doomed!

[Lobo93]

We're doomed!

Not only are we doomed, we're doomed to be nuked in a selective manner. Oh, boy... ;)

Found this in ...private/inet/mshtml/nuke.bat:

:SetAllNotify
echo **} selective nuke enabled with:
echo **} nuke [build]
echo **} ie, nuke debug, nuke free, nuke misc, etc.
echo.

I'd say, with a pair of pliers and a blow torch, there's a whole lot of associative connections in those few lines!

BillG: Free as in Nuke free!!!!111!!

Looks like they will use it to harrass OS devs

[hingo]

While it's not news that MS doesn't see that there might be any security threats towards Windows, should we read more into this:

"One main risk in having source code exposed to the public is the possibility that hackers could break into computers running Windows NT or Windows 2000 and destroy or steal data.

"Although the company said that was unlikely, given the relatively small portion of code that had been circulating, a greater risk could come from others using the code as a base for developing software that competes with Windows."

http://www.reuters.com/newsArticle.jhtml?type=te ch nologyNews&storyID=4351461

Re:The shit will hit the fan + Mirror

[foidulus]

There are legitimate people(universities etc) who have looked at this code, if there was a license violation, we would have known about it beforehand....

Finally, microsoft lives up their word: security

[Tatarize]

It'll be rough for a few months, but after some bugs start churning out left and right Windows will be a more secure OS.

It's the best of both worlds, you get geekloads of bug checkers, and still can sue the butt off of anybody who makes a derived work.

Microsoft should have done this years ago!

how things suck

[Anonymous Coward]

you should grep for string 'suck' on that src-code. There are some pearls. like:

// BUGBUG -- Win95 sucks. Close the socket and try again

or

printf("Ha! There is no verbose mode, sucker. Try again\n");

and so on ...

Reminds me of the movie Anti-trust

[Gary Destruction]

Near the end, Gary Winston is frantic as the anti-competetive and murderous tactics of his company are broadcast by one of his own communication satellites. Then you see the source code for Nurv's multi-billion dollar project being transmitted over the Internet.

Milo: "Are you proud of me yet, Gary?"

Official Microsoft statement on the leak

[djace]

From http://www.microsoft.com/presspass/press/2004/Feb0 4/02-12windowssource.asp

Statement from Microsoft Regarding Illegal Posting of Windows Source Code

REDMOND, Wash., Feb. 12, 2004 -- On Thursday, Microsoft became aware that portions of the Microsoft Windows 2000 and Windows NT 4.0 source code were illegally made available on the Internet. It's illegal for third parties to post Microsoft source code, and we take such activity very seriously.

We are currently investigating these postings and are working with the appropriate law-enforcement authorities.

At this point it does not appear that this is the result of any breach of Microsoft's corporate network or internal security.

At this time there is no known impact on customers. We will continue to monitor the situation.

probably a source code source that's going to last

[robby2]

a lot longer: Freenet
I wonder how many people will start using freenet just to get the sources and not get tagged as "one that downloaded the sources".

Reverse Engineering

[5lash]

Ok I just explained this story to my mate who doesn't know much about computers but is doing a Law Degree...
He says your allowed to Reverse Engineer any piece of software yourself. I said yeah maybe but either way I don't think any team with all the time in the world could ever Reverse Engineer windows perfectly? And anyway it's probably illegal, though my friend says its perfectly legal.
Er, I've confused myself now, could someone please explain!? Could people just reverse engineer the whole of windows and then have access to pretty much the same source code as was written by MS?

Is this an ear?

[Anonymous Coward]

And if you don't pay up, we'll release the rest of it . . .

Possible reason....

[mormop]

For once the BBC carried a tech story on the main news which was reported as follows:

Source code for Windows NT and 2000 was leaked onto the internet. Microsoft fear that the source code being open to view could make it easy for haclkers to attack these systems

So there you have it. Source code readable by plebs = security risk, a statement that will reflect on FOSS in the minds of joe public if you tell them that the Open Source means readable source code.

Hmmmmmm....

cool

[GerritHoll]

So we can finally find out whether Microsoft uses 2, 4 or 8-sized tabs... ;-)

Source Code Manifest

[Tatarize]

http://us.share.geocities.com/tatarize/files.txt

Not hyperlinked to keep it there longer.

Up for 2 minutes tops. If anybody has a legit hosting for this, save a copy, and post a reply... although its already down, and your site would be 20 seconds later. The file names are good to know.

Re:Source Code Manifest

[Tatarize]

Here, better link.

Re:Source Code Manifest

[calyptos]

i dont think it's illegal or anything to host such a list, so i'm willing to donate some bandwidth.

Here is my link

I'd be intrested to see the change in my site's hits and bandwidth.

Re:Source Code Manifest

[TheUberBob]

anyone grep for fixme?

Leaked source code?

[kwikjump]

Could be a conspiricy, perhaps the 'leaked' code was purposefully 'lost' and now those virus you are writing could be looking for the wrong holes. lol. Well, if the code is legit, we can start making +9 trainers for Microsoft OSes! Cool! Press F1 to register , press F2 to resurrect clippy!

BBC Radio 4

[midgley]

The Today program I regret to say seems to have swallowed the story.

I think this is part of the Microsoft programme of advertising and attacks on OSS which started last week.

Plus a sort of effort to excuse the huge security hole revealsed after 7 months earlier this week.

It would be worth making contact in a thoughtful and polite way with your local media, and offering to give a reaction on the next MS press release or "new" revelation.

Re:It's a TRAP!!! /Adm. Ackbar

[scott_davey]

There are exceptions, I believe, for parody -- various Star Wars knockoffs (e.g., the Death Star Clerks animation) are apparently legal as parody

So if Wine or Samba get into hot water, they should say "Hey Judge, we were just making a parody of Windows. Funny, huh. Get it?" ;-)

Re:Adding 5 as an arbitrary number is a cheat, but

[I. M. Bur]

666 * 3 = 98

Whoa...

Re:The shit will hit the fan + Mirror

[CaptainCarrot]

Civil courts have a notoriously lower standard for proof than criminal courts, presumably because the penalties are fines and not jailtime or execution.

No, the "penalties" are financial compensation paid by a losing defendant to a winning plaintiff. That's not a fine. The lower standard of proof is far from "notorious", it's only fair. Civil suits take place between parties that are theoretically equal in the eyes of the law, so there's no reason to automatically favor one party over the other. Criminal law is heavily weighted in favor of the defendant because it's presumed that citizens need more protection from a potentially draconian government than they do from each other.

IOW, mod grandparent down. It's an ill-informed comment from someone who has little understanding of the court system. He ought to have learned better from The People's Court, if nowhere else.

So, lets help MS out and find the holes!

[insomnic]

The best thing the community can do now - when the source has leaked - is to actually perform a peer review of the MS source code, and HELP MS close the security holes.
After all, we all do want a more secure internet, with less virii, worms and bugs. So why not help out?
I can't imagine what MS reaction would be if they actually started getting serious _help_ from the open source community, instead of the regular bashing.
And - it would be a Good Thing as well... Remember - it's Valentine's day tomorrow...

Re:So, lets help MS out and find the holes!

[Random Guru 42]

There must be anonymous ways of providing fixes.

This is a dilemma the Russian mafia does not have

[janimal]

Are you gonna let them do it alone?

Re:The shit will hit the fan + Mirror

[shione]

Thats true and they also have patents and trade secrets in the code, although with trade secrets its unknown if they still hold up in court now that the source is leaked.

Filelist shows virus infection?

[TwistedSpring]

http://heim.ifi.uio.no/~mortehu/files.txt seems to show signs of a Nimda (or similar) virus infection. Look at the number of 0-byte sized email messages distributed in inappropriate places throughout the tree. If whatever machine this source was ripped from did indeed have a virus then no wonder it was leaked.

Microsoft called me...

[nordicfrost]

Well, as a journalist in a large newspaper, I recieved a phonecall from the CEO of MS Norway. He's a nice guy and said that the title we had was misleading. I could see his point and we changed it to something more accurate.

Anyhoo, he said that only parts of the code had been released and not the whole tamale. Furthermore, the code is not possible to compile from the source that has been leaked.

Can anyone here confirm / deny that the whole code set for Windows 2000 / NT has been released?

Mail me at pal.unanue@NOSPAM.vg.no

Re:Microsoft called me...

[pandrijeczko]

Hmmm, so Microsoft now believe they control the freedom of the press also?

"The real question is..." regional?

[Seetee]

It _was_ not ilegal to download musik in sweden. Since Januari first this is not true, however.

In sweden it is not legal to download copyrighted material you haven't payed for, as well as upload, of course.

So there might be countries where it is fully legal to download the Windows Source Code, I guess.

--

Not a problem..

[AftanGustur]

If there are no backdoors are in the source, the tinfoil hat crowd will just say that the leaked source isn't the version used to build windows binaries, and the controversy will continue.

That would be wasy to verify.. If the compiled binary matches the commercial one, the this is the sourcode, otherwise there are tools to locate the differences ..

cat | grep FIXME | wc -l

[1s44c]

One quick way to tell:
cat | grep FIXME | wc -l

If you have a very large number then you really do have microsofts code.

Re:NTFS...

[Anonymous Coward]

doesn't appear that there is any NTFS code in what was leaked. why would microsoft share NTFS code with a developer? really doesn't have much to do with the API

Re:"brags" about Windows security?

[1s44c]

Every tech in the universe may well know that microsoft code is poorly written. But it's not us that signs the purchase orders.

Dumb managers fall for the marketing, excuses, and FUD every time.

Re:Small server they've got there

[Dave2 Wickham]

Yeah, I do know of what is apparently a source. Not tried it, because I don't want to touch it and hate warez, but the neowin.net article wouldn't point to any sources...

Re:The shit will hit the fan + Mirror

[mijok]

Well, that's not the case in all countries. I wonder if the wine project could continue as an EU only project (but obviously still be legal to use in the US) since in most countries here the suing party* is obliged to pay all the fees of the party being sued if that party wins - thus suing someone out of existance isn't possible. Consequently in a case where Microsoft is actually the underdog lawyers would line up to defend wine knowing how much money they could get out of MS pocket if they win and thus it would be very hard for MS to prove that wine has done any IP infringement.

*) Sorry, English is not my native language but what I mean with suing party is the entity suing another one. If the party being sued wins the suing party is obliged to pay all the legal fees of the party that was sued (in that case the winner). However, if the suing party wins the party being sued (and in that case the loser) isn't automatically obliged to pay the legal fees of the winner (in that case the party suing) since otherwise the party suing would be tempted to use excessive resources (ie. knowing that the loser will pay) in a case where they know that the outcome is obvious.

It's a FLOSS !

[Mr Europe]

Didn't I tell you. MS is going for Open Source !

Re:It's a TRAP!!! /Adm. Ackbar

[tiger99]

DEC may be gone, but they became part of Compaq, which became part of HP, which uses Unix....

Oh, the complexity of it all.

Strange that NT has never had the stability of VMS, or maybe not so strange, if the reports are to be believed that after NT3.51, some Silly Billy has the device drivers moved into kernel space to make it faster.........

It is sad that DEC is gone, but it was entirely predictable because the semiconducter industry, mainly Intel, is in a position to undercut anyone who only manufactures computers. They actually lasted longer than I expected. I had nothing against DEC, in fact I thought some of their early stuff (PDP8, 11) were actually quite decent at the time, and they were positively generous with documentation and manuals, certainly to educational and research users, but it was clear that their approach had had its day, with teh advent of the 386, or certainly the 486. Compare the cost of a complete top of the range PC to the biggest VAX, with a tiny fraction of the CPU performance, and you will see why.....

Having said that, I have worked quite efficiently, some years ago, on a VAX shared with a hundred users, using Word Perfect on a serial terminal. It was surprisingly usable.

Conspiracy Theory

[Shiner_Man_NJ]

Heres a crazy idea. Perhaps...just perhaps this leak was somewhat of a test to see what would happen if Microsoft did go open-source. Perhaps they want to see if hackers will take the code and try and fix it or take the code and write better viruses. hmmmmm...or maybe they just pissed off an employee.

Forty freakin' Gigabytes?

[phiwum]

"The 203MB file expands to just under 660MB, he said, noting that the final code size almost perfectly matches the capacity of a typical CD-ROM. The entire source code, he said, is believed to be about 40GB, meaning that the file circulating Thursday is only a fraction of the full code base." Security consultant Dragos Ruiu, as quoted at zdnet.

Can this be true? Can the Windows 2000 source code really be forty gig? What is he counting as source code?

My Linux 2.6.0 kernel source tree is 348M. Of course, Windows will have the GUI as part of their kernel source, but for X, that's just another 279M. Yeah, okay, so toss in the source for the MS equivalent of window managers, and perhaps some other utilities, but still...

Is 40 gig a reasonable estimate? Really?

Re:Forty freakin' Gigabytes?

[calyptos]

I'm making my own distro right now. my source code folder is 5.9GB and that's including the object files. 40gb is excessive. I think microsoft basically just admited to having way too much bloat.

Re:It's a TRAP!!! /Adm. Ackbar

[Brendan Byrd]

One word: Compaq. Remember the IBM chip? Remember clones? Was that derivative work or reverse-engineering?

Re:The shit will hit the fan + Mirror

[xRizen]

If they win, their fees are paid. Good, so what about the meantime? You still have to have the cash to begin with.

Re:It's a TRAP!!! /Adm. Ackbar

[Brendan Byrd]

Fine, then...force them to release that part of the code to the laywers under a NDA. This is civil court, not criminal court.

mp3s on kazaa?

[calyptos]

I've read in another thread that Microsoft released bogus files onto kazaa. I decided I'd try to get one of these bogus files and see what they were. I found a 100mb ZIP file which was obviously a fake, everything's saying it's zipped up to like 200mb and extracts to 600mb. Using my handy dandy "file" command I discovered it was an mp3. A 100mb MP3. I played it and it was some 3 hour long thing full of absolutely nothing. For those of you intrested, the filetype was: MP3, 80kBits, 22.05kHz, JStereo

Re:The shit will hit the fan + Mirror

[mijok]

You still have to have the cash to begin with.
The lawyers send a bill once the case is over. No cash needed at first.

Re:Very smart - MSFT flooded Kazaa with bogus file

[oshy]

Didn't maddona get a telling off for doing something similar.
She had some files put out claiming to be mp3s of her album but were messages not to pirate her stuff.
Hit by a fine for misrepresentation of goods even though they were free.

The fake ones are probably spammers trying to get you to download a big zip file full of 'buy viagra' and other junk

SCO's new target

[rastamutz]

hey call SCO, maybe they'll find some... ehrrr lines ...

os/2 is in there!

[586]

Look at the file win2k\private\windows\shell\control\bitmaps\std.bm p
for a laugh

SCO did it!

[scharkalvin]

If anybody DOES see the code, perhaps they might scan it to see if it contains any GPL'ed code (stolen from Linux perhaps?) Hey maybe SCO stole the code! (SCO sues MS! Wait they can't Bill bought a license! OTHO they might anyway!)

Actually I wouldn't get within 100 yards of the windows code myself!

Clean room

[dpilot]

I seem to remember that an essential part of the Compaq clean-room clone of the IBM BIOS was monitoring cameras and a videotape record to show that only the correct information ever crossed the "Chinese Wall".

A few years back, I was trying to purchase a piece of software for business use, and vetting it with company lawyers was an essential part of the process. The author had developed it while working for a company, and that company had been sold several times. Eventually he took the program on his own, and was selling it as shareware. The ownership of the program was so murky the lawyer wouldn't let me buy it.

The lawyer used a phrase, "Fruit of the forbidden tree," that is probably relevant here. If an NTFS spec is derived from stolen source code, that spec is tainted, and any future code written based on it is tainted, too.

If you really want a clean NTFS spec, find a legit way to get access to the object code without signing or clicking the license, (I've seen any number of ways to avoid clicking the "I agree!" button.) and disassemble, then document. Preferably with a video record.

Interesting tidbits from the source..

[Anonymous Coward]

windows_2000_source_code.zip:

4667 *.c files. 5601 *.h files. 2255 *.cpp files. 26 *.hpp files. 1456 *.cxx files. 961 *.hxx files. 148 .asm files = 15114 total "code" files.

Lines of code:

<...>@<...>:/stuff10/win2k# for i in `find . -name '*.c'`; do `echo `cat $i|wc -l``; done | perl -le '$sum = 0; while (<>) { $sum += $_; }; print "\nLines of .c code: $sum";'

Lines of .c code: 4223425

<shell command omitted for the rest..>

Lines of .h code: 1205670
Lines of .cpp code: 1763501
Lines of .hpp code: 1684
Lines of .cxx code: 1363944
Lines of .hxx code: 194893
Lines of .asm code: 78500

Totalling 8831617 lines of code

Some grepping..

<...>@<...>:/stuff10/win2k# grep -r -i 'fuck' *
....
private/shell/shell32/copy.c:// want to fuck with.
private/shell/shell32/util.cpp:// the fucking alpha cpp compiler seems to fuck up the goddam type "LPITEMIDLIST", so to work
private/shell/shell32/util.cpp:// around the fucking peice of shit compiler we pass the last param as an void *instead of a LPITEMIDLIST
private/shell/shell32/util.h:// the fucking alpha cpp compiler seems to fuck up the goddam type "LPITEMIDLIST", so to work
private/shell/shell32/util.h:// around the fucking peice of shit compiler we pass the last param as an LPVOID instead of a LPITEMIDLIST
private/windbg64/debugger/tl/remote/ shell/windbgrm.c: // The user fucked up
private/windows/media/avi/verinfo.16/verinfo.h : * !!!!!!!!!!!!!!DOING SO FUCKS THE BUILD PROCESS!!!!!!!!!!!!!!!!
private/windows/shell/con trol/midi/map.c: // !!!this is fucked if a map goes to multiple physical devices

Bugs anyone?

<...>@<...>:/stuff10/win2k# grep -r -i 'a bug' *|wc -l
408

Curious; grepping for 'linux':

private/ntos/udfs/udf.h:#define OSIDENTIFIER_UNIX_LINUX 5
private/ntos/udfs/udf.h:#define OSIDENTIFIER_UNIX_MKLINUX 6

'grep -r -i's with no results: GNU/Linux, GNU GPL. Bill Gates, Steve Ballmer,

-- Hopefully Anonymous-Enough COWARD

Re:Interesting tidbits from the source..

[TheDigitalRaven]

I wish I had mod points for you.

Re:It's a TRAP!!! /Adm. Ackbar

[Afty0r]

Can the RIAA sue me for listening to a song I hear on my friends CD player if I have not purchased the song?

Yes, yes they can. They may, or may not be succesful, but to ensure that they are not, you would have to spend some of your money.

Sounds unfair, but that's the cost of justice in the USA.

I predicted this a while ago

[Anita Coney]

Back when Microsoft agreed to show Russia, China, etc its source code. When the whole world has a key to your house, locks are irrelevant!

Microsoft's Nasty Bugs

[kff322]

You know how windows freezes up a lot? Do you bugs by microsoft will be found that was purposely added

Has anybody thought of this?

[SpacePunk]

That Microsoft had the source leaked for Win2k and NT 4.0?

Their whole business model depends on upgrades. If people/companies keep using their NT 4.0 machines then MS makes no money on them. It is actually in MS's best interest to 'leak' the code then make an issue of the 'hackers can find ways of exploiting the operating system with the source code' argument. Remember people, FUD sells.

Re:Has anybody thought of this?

[Anita Coney]

That's a pretty interesting theory, but XP and W2k are so similar that any hacks anyone finds in W2k could almost certainly be exploited in XP.

Re:Has anybody thought of this?

[SpacePunk]

Yup, and there's an 'upgrade' to XP on the way also if I hear things correctly.

I love the irony

[Anita Coney]

The previous story stated that open source is necessarily insecure because it's open. I.e., that closed and proprietary are necessarily safer. But, when happens when the closed/proprietary door is opened?!

Security by obscurity is only a short-term solution. And only a moron would think otherwise!

Re:I love the irony

[jgabby]

But, when happens when the closed/proprietary door is opened?!

It simply proves the previous author correct! The open(ed) source is less secure than the same code closed source. And if it's not, why are we worried about the repercussions of this release?

--purposely facetious. don't hate me.

Re:I love the irony

[Anita Coney]

The mistake the previous author makes is in assuming that closed source can stay closed source.

I don't agree with the previous author that closed is necessarily more secure, but even if he's right, he's still wrong because what can be closed can be opened. It's only a matter of time.

Not correct

[demiurg]

IBM is actually smaller then M$.

IBM capitalization - 170.84B
MSFT capitalization - 290.91B

I guess you just don't know what you are talking about.

Re:It's a TRAP!!! /Adm. Ackbar

[shird]

From bugcheck.c, the code which makes the screen blue...

if (InbvIsBootDriverInstalled()) {

InbvAcquireDisplayOwnership();

InbvResetDisplay();
InbvSolidColorFill(0,0,639,479,4); // make the screen blue
InbvSetTextColor(15);
InbvInstallDisplayStringFilter((INBV_DISPLAY_STRIN G_FILTER)NULL);
InbvEnableDisplayString(TRUE); // enable display string
InbvSetScrollRegion(0,0,639,479); // set to use entire screen
}

Re:it's true - Better yet it was palnned.

[rippleone]

So many people are talking about open source stuff that no one has looked at the obvious. Microsoft did this on purpose. Let the code conveniently get out onto the net and then let more and more security holes be found. Nice sales tactic to get everyone to move to Windows XP or Server 2003. Microsoft - "you know, if most of guys out there refuse to upgrade then we will give you real reason to upgrade, this is our new licensing plan." Reminds me of mechanics damaging cars themselves just to do repairs.

It was done intentionally!!!

[rippleone]

So many people are talking about open source stuff that no one has looked at the obvious. Microsoft did this on purpose. Let the code conveniently get out onto the net and then let more and more security holes be found. Nice sales tactic to get everyone to move to Windows XP or Server 2003. Microsoft - "you know, if most of guys out there refuse to upgrade then we will give you real reason to upgrade, this is our new licensing plan." Reminds me of mechanics damaging cars themselves just to do repairs.

Re:It was done intentionally!!!

[perfessor multigeek]

Intentional release? I really don't think so.
Micro$oft has one of the strongest corporate cultures of any organization of the past hundred years. Their acculturation means make the Jesuits seem like they just test prospectives for eyesight and driver's licence.
That having been said, one of the fundamental tenets of the Micro$oft belief system is that source code is to be held close at all costs, kinda like the brain-damaged way that Palm continues to fight to insist that "smaller is always better" even while every other platform is furiously adding back keyboards, different form factors, etc.

To willfully open a codebase is to accept the inevitability of vulnerability, to surrender the myth of impregnable barriers and perfect seals. M$ is far too wealthy, too successful as they are, and too paranoid, from Ballmer and Gates on down, to be so bold.

Without doubt, this event will change tech history. You know it, I know it, even Jon Katz probably knows it. But even so, I'ld lay heavy odds that the folks in Redmond will still be denying key implications and consequences of this leak for at least (mark my words) four years.

Rustin

Re:It was done intentionally!!!

[dolson]

Yeah, that or they could go a different route and say "look, the source code is out there, and now there are more issues with security, just like all other open source stuff! We said this was the case, and now there is proof."

Re:It was done intentionally!!!

[everythingeverything]

Why did you make me think of this?

Re:It's a TRAP!!! /Adm. Ackbar

[ckaminski]

No, but it might be enough get a DA to get a subpoena for Microsoft's source and backups to prove compliance.

Maybe.

Holy C code batman

[BoneFlower]

This shit is real.

Includes kernel stuff, crypto code(ouch!), architecture documents, some stuff that looks like internal emails but I can't get them to open(will work on that later)...

This is FUN!

Re:The shit will hit the fan + Mirror

[timjdot]

Prediction: Windows marriage of Linux in China. We'll all be importing Chinese Winux in a few years. :-)

If Linux developers in the USA use ideas from Chinese Winux they will not know about a possible relating Windows copyright?

Worse yet, the leak will probably reveal how unadvanced Windows really is. Aside from the blue screen and bloat technical people will have to actually compare the implementations of Windows versus Linux. Scheduler for instance! Windows books always say it was a round robin but maybe we find it is more timesharing like the 2.3 kernel.

Re:Microsoft uses Perl

[relay_mod]

It's probably just a code generator, in which case the perl interpreter would not have to be included in Windows. Only non-perl code generated by a program written in perl would be in Windows, which wouldn't violate perl's license.

Microsoft press release

[scott_davey]

I just scooted over to microsoft's press room and saw these two articles next to each other:

February 12, 2004 7:30 p.m. PST
Statement from Microsoft Regarding Illegal Posting of Windows Source Code

February 11, 2004 5:00 p.m. PST
Microsoft on the Issues: Strengthening the Knowledge Economy

What a good way to strength the knowledge economy :-)

Re:"brags" about Windows security?

[AndyElf]

MSFT is in a lot of problems specifically *because* of thir market domminance. While I would whole heartedly support the opening up of the code in general, the issue they are facing is very simple: if they let it free, chances are that:

(a) vulnerabilies would be discovered *and* exploited by malicious groups *before* the white/grey hats ever get to them

(b) it will be just as difficult to get the install base to patch the wholes -- look how many unpatched old machines are out there, every Joe-user and your-grandma out there...

Linux and *BSD advantage here (and in a way Mac) is small install base *on top* of the thorough peer audit that has been going for years now. And we still get to find some bugs here and there...

Put it another way: it sucks to be M$FT, either way you cut it...

hall of fame

[jsrlepage]

made it to the posts hall of fame/shame

Breakdown of MS OS usage (thanks, Google)

[The Closet Optimist]

This is from Google's tallying, so it's probably a pretty good ballpark. Look at the second section, right side:

http://www.google.com/press/zeitgeist.html

Re:It's a TRAP!!! /Adm. Ackbar

[archen]

I agree that you should just say no. But what if someone who has no interest in working on Samba does something like figures out the MS impimentation of the SMB protocol and junk like WINS replication, then only publishes how the protocol works?

This is just a theory, but if the person who publishes it cannot be traced, and those who learn from the protocol specs never see the code, then I don't think there is much MS can do.

FreeBSD source code leaked too!

[cbmeeks]

Oh...wait. Nevermind. :-)

cb

Evidence

[zeux]

27117 07-26-00 22:00 win2k/private/ntos/w32/ntuser/kernel/security.c

This file is the absolute strong evidence that Microsoft did increase the security in the Windows kernel. :)

Re:The shit will hit the fan + Mirror

[danila]

Why? Why are you so much afraid? Imagine you are a programmer at WINE. You work hard to recreate necessary functionality, but then you stumple upon a roadblock. You simple can't make something work as it works in Win2k. So you fire up eMule, get the sourcecode, find the relevant fragments, read them a bit and then it dawns on you how it works and how your problem should be solved. Voila! You delete the code, wait a few days and then recreate the much needed functionality from scratch. To be completely sure you didn't "taint" WINE, you can undelete :) the code and compare it with what you have written.

If you are careful and don't just copy-and-paste the code, how can MS know that this particular function was written by you after looking at their code?

Re:The odds of getting the full source: experience

[danila]

No, inside Microsoft is a lot more like "Office Space" and anybody with motivation could get the entire source with little trouble.

I first read it as "No, inside Microsoft is a lot more like Open Source and anybody with motivation could get the entire source with little trouble."

tabs

[GerritHoll]

I do. You can find out about the tabstop in the source when tabs and spaces are mixed. If tabs and spaces are mixed, and the alignment looks screwed, the source has a different tabstop than the destination.

(Pythoneer speaking ;-)

Re:Very smart - MSFT flooded Kazaa with bogus file

[borfast]

A little bird told me that "windows_2000_source_code.zip" on FastTrack (Kazaa) is a good possibility... ;)

He also told me the file is about 203.8 MB in size.

The strange thing is that I've read somewhere that one of MS's people said the file was around 660 MB, which is odd, since the little bird didn't see any file of that size. The only similar size he has seen is a "Windows.Source.Code.exe" weghing around 733.1 MB but it's an .exe ... the little bird doesn't like .exe's and something told him that it wasn't it.

Re:It's a TRAP!!! /Adm. Ackbar

[Austerity Empowers]

Please. Then every employee of every software product around the world could be considered "co-opted" in court if enough doubt about whether the employee has seen the w2k code could be planted. Then every software company in the world would have to pay royalties to Microsoft. I'm not a lawyer, but let's use a little common sense.

COPYING code surely will get you in trouble, and it's easiest tested on open source code. Having seen an implementation ... Bah, consider it research. In this case, consider it an example of how NOT to design an operating system.

5 Overrated mods? You people here are nutcases.

[Ayanami Rei]

What did I say wrong? That I said something that if read quickly, without full comprehension, might be construed as criticism of the Samba project?
Way to jump the gun, Moderator! Did you read any of my followup posts before getting all hot under the collar?

And -1 overrated, so no one can M2. I can't believe this childishness.

what if..

[savuporo]

Ok, thats a lame release. If the hackers or leakers were in the MS corporate network, they should have posted it on Microsoft site.
Imagine thousands of users D/Ling it from download.microsoft.com or somesuch.
And if it were downloaded in this way, would MS have legal grounds for saying you cant have it ?

the irony of it all

[php-eric]

indeed - i almost fell out of my chair last night when i read the article on open source being more vulnerable and then scrolled up (or down?) and saw the article on MS source code leaks...

but more importantly..

[diamondc]

does it play OGG Vorbis?

Re:It's a TRAP!!! /Adm. Ackbar

[CheapScott]

I couldn't help it...I just had to look. It was actually hundreds of thousands of goto statements...interspersed with:

while(1) fork();

to moderate efficiency.

I'm now blind (a la "don't look in the Ark of the Covenant")...and of course running from both SCO and MS.

Freak

[johnjay]

I just noticed a brown dot next to your name which introduced me to the concept of "freaks" on Slashdot. It turns out I have a few. The thing is, I can't remember ever talking to you about anything. If you care to respond, I'd be interested to know why you consider me a "foe".

Regardless, have a nice day. I can't see any reason to object to your choice.

On topic: There are definitely parts of the Gnome/KDE GUIs that I would like to use on Windows. I really wish Windows would emulate the multiple-desktop environment that comes standard in Linux GUIs.

Re:Freak

[nickos]

I'd be interested to know why you consider me a "foe".

I honestly don't know (it would be nice if you could leave a comment to yourself and perhaps others when you change your relationship with someone). Most likely I disagreed with something you said to such an extent that I thought I'd mark you as a foe. Looking at you current sig ("Unless a Dem. candidate promises to continue and improve on current foreign policy, I'll vote for Bush. Defense first."), it could have been your politics. (No offence, but I don't think many Americans realise how objectionable the rest of the world finds the Bush administration)

Please don't take it personally. I use the friend/foe system to see who I generally agree/disagree with more that whether I like/dislike someone.

Sometime life is stranger than fiction...

[Thud457]

Windows is it's own pardoy.

Re:Someone got into Mac OS X's source and posted i

[ernstp]

What is Aqua?

If it's a Spec it's avaliable here.
And if it is a bunch of bitmaps they are already on my computer.. you know, as a part of OSX?

So does it compile under GCC?

[Twyford]

That would be an interesting test. Anyone want to try? :)

Don't do that yourself!

[Via_Patrino]

I've seen some comments about people greping the code themselves, so I must warn: Don't do that yourself! Downloading the code is illegal.

Downloading == copy. And the code is copyrighted. Altought you may find someone in a country which copyright laws don't cover computer software or something like that.

Re:It's a TRAP!!! /Adm. Ackbar

[Beryllium Sphere(tm)]

The entertainment industry has been dealing with this for decades.

Scripts, demo tapes, etc. from random people get returned in envelopes sealed with metal tape after creation of a log proving that the creative people never saw them.

That's because real-life copyright cases often hinge on the question of whether the alleged infringer had access to the work being sued over. If you never saw it, it's pretty easy to argue that you didn't copy it.

Then there's the trade-secret angle. I'm not a lawyer either, so I don't know whether this publication has cost MS their trade-secret status, but it's pretty safe to figure that whoever did it violated an NDA.

"Congress must act now to rein in the Patriot Act" - Newt Gingrich

Actually, the Windows 2k...

[akoni]

The Windows 2k source tree is a little over 30GB and the Windows XP source tree is about 40GB. So, yes, you are correct. The combined source tree's for all non-longhorn windows 32 bit computing hovers around 300GB. Don't get me started on the office source code tree...now that's funny. On a side note, the amount of code written in the Mac group for office apps is considerably smaller than the main office software group. This is mostly due to the fact that they are a tighter group of progamers who crack out some sweet code.

Re:It's a TRAP!!! /Adm. Ackbar

[0x0000]

I think it's worse than just a simple trap.

The Reuter's article on Yahoo contains a number of inaccuracies that are clearly prejudicial, and are probably sourced within Microsoft.

It (the story) amounts to an obvious attempt to spin up a scenario that will lead ultimately to criminal prosectution of persons involved in Open Source. And the story being such an obvious attempt at spin doctoring could lead one to believe there is more going on here than one poorly written news story...

Apparently Gates & Co. have decided their civil case fronted by SCO is not quite strong enough, and are trying to establish criminal precedent in order that, whether the current SCO effort succeeds or fails, the next case will be criminal.

One could hope that the courts will develop enough tech skillz to determine that the line

for (int i=0; i < cnt; i++) {

showing up in both windoze and Linux code does not constitute proof of theft under some Gatesien system of jurisprudence ...

Examples of the (imo) prejudicial language in the story [emphasis mine]:

...copies of the source code [...] were being traded over the internet

There is no evidence cited that the code is being "traded". It appears that it is being distributed, but I haven't seen any reports of it being exchanged for anything else. This is key, since the languaged used here implies a profit motive on the part of the alleged "traders"; necesary for the criminal prosectution because there is a need to establish that the code is worth a great deal...

Source code is the ... lifeblood of any software company

This sounds like it came straight out of a Microsoft publicist. It is an emotional appeal statement, designed to imply a henious threat to the alleged victim, Microsoft (and by implication, SCO).

The statement is factually inaccurate, even as metaphore. Source code is a principle part of the products manufactured by most software companies, but expertise in the creation of source code is more properly the "lifeblood" of the company.

Of course, Microsoft is a bit challenged in the expertise dept, but that should be applied to "any software company"....

Microsoft has [...] shared its source code with close partners and carefully chosen organizations, with legal agreements that threaten litigation in the event of that any of is leaked.

...followed by...

"It's illegal for third parties to post Microsoft source code [...]"

If it is indeed "illegal" for 3rd parties to post the sources, then why would the aforementioned "agreements" require threat of civil action? If it's illegal, there should be no need to lititgate. The threats would be of prosecution, not litigation.

Furthermore, the word "share" here is ridiculous. If you've ever looked at what it takes to get an NDA to look at M$ sources, there's no "sharing" to it. It's a business transaction, and it doesn't happen unless M$ gets the lions "share" of any potential benefit.

Software companies that create programs running on Windows need access to source code to build their own products.

WTF? Well, admittedly I haven't written any "programs running on Windows" in quite a few years, but I no idea things had changed quite that much... [that's sarcasm in case you can't tell; the statement is just plain wrong]

Microsoft said that it was working with the Federal Bureau of Investigation and legal authorities to try and track the origin

For posterities sake...

[metalslinger]

Just in for the record :). This is an awesome thing that's been done. However it's not useful if it's not willingly done; referring to the source code being revealed. They should do it voluntarilly so they can get the good press and good coders in on it. Now it will only get bad press and anyone who happens to have the source and makes fixes will be too scared to release it; even to MS. Shame... well maybe MS will spin this properly.

What a big topic

[Graspee_Leemoor]

WOW.

B-I-G topic.

The problem is that I can't say anything, make any jokes etc. without the risk of being redundant. Not even sad old me has time to read all those comments.

I mean, f'God's sake, even people who browse at +5 have to read more than one page! (And I read at -1).

graspee

Thank you Microsoft! Just in time!

[Tibor the Hun]

Now I have something to give to my honey for Valentine's!

The butterfly comes through for me again!

Mainsoft has a source license

[Anonymous Coward]

I used to work at Mainsoft (from nov 1994 - nov 1996) and worked with the mainwin toolkit. Part of my responsibility was to mine the Windows NT source code we had to port some parts into the mainwin toolkit.

Mainwin began life as a reverse-engineering of the win32 API's. What they found over time is what the Wine and Mono teams are finding the hard way; Microsoft has jillions of programmers, and are very willing to keep rewriting their platform, and to add tons of new modules, at a rapid pace. You simply cannot keep up if you're reverse engineering, because Microsoft will outpace you 10 times over.

Since Mainsoft is a commercial enterprise the then President convinced them to get a source license, using the above argument. Jeff got laid off the same time I did (nov 1996).

At the time I was there, we had source trees to DOS 6.xx, Win 95, NT 3.51, and NT 4.0 beta 2. Remember this was in 1995-6 timeframe, and those were the then-current releases. We also had source for Internet Explorer v3.x and were working to port it to Unix. Mainsoft later collaborated with Microsoft to port IE v4 to Unix, and Microsoft made that port available on their web site.

I was the first one to port any source code from NT into the Mainwin product. We had a number of listbox related bugs, and I had a theory that since our Listbox.c was 2000 lines, and Microsoft's list{1,2,3,4}.c source was over 8000 lines, that we were missing a few pieces of functionality, and got permission to experiment with moving Microsoft's source to the Mainwin source tree. It was a successful experiment, and let us close out a whole slew of listbox related bugs.

With having our own copy of the source tree, we were also able to port various modules like WINSOCK and COM directly from their source code. COM was especially important because it was, at the time, 2 million lines of code, and a totally daunting prospect of reverse engineering the functionality.

In any case, I was wanting to give a little background since you guys are talking about Mainsoft. It shouldn't be a surprise that Mainsoft has a Windows source license.

- David Herron

WE PASS IT!

[DrunkenTerror]

/. Hall of Fame

Re:WE PASS IT!

[johnfreez]

i doubt we'll make it passed the 3042 mark but what the shmell?

hi mom! :)

hidden vulnerabilities

[bstil]

article: the number of industries and critical systems that are based around these technologies that could be damaged by new exploits found in this source code is something that doesn't bare thinking about.

what could be a better argument for open source code, in which potential vulnerabilities are always exposed to the developer community?

I just wanted in on this

[the Man in Black]

So um, yeah. Someone make sure to get this code over to the Samba team, STAT.

OK, that's it. Bye now.

tar source

[bstil]

Windows.Source.Code.w2k.nt4.wxp.tar

isn't it ironic that the leaked source would be distributed in a *nix archive file format?

Re:It's a TRAP!!! /Adm. Ackbar

[benlinkknilneb]

Google for "Windows RG"... someone actually made a parody of Windows (sorta recursive, I know, but hey... it was pretty accurate)

eDonkey hash-link (elink); Jigle search

[atreyu42]

Here is the Jigle search for the source code of Windows (elinks there).

Seems like it is true

[jrasmussen0]

http://www.microsoft.com/presspass/press/2004/Feb0 4/02-12windowssource.asp

REDMOND, Wash., Feb. 12, 2004 -- On Thursday, Microsoft became aware that portions of the Microsoft Windows 2000 and Windows NT 4.0 source code were illegally made available on the Internet. It's illegal for third parties to post Microsoft source code, and we take such activity very seriously.

We are currently investigating these postings and are working with the appropriate law-enforcement authorities.

At this point it does not appear that this is the result of any breach of Microsoft's corporate network or internal security.

At this time there is no known impact on customers. We will continue to monitor the situation.

Damned Censorship

[agentforsythe]

"Our Internet filtering software has prevented access to the site: http://www.hopf.demon.co.uk/humour/win98.txt.
Ple ase contact the relevant Helpdesk if you feel this message to be in error. "

what was on the site? I suppose I'll check that when I get home.

Re:It's a TRAP!!! /Adm. Ackbar

[Krunch]

Found it. I have already seen it but I forgot about it.

Don't do it.

[lay]

Really.

Don't go around propagating the source code for this thing. Millions of people use computers with these operating systems, people spreading the code could easyly being contributing to *MAJOR* problems arising.

My 0.02

Re:Don't do it.

[kfuq]

Too late...

It's all over the dam place now..

Re:Don't do it.

[calyptos]

These problems shouldn't exist to begin with. By distributing it you are encouraging microsoft to fix their errors and actually create a decent operating system. This is by far the most helpful thing that has happened for microsoft customers. There will be a time when things are dirty to begin with, but throwing mud on a dirty man makes him want to shower sooner.

Re:Don't do it.

[iggymanz]

I do believe companies have the right to have closed source & to profit by it should they choose that, and that it is wrong to steal that code. But I have to laugh because of your post; we've *already* had 100's of millions of dollars of damage when MS operating systems source were secret. We've already had *MAJOR* problems. Crackers generally don't cause these problems by reading code, they

1. throw garbage at the system until something
breaks
2. use social engineering to get the end user to execute code
3. make traps involving already patched bugs knowing most people are lax in applying them

Maybe this will light a fire under Microsoft's butt to start taking security seriously.

Re:It's a TRAP!!! /Adm. Ackbar

[__aanebg9627]

My wife *is* a lawyer (working in IP). She was reading this (AstroDrabb) over my shoulder, and said; "He doesn't know what the **** he's talking about. He should go to the EFF site and do some reading. His interpretation of the law is worse than what my C++ coding is like, and that's saying something." (AFAIK, she doesn't know how to program C++. Only BASIC.) Things to check: derivative works, DMCA, reverse engineering. "Don't give legal advice if you're not a lawyer." "Wait...never mind. DO give legal advice! We need the money."

Re:It's a TRAP!!! /Adm. Ackbar

[Myopic]

no, but the RIAA can sue you if you turn around and make a song just like it

just a thought

Re:It's a TRAP!!! /Adm. Ackbar

[AntonyBartlett]

Or, better, get someone who can read C(++?) but can't write it

Probably impossible - it's far far easier to write code than it is to read somebody elses.

Re:It's a TRAP!!! /Adm. Ackbar

[Derek Pomery]

The two layer approach doesn't really require the person not know how to write C/C++ - only that they not contribute any code.
Not certain why parent added that extra requirement.

No offense taken

[johnjay]

That makes sense. I haven't bothered to learn the system, but I can see how it is useful if you would rather not waste time reading someone whose ideas you find to be mostly noise. The names for each state are odd, but that's not your choice.

As the US presidential race drags into gear, the amount of political chatter on this site is increasing. I wondered about those poor souls who just want to read about technology and don't want to hear all the bickering. I guess careful use of the Friend/Foe system could help tune in the actual on-topic discussions. (On the sig. - I could explain myself, but you expressly don't want to hear it, so I won't.)

On the other hand, I have gone off on people a few times in the past, but I can't find much record of it since my page only shows the last 20+ posts. I could have actively offended you at some point.

Having a comment next to each user would be a helpful addition.

Anyways, sorry to take up your time. The terms "foe/freak" amused me and your post was the first time I noticed it.

Solitaire!

[PhraudulentOne]

Finally! The source code to Solitaire!

2K NT Haiku?

[DanTheLewis]

Did it for DeCSS. I don't see why someone doesn't take their ink-brush in hand and start summarizing. (someone uninvolved in OSS projects)

Why does trash attract so much interest?

[tiger99]

Why? It is as if someone knocked over a rubbish bin in the street, and every passing Slashdotter spent the next week talking about its contents, all the cockroaches in the kitchen waste for example.

It is only garbage that has leaked, after all. It has no real value to anyone, although it may have a perceived value to the Convicted Monopolist and those unfortunates who have been misled by his marketing machine. In fact, like garbage, its real value, based on its cost less the cost of cleaning up after each problem with it, is negative. It has a negative environmental impact, just like what goes to incinerators and landfill sites. No doubt people are picking over it as I type, laughing at certain features, as they might find amusement in the contents of some rubbish bins.... The difference between this code and garbage is that garbage is the unusable left-overs from something inherently useful, or an unwanted byproduct of a useful process, unfortunately the Monopolist has not come up with the good part of which the garbage is the remnant......... (Unless of course it is the left-over garbage from Wordpad, which is of tolerable quality, but in that case the garbage outweighs the wanted product at least 10000:1, which must be the lowest yield in history.)

Surely, even SCO is more profitable to discuss that the trash of Redmond. At least SCO's OS (or what they claim is their's...) is fairly stable and secure.

Seriously though, I might even have a look myself when I find out where it is. Then I might go out and rummage in some bins....

Re:Why does trash attract so much interest?

[Anonymous Coward]

Unless of course it is the left-over garbage from Wordpad, which is of tolerable quality

Hey, edit.com was quite nice too. Split windows, automatic indenting, and other stuff all in a console text editor.

Re:It's a TRAP!!! /Adm. Ackbar

[AntonyBartlett]

The two layer approach doesn't really require the person not know how to write C/C++ - only that they not contribute any code.
Not certain why parent added that extra requirement.

Cool! Is this a widely know approach (kind of how clean-room development is a widely know approach)? - and if so, where can I find out more about it, please? Or is it just an idea that we're kicking around here on slashdot?

Re:The shit will hit the fan + Mirror

[tiger99]

They can't demand anything. WINE developers are innocent until proved guilty, under tha laws of most of the English-speaking world at least.The Convicted Monopolist would have to show places where code had been copied, as will McBride when his case comes to court.

A smart move by WINE developers would be to set up a clean-room environment where if anyone sees the code, he may analyse it and write a specification about how it works, which is then passed over to a developer to code a new module of equivalent functionality. That is how Compaq and others were able to clone PCs originally, the BIOS source was in te IBM Advanced Reference Manual or book of similar title, they did a clean room implementation where the coders had no knowledge whatsoever of the code, and it has stood the test of time legally.

Now, anyone writing code to a spec is acting legally, the grey area is that it "may" be illegal to read the code which has leaked. I think that the actual illegal act is the publishing, not the reading, under copyright law, and there need be no, and must be, no subsequent disclosure of what was read, especially in the clean room.

With a bit of care and intelligence, this leak may well be of enormouis assistance to WINE, as it may help them exactly reproduce undocumented bugs which others have worked around, so that the workarounds don't break on a clean OS.

If they are smart (which is not in doubt) they will do the analysis of the leaked code in a country which is not signatory to the Berne convention, then they would be untouchable (except that the Monopolist might pressure the unelected imbecile who poses as president into going to war against "terrorism".)

Of course the code is most likely such a heap of rubbish that it is of no use to anyone, but that could easily be deduced from observing the behaviour of the end product, without needing access to the source.

Re:It's a TRAP!!! /Adm. Ackbar

[Lord Kano]

No, but it might be enough get a DA to get a subpoena for Microsoft's source and backups to prove compliance.

IANAL, but it's well established case law that you can't use illegal means to gain evidence.

You need proof before you can subpoena anything.

LK

Re:It's a TRAP!!! /Adm. Ackbar

[Lord Kano]

Look at whats happening in the SCO case.

SCO is making a lot of noise. Not much else is happening in the case.

LK

Re:hmm seems a bit buggy

[tiger99]

It was said to be a threat to national security because of 1 (or was it 3) insecure APIs which could not be fixed, and would be exposed. It has now been exposed to enemies of the US. Does that not mean that the Convicted Monopolist is a traitor?

I think the 1 problem was raw sockets, which is pretty well exposed by Mr. Gibson at www.grc.com, but I may be wrong.

Even the Frogs have seen the Windoze source, and we know how much thay hate the US, and the UK for that matter, and I mean at government level, most individual French are very nice people indeed. It is certain that some of the countries which have seen the source, or some of the employees concerned, who may have their own little axe to grind, will do something like this sooner or later. Of course it may be in retaliation for having suffrered vast economic damage due to Windoze/Outlook virii in the last few weeks, a bit of revenge.....

Re:It's a TRAP!!! /Adm. Ackbar

[Derek Pomery]

I have in fact heard about this before.
I don't have any references though, sorry.
I'm sure it will happen eventually.

You might ask the Blackdown people. I believe while they require developers to attest they haven't seen Sun's Java source, they will accept advice from those who have.
I could be wrong, but worth asking.

Re:It's a TRAP!!! /Adm. Ackbar

[Shardis]

I *wish* it was derivative, it might make it more reliable...

Re:It's a TRAP!!! /Adm. Ackbar

[jay2003]

Seeing the source is only a issue if the source contains trade secrets. Now the the code is widely available, the question is whether the information contained is still legally a trade secret. Microsoft's legal department will undoubtably insist it still is.

The best predcident I can think of is the unauthorized disclosure of RSA's RC2 & RC4 algorithims. The poster is correct that it's better not look and avoid the fight, not because it is not legal look, but rather Microsoft has the resources to bury you in legal challenges.

You'd be much worse off looking at your employeer's legal copy of the Windows source because that copy is definately protected by trade protection.

Re:It's a TRAP!!! /Adm. Ackbar

[Mr Z]

Evidence of binary similarity could be sufficient to persuade a judge to compel disclosure of source code as part of a discovery process.

So, no, you won't win a trial with the binary evidence alone, but you might win a motion to compel disclosure. The whole "probable cause" notion--it's enough to get a search warrant but not enough to convict.

PS. IANAL.

--Joe

Here it is

[Quixadhal]

% cat windows.c

#include

int main() {
printf("Loading...");

while(1) {
usleep(10000);
printf(".");
fork();
}
return 0;
}

Yup - He's the real McCoy.

[BIGstan]

...I'm really bad at detecting sarcasm ...
That proves it - he's for real.

Wow.

Hmmmm. I wonder who this AC is.

[perfessor multigeek]

I'll betcha a nickel that this comment and quite a few others are being posted by Micro$oft employees. It's just got that classic M$ pseudo-reasonable, highly informed, but somehow off feel to it.
We're watching history, folks and don't you doubt for a second that we'll being seeing vast mounds of astroturfing in the days ahead. Again, mark my words, someday it will come out in memoirs or elsewhere that a key part of how M$ is reacting is having hordes of their staffers go online and do spin control.
Don't forget just how many smart, aggressive folks with smart, aggressive bosses depend on Bill for their paychecks and will be sent off to minimize the damage of what is sure to be causing no small amount of realignment out Seattle way.

Rustin

Re:It's a TRAP!!! /Adm. Ackbar

[ckaminski]

IANAL either, but I had thought that applied onto to illegal searches and seizures by police officials. If I steal your gun, that you used to kill your neighbor and give it to the police, they can use that as evidence against you. In fact, that's the whole point behind much of this nation's (U.S.A.) whistleblower laws.

Why worry about Wine???

[localhost00]

The US Government tried banning Wine in the twenties and it failed miserably!

Re:Why worry about Wine???

[localhost00]

I know what Wine is. You apparantly failed to see the pun that was intended here.

Re:Why worry about Wine???

[calyptos]

what are you talking about "comeback"? i'm not attempting to insult anyone or go into a fight. it is merely an attempt to inform someone who was apparently uninformed about windows emulation software. I'm sorry for trying to help someone.

The secret to beating Solitaire...

[LinuxParanoid]

AT LAST! The secret to beating Solitaire... This could perhaps be the most significant event of our times!

Shh, don't tell anybody but the solutions for all 32,000 Microsoft FreeCell deals (except for number 11982 which can't be won) have already been posted!!!

I feel pathetic for knowing this.

At least I didn't try playing them all myself, right?

--LP

Re:It's a TRAP!!! /Adm. Ackbar

[Curtman]

Are you paying attention though?

• We have produced already significant lines of code from Dynix, and we are prepared to produce, and the reason we have not produced it, by the way, Your Honor, is because you ordered us not to.

Seems anyone with even the slightest of "evidence" can get the source introduced into court.

Re:It's a TRAP!!! /Adm. Ackbar

[Spy Hunter]

You've never seen an actual Windows 2000/XP blue screen, have you? They are different from the old Windows 98/ME blue screens; they don't use text mode any more.

"Your Sinclair"?!?!?!?!

[perfessor multigeek]

Good Lord, sir, you hereby win my award for Intriguingly Informative Old Timer for this thred. Nice to be reminded that I'm not the only one around here who was a geek before last month ;->

btw, thanks for the naming convention heads-up, it matches what I've read in an old MS doc I've got sitting around. And good luck with your film.

Rustin

Some goodies from the source code comments

[Swedentom]

Here's some goodies I found in the code: (yes, they're real)

shell/win16/commctrl/ctl3d.c: // Some ugly shit goin' on here!
inet/controls/framewrk/ctlview.cpp: // wow, this sucks.
inet/mshtml/src/site/text/linesrv.hxx:// basically an oversized v-table. C sucks.
inet/urlmon/search/b4hook.cxx:// SUPER HACK FUNCTION because InternetCrackUrl sucks.
shell/browseui/iaccess.cpp: // This interface sucks.
shell/ext/webcheck/throttle.cpp: // Hey! This sucks dude. User said no (or we couldn't increase the cache).
shell/ext/cscui/dll/filelist.h:// fnl.AddFile(TEXT("\\\\performance\\poor"), TEXT("sucks.doc"));
shell/ext/ftp/priv.h: extracted in such a way that we hit the net. This figgen sucks!!!
shell/ext/msident/multiusr.cpp: // Here ends the suck
shell/ext/msnspa/proxy.c: // BUGBUG -- Win95 sucks. Close the socket and try again
windows/media/avi/drawdib/drawdibi.h:#defin e DDF_BITMAP 0x00040000l /* Display driver sucks! */
windows/media/avi/mciwnd/mciwnd.c: // this manually sometimes because GDI sucks the big wazoo.
inet/wininet/ftp/test/multfind/multfind.c: printf("Ha! There is no verbose mode, sucker. Try again\n");
inet/wininet/http/headers.cxx: // "HTTP/1.0 302 Try again, sucker\r\n"
ntos/w32/ntcon/server/output.c: * ICK!!!!!! Convert to chars. This sucks. We know
inet/mshtml/src/site/text/lscomplx.cxx: // things suck in some more text.
windows/shell/shole/shole.c: // If we have a fancy error message, hide ugly message
shell/ext/docprop/propdlg.c: // This code is added for bug 188 and the code is ugly !! :)
inet/mshtml/src/site/text/onerun.cxx: // Gotcha. Got a previously cached sucker
inet/mshtml/tried/triedit/lexer.cpp: // but sucks egss for values.
windows/media/avi/compman/icm.c: // Don't show a preview if we can't draw the damn thing!
sdktools/vctools/rcdll/p0io.c: //- I'll be the first person to admit that this is an ugly solution, but
NV_DECLARE_TEAROFF_METHOD( DoTheDarnPasteHTML, dothedarnpastehtml, (IMarkupPointer*, IMarkupPointer*, HGLOBAL ));
shell/lib/util.cpp:// _SHPrettyMenu -- make this menu look darn purty
shell/comctl32/cutils.c:// Don't freak out about this code. It will do nothing on NT, nothing yet
inet/mshtml/src/site/text/linesrv.cxx: // None of the restrictions apply, lets blast the sucker to the screen!

Re:Some goodies from the source code comments

[ChopsMIDI]

heh....that's pretty funny. Lucky for me, I never write comments.

Re:It's a TRAP!!! /Adm. Ackbar

[Anonymous Coward]

Haven't you ever seen a STOP fault? Sure, it doesn't use the 80x25 text mode, but it does use the 80x60 text mode. And it sure is blue.

If you have seen one, it's easy to reproduce: just take Linux laptop with IrDA, point it to a Windows laptop with IrDA, and run the irping command. You will immediately recieve a STOP fault.

Re:It's a TRAP!!! /Adm. Ackbar

[holt]

I disagree. I find that it takes a much deeper understanding of the language to create good code than it does to understand it. It's the same with art - it takes considerably more skill to be a painter than an art critic.

Re:It's a TRAP!!! /Adm. Ackbar

[TKinias]

scripsit Brendan Byrd:

One word: Compaq. Remember the IBM chip? Remember clones? Was that derivative work or reverse-engineering?

I don't think copyright can apply to devices, only to written, visual, or audio works. That's what patents are for. Copyright is the default -- that is, unless I waive it, you can't copy my book (or whatever). If I make a snazzy new cigarette lighter, though, I can't stop you from manufacturing the exact same thing on your own unless I go out and explicitly patent it.

This is why the whole concept of ``IP'' just muddies the water, because patents, copyright, and trademarks are all very different things.

Re:It's a TRAP!!! /Adm. Ackbar

[master0ne]

what version of the source did you grab? mine was 200Mb (compressed) lines of: while(fork()); while(1) sched_yield();

Re:The shit will hit the fan + Mirror

[0x0d0a]

You bring up an interesting point. What if the Windows source was analyzed for stolen GPL code? Wouldn't it make that part of the Windows OS GPL?

No. It *would* mean that Microsoft had infringed on the original author's copyrights -- they never had rights to use the code in the first place.

You can never "accidently GPL" something you wrote by simply combining your (GPL-incompatible) code with GPL code. However, if you do so, and your code is not GPL-compatible, you *are* liable for copyright infringement.

I don't think the FSF would go after Microsft for infringement unless the infringement was pretty severe or obviously deliberate. The FSF has been pretty reasonable in the past with GPL infringements -- they want to discourage folks from stealing code, but neither are they ambulance-chasers, trying to get multi-bazallion dollar settlements.

Re:Pointless Post

[Wawazuzu]

n/t

Why you'd want to look at the Windows code

[mdenham]

Step 1. Look at the ENTIRE Windows source. I'd suggest making sure that you can do this legally. Step 2. Whenever possible, optimize code by hand. Whenever bugs are blatant, fix that code. Step 3. Make sure the whole thing compiles correctly when finished. Step 4. Burn the fixed source to DVDs. Step 5. Mail the DVDs to Microsoft, along with a bill for the hundreds (or thousands) of hours spent fixing their code. Charge $60/hour.

Re:It's a TRAP!!! /Adm. Ackbar

[tchernobog]

"Can the RIAA sue me for listening to a song I hear on my friends CD player if I have not purchased the song? Of course not."

Well, I ain't sure the RIAA. But I know that here in Italy the SIAE can do it for sure. Obviously, they cannot check _everyone_, but they have the power to do so, if they will. Think about that.

Re:It's a TRAP!!! /Adm. Ackbar

[AstroDrabb]

Your friend goes out and legally purchases a music CD, brings it home and pops it into his player. You knock on his door and enter his home and happen to hear the CD his is legally playing. Your saying that the SIAE can sue you for that? That is just insane!

Re:It's a TRAP!!! /Adm. Ackbar

[tchernobog]

I haven't said it's fair, or understandable. It's just italian law. ;) Taken to the letter, I admit it, but this is true. Theorically (but you've got to find a good lawyer to sue someone on this) it's also forbidden listening to music with a stereo in public places, since it's violating the law that "forbids the reproduction of copyrighted music in public places, for money or for free" to an audience. You can just listen to it indoor, at home ("domestic usage"), but watching it with your family is already a violation of the law. Beware, if you listen music with your portable cd player in bus... if someone doesn't like it, then he can denounce you to SIAE! :) ------ 2004 : twenty years after 1984. Things got improved. For worse.

Re:It's a TRAP!!! /Adm. Ackbar

[AstroDrabb]

She was reading this (AstroDrabb) over my shoulder, and said; "He doesn't know what the **** he's talking about.

Wow! Your wife sounds like such a nice lady. Boy how I wish my wife had a mouth like that. You must be proud! And we all know what high values lawyers have!

I am a senior programmer not a lawyer. Where in my post did I say I was a lawyer? In fact, I said I could be way off base. So you and your wife can go chase an ambulance or something. I am sure there is someone who stubbed their toe that your wife can try to sue. Oh, and maybe your wife and you can take a few reading lessons to learn how to read a simple post. I guess this sentence in my post is hard for your lawyer wife to understand:

*Note*: I am not a lawyer and I can be completely wrong about copyright laws.

A foul mouth and poor reading comprehension, you landed a real keeper!

Re:It's a TRAP!!! /Adm. Ackbar

[bigchris]

Uh... for Microsoft it's not about the money. It's about sowing the seeds of fear, uncertainty, doubt into the minds of potential developers and administrators.

They'll be thinking:

"Can I contribute to this project without getting into legal trouble?"

Maybe MS did release the source "accidently" - this would serve their purposes quite nicely

putting a $ in "Micro$oft"

[perfessor multigeek]

LOL

Oh, no question, the use of the dollar sign is a cheap shot. But, hey, at least a quarter of why I hang out at /. is to be able to indulge my whims to engage in cheap shots :->

Maybe my serious stuff would be read more if I were to adopt a more "proper" tone but after too many years in jacket and tie (or even suit-bound - blech!) in flourescent-lit office buildings, I just can't be bothered.

I mean, criminy, I've been in self-imposed exile from the land of corporate jobs and "serious" business prose for over three years now and have just come home from the mushiest, sappiest, flat out cutest Valentine's Day dinner of my life, part of which was spent discussing the implications of my swiftly growing business and my swiftly improving finances. So doggone it, the silly letter usages stay. The world will just have to survive the trauma of it all.

Down with propriety! Hail giggling and ditzy cheap shots!

Rustin

Re:It's a TRAP!!! /Adm. Ackbar

[AntonyBartlett]

I disagree. I find that it takes a much deeper understanding of the language to create good code than it does to understand it. It's the same with art - it takes considerably more skill to be a painter than an art critic.

Who said anything about good code?! - I thought we were talking about the source for Windows!

Code that easy to follow is a very very rare commoditiy indeed - actually I've only ever seen one such program - and yes, I'm certain it was harder to write than it was for me to read. Normally the only way to understand a program is to fiddle with it and see what happens. At least well documented interfaces (API's) are slightly more common.

I mean, don't get me wrong, I believe every reasonable effort to make code more readable should be made. I just happen to think that writing code that is that easy to read would require unreasonable effort, even if you factor in the hit you know you're going to take on the maintaince side of things if you don't do it. Oh, and it would be almost a sin to accidently introduce a bug into code that works perfectly well, in an effort to make it more readable - and eventually this is envitable unless you confine your efforts to comments.

Further more, a deep understanding of the language has about as much to do with writing good code as knowing one end of a paintbrush from the other has to do with being a great artist - it's a pre-requistite, nothing more. Calling something a programming "language" does the thing too much credit, anyway - as far as I'm concerned they're all just syntaxes.

Sartre got it wrong when he said hell is other people. Hell is other people's code.

Re:It's a TRAP!!! /Adm. Ackbar

[julesh]

Source code is the ... lifeblood of any software company

This sounds like it came straight out of a Microsoft publicist. It is an emotional appeal statement, designed to imply a henious threat to the alleged victim, Microsoft (and by implication, SCO).

The statement is factually inaccurate, even as metaphore. Source code is a principle part of the products manufactured by most software companies, but expertise in the creation of source code is more properly the "lifeblood" of the company.

Yep, I agree. Looking around my company's server hard disks, I think I could liken source code more to that disgusting icky stuff that smokers get in their arteries...

Microsoft and RIAA

[jamesl_89]

I lost my internet connection and then about an hour later I got a call from my ISP....

What's the difference?

[dacaldar]

Most people are breaking the M$ licence by copying it from a friend anyway...
So if you manage to compile the source code successfully, I'd imagine you are still breaking the licence.

Re:It's a TRAP!!! /Adm. Ackbar

[THENate]

A binary comparison can give reasonable cause. after that it's a matter of subpeona, and a damn good lawyer.

Oh, and barrels of cash.

Windows source

[ward.deb]

Where do we need that source for anyway? We all use Linux, don't we? :P