Slashdot Mirror
David Auerbach Explains the Inside Baseball of MSN Messenger vs. AIM
In N+1 magazine, David Auerbach explains what it was like in the "Chat Wars" of the late '90s, when he was the youngest person on the team developing Microsoft's brand-new messaging app, in the face of America Online's AIM, the 900-pound gorilla in the room. Auerbach explains how he used a network analyzer to fake out AOL's servers into letting Microsoft's client connect to AIM as well.
"AOL could only block Messenger if they could figure out that the user was using Messenger and not AIM. As long as Messenger sent exactly the same protocol messages to the AOL servers, AOL wouldn’t be able to detect that Messenger was an impostor. So I took the AIM client and checked for differences in what it was sending, then changed our client to mimic it once again. They’d switch it up again; they knew their client, and they knew what it was coded to do and what obscure messages it would respond to in what ways. Every day it’d be something new. At one point they threw in a new protocol wrinkle but cleverly excepted users logging on from Microsoft headquarters, so that while all other Messenger users were getting an error message, we were sitting at Microsoft and not getting it. After an hour or two of scratching our heads, we figured it out."
Eventually, though, AOL introduced x86 assembly code into the login protocol, and that not only stymied the MSM team, but led to some interesting warfare of its own. Auerbach's story sheds a lot of light on both good and bad aspects of corporate culture at the start of the 21st century, at Microsoft as well as other companies.
if it were applied to actually useful things? We'd have the green leisure society figured out for the entire planet.
Mostly random stuff.
Wasn't ICQ the biggest player back then?
If I did this, I would likely be facing criminal charges ... how is it that corporations can do this kind of stuff with impunity?
There seems to be a huge double standard in the way 'people' who are people are prosecuted under the law, versus how 'people' who are corporations are.
And once again, I will take the opportunity to say the problem is the notion that you have 'people' who are corporations.
Lost at C:>. Found at C.
The AOL coders did not try to incorporate a challenge and response system based on public/private keys. Or use some sort of digital signature in their clients to authenticate themselves as the "true build" from AOL. Not surprised. After all they wrote AOL.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
The End.
I realize it would've required users upgrading, but at the time this was going on, most of the people using AIM were pretty comfortable with that process.
It was a smart move by Microsoft though. Why use the AIM client which can only talk to AIM users when you can use MS to talk to AIM and MS users?
I guess even our sayings are getting fatter, because I've always heard it as "800-pound gorilla" :P
But AOL’s client had a security bug in it, called a buffer overflow. [...] AOL knew about this bug in their program and now they were exploiting it! That was what all those double zeros were for—they were just filling up space in the program’s buffer until they hit the end of the AOL client’s buffer and started overwriting executable code with the remainder of the protocol message. AOL was causing the client to look up a particular address in memory and send it back to the server.
There's something that you could always count on AOL for -- Respect for the users. Most companies, when faced with a trivially exploitable buffer overflow that could cause their chat client to execute arbitrary code would classify it as a bug and feel compelled to fix it, but that's not the AOL way. Instead they changed it from a bug to a feature which enhanced security by verifying the client's identity.
And if somewhere along the way someone else used it to own an army of AOL-zombie PCs, then that's just the price you pay. You can't make an omelette without breaking a few arms.
Big Slow Giants squabbling over long rotten carcasses leave room for small flexible innovators with disruptive tech. Although, It's a shame them roped creative people into participating in their access control war...
People need to learn not to use non-standard software controlled by corporations for their communications. For me, no Skype, no Facebook, no stupid crap.
Read it as David Attenborough and was much more excited. Then read what it actually said, now I'm not so excited
Technically, it was post-DMCA. It was signed into law in 1998 - same year Auerbach graduated. But the lawsuits didn't really begin until Napster hit it big and was sued by Metallica in 2000. AOL wasn't as smart as a bunch of metal-heads, I guess.
"A little misunderstanding? Galileo and the Pope had a little misunderstanding."
I was struggling with "Insightful" and "Funny" as a moderation for this...
I really enjoyed reading about the little war between Microsoft and AOL during the chat heyday. However the author went into asides that were 3x longer than the actual story he was trying to tell, going through the entire history of Microsoft and Apple.
But AOL’s client had a security bug in it, called a buffer overflow. [...] AOL knew about this bug in their program and now they were exploiting it! That was what all those double zeros were for—they were just filling up space in the program’s buffer until they hit the end of the AOL client’s buffer and started overwriting executable code with the remainder of the protocol message. AOL was causing the client to look up a particular address in memory and send it back to the server.
There's something that you could always count on AOL for -- Respect for the users. Most companies, when faced with a trivially exploitable buffer overflow that could cause their chat client to execute arbitrary code would classify it as a bug and feel compelled to fix it, but that's not the AOL way. Instead they changed it from a bug to a feature which enhanced security by verifying the client's identity.
And if somewhere along the way someone else used it to own an army of AOL-zombie PCs, then that's just the price you pay. You can't make an omelette without breaking a few arms.
'Round here we calls 'em armlettes.
As if either of these platforms are actually relevant.
Yeah, those long forgotten chat-silo days when you needed an ICQ account, an AIM account, a MSN account, a Yahoo account to reach all your friends... fortunately XMPP/Jabber would solve all of this, and even Google would embrace the open standard with their new GTalk.
Oh! wait... it was a bait and switch.
Don't be evil does not mean be good.
History of AIM.
can't wait, in ten years, everyone can talk about the fights and struggles to get Facebook, iOS, Android, et al. out the door.
Gotta be some epic stories in there somewhere.
Non impediti ratione cogitationus.
If I did this, I would likely be facing criminal charges...
In the US, yes....
Just imagine if AIM had encrypted the communication with a key hardcoded into their client... Then accessing the server with a third party client could be unauthorized access of computer system in violation of the computer fraud act, or at least violation of DMCA, by breaking DRM.
This is exactly why you can't trust corporations. [short version] Corporations are full of humans..
[long version] searching for an angle, hiding behind the protection of incorporation, and doing everything they can to get rich quick.. On the surface, they only attempt to look on the up and up, but everyone knows better. Just below the surface, there is a feverishly frantic feeding frenzy.
[epilogue] *Trust is just another word in their bag of tricks for the greediest of corporations to shape public policies for enacting laws designed to fill their coffers so they can build their underground cities and steal our rock and roll icons for their live elevator music.
Well, when MS was presented with a closed, proprietary format, their solution was to reverse engineer it and admitting what a burden that was and how it hindered interoperability. Maybe they should re-evaluate their position on the Microsoft Office formats.
I just read the article and was thinking ‘haven't I read this before?’
Turns out I have. There is nothing new in this article. And this has been on Slashdot multiple times already, the first time in 1999.