Microsoft Source Follow-Up

shystershep writes "It's official. Microsoft admits that 'portions of the Microsoft Windows 2000 and Windows NT 4.0 source code were illegally made available on the Internet.' No more details, although it seems clear that it is only a portion of the code. Microsoft is, naturally, downplaying its impact, while everyone else is busy speculating about how serious this could get." A lot of you apparently haven't read yesterday's story. An investigation of the code is already underway.

Winsock API Included.

[Anonymous Coward]

The Winsock API is included in the leaked source that's something fantastic hahaha.

Re:Winsock API Included.

[Chester K]

The Winsock API is included in the leaked source that's something fantastic hahaha.

Even better, all of the rendering engine and interface code for Internet Explorer is in the leaked source.

Re:Winsock API Included.

[Copperhead]

So, can someone write a patch to make IE properly support PNGs?

Re:Winsock API Included.

[JebusIsLord]

or equally important, make it anchor CSS images properly?

Re:Winsock API Included.

[netsharc]

Someone probably can, but what are the chances Microsoft will take it? And since the source code isn't complete, you can't just re-compile IE and distribute your own version. :)

Re:Winsock API Included.

[MegaFur]

Microsoft tainted me a long time ago--as it did with all of us, merely by existing.
Show me the source, Sam.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:Winsock API Included.

[AzrealAO]

Rumor is GNU style Makfiles (which isn't illegal) and parts of gnu autoconf (which I suspect is illegal, if they actually include it in the OS).

Of course there are. This source code leak came from a company who ports Windows software to Unix.

Doesn't sound as interesting as BSD or Linux.

[ron_ivi]

It can't be that fun to work on -- Did you guys know that Microsoft has to _pay_ people to work on this codebase! If there was really anything interesting in it, people would be working there for fun on their own time.

[ I unintentionally posted as an AC first - hopefully it's interesting enough that I get more interesting mods than redundant.]

Re:Doesn't sound as interesting as BSD or Linux.

[jazman_777]

It can't be that fun to work on -- Did you guys know that Microsoft has to _pay_ people to work on this codebase! If there was really anything interesting in it, people would be working there for fun on their own time.

They get paid for the first 40 hours in a week, then the other 60-70 hours is for the fun of it all.

Re:Is there any GPL Violating Software in it?

[slipgun]

Has any one taken a look to see if the old rumors that Win2K is more stable because it uses open source code is true? If so, would that make Microsoft in violation of the GPL?

If they're using GPL code, yes. They already use open source code, and admit it freely - however, it's licensed under the BSD license, and hence can be distributed in closed source systems.

(Someone correct me if I'm completely wrong, but I think that's right).

Re:Winsock API Included.

[noisehole]

Clues to the source code's origin lie in a "core dump" file, which is left by the Linux operating system to record the memory a program is using when it crashes. Further investigation by BetaNews revealed the machine was likely used by Mainsoft's Director of Technology, Eyal Alaluf.

right, betanews revealed it.. damnit. they could've at least credited me [slashdot.org] ;)
bastards

The best bit in that article...

[blorg]

"Finally, this is very important: If you propose to continue working in the IT industry, and somebody offers you a look at the source, just say no. Remember - if you learn too much about the internals of Microsoft products, you may find yourself unable to work for anybody except Microsoft. Yike."

Re:Winsock API Included.

[br0ck]

Mainsoft has released a short statement [mainsoft.com] which sounds like an admission that the code did indeed come from them.

Statement to the Media Regarding Microsoft Source Code Leak
Mainsoft has been a Microsoft partner since 1994, when we first entered a source code licensing agreement with Microsoft. Mainsoft takes Microsoft's and all our customers' security matters seriously, and we recognize the gravity of the situation.

We will cooperate fully with Microsoft and all authorities in their investigation

We are unable to issue any further statement or answer questions until we have more information.

From Mike Gullard, Chairman of the Board, Mainsoft Corporation

Source of the leak

[cyt0plas]

There are a number of empty .eml files in the archive. While their FTP server looks like (didn't check) it is running a vulnerable version of wu-ftpd , it seems more likely Nimda got to them first.

I wonder what the final MS press release will name as the cause. "Evil Linux Hackers", perhaps?

Re:Source of the leak

[ackthpt]

I wonder what the final MS press release will name as the cause. "Evil Linux Hackers", perhaps?

Haha! How about 'Evil Worm Which Exploits Security Holes We Deny Exist Distributes Code'

Nah, I can't see them fessing up to something like that.

Source was Mainsoft - and from a Linux machine

[blorg]

"Evil Linux Hackers", perhaps?" Ironically, there is a Linux connection. Betanews is reporting [betanews.com] that an analysis of the leaked Microsoft code indicates that it came from Mainsoft [mainsoft.com], specifically a Linux machine belonging to Mainsoft's Director of Technology.

Mainsoft specialise in cross-platform development, enabling devlopers to develop using MS tools for deployment on *nix. Interestingly, for the conspiracy theorists, their previous mentions [slashdot.org] on /. date from 2000 and center around rumours that they were porting Office and IE to Linux. More news on the leak from Internetnews.com [internetnews.com] and The Register [theregister.co.uk].

The code is said to be W2k-SP1.

Then why was the code in a "zip" archive?

[NZheretic]

If the code was leaked from a Linux/Unix computer, why was the code found being distributed in a zip archived file instead of a compressed tar archived file?

Zip files are rarely used for distributing source code amongst the Linux/Unix community because compressed tar files are far more efficient.

zip -r source.zip /usr/src/linux-2.4.22-1.2149.nptl
ls -l source.zip
-rw-rw-r-- 1 build build 49091705 Feb 14 06:20 source.zip
tar cjf source.tar.bz2 /usr/src/linux-2.4.22-1.2149.nptl
ls -l source.tar.bz2
-rw-rw-r-- 1 build build 31964979 Feb 14 06:23 source.tar.bz2
tar czf source.tar.gz /usr/src/linux-2.4.22-1.2149.nptl
ls -l source.tar.gz rw-rw-r-- 1 build build 40689187 Feb 14 06:31 source.tar.gz

The resulting tarred archive compressed by bz2 is is around 35% smaller than the zipped source. With the exception of the the jar format for java classes, the zip format is rarely use by Linux/Unix developers for distributing source code.

IMO this points to the source code being lost by from a Microsoft based platform.

Zipped contents of a CD-rom

[NZheretic]

Phillup rightly raised the point: "Perhaps it got into the computer (from MS) as a zip file? And... they kept the original.".

The expanded contents of the zip file is around the size of a single CD. This points to the contents being originally distributed from Microsoft on CD-rom.

Microsoft has made so much fuss about retaining control of the source code. In May 2002, under oath at the antitrust hearing Jim Allchin, group vice president for platforms at Microsoft, stated that, because the Windows operating systems contained inherent flaws, disclosing the Windows operating system source code could damage national security and even threaten the U.S. war effort. [eweek.com]

It's going to be interesting if it is subsequently found that Microsoft itself has been distributing said source code over the internet in zip format.

By the way, In February 2003, Microsoft signed a pact with Chinese officials to reveal the Windows operating system source code. Bill Gates even hinted that China will be privy to all, not just part, of the source code its government wished to inspect [com.com].

Dispite gaining more favored trading status with the USA, there remains many embargos over technology transfers which could put the US at future risk [newsmax.com].

Either Jim Allchin lied under oath, to prevent code revelation being any part of the settlement, OR the Microsoft corporation is behaving traitorously, by exposing national security issues to foreign governments.

The exposure of Microsoft source code put users at risk because of the inherent design and implimentation flaws built into the source code.

In comparison open source development practices [arxiv.org] enables open source distributions and users to evaluate the source code from the start. This forces developers to build in security from the early outset of each project or risk abandonment for more secure alternate solutions. End users can particpate in the development process.

More details on the Linux machine analysis...

[blorg]

...are provided by noisehole in this post [slashdot.org] from yeterday's discussion. He reckons [slashdot.org] Betanews lifted the analysis from his post.

Article doesn't say it was *stolen* from Linux box

[blorg]

The article doesn't say it was *stolen* from a Linux box, it just says that an analysis of the files suggests that it had come from a Linux box. For example, the image could have been a CD that was burned on a Linux box, and then misplaced. And given that Mainsoft's work is "Windows on *nix" I'd be surprised if they didn't have a few Linux boxes around ;-) As things stand, this says absolutely nothing about Linux security.

Of course!

[NeoThermic]

>>Microsoft is, naturally, downplaying its impact

Of couse they are. They don't want to admit that its 203MB of files, they will just say its a small fragment.

Makes me wonder about all the weird e-mail files in the zip though...

NeoThermic

Of course it's a small percentage...

[SpaceBadger]

...of the total that accepted wisdom says makes up the full source tree, but what percentage of the full source is for the thousands of drivers etc. that really aren't part of the OS proper.

I wouldn't be so sure that what has leaked is an insignificant portion just because of the number of lines of code.

So the question is

[drinkypoo]

Has anyone actually built this code? Will it actually be useful to anyone? I could see how having enough of the code available might allow someone to create a version of windows 2000 that would work with plex86, which would be exceptionally exciting. Just how much of the code is there anyway? It's reputedly a ~200MB archive which also contains assorted tools needed to compile from the source, so only so much of that can be code. 200MB of pure source code would seem like it was probably enough to assemble most or all of Windows from.

Re:So the question is

[MoonFog]

Actually, it's supposedly only 15% of the source code. See here [bbc.co.uk].

Re:So the question is

[cozziewozzie]

15% of what? They seem to be very vague about this. The link you mention claims it is 15% of the operating system. Does it mean 15% of Win2K or 15% of all Windows code (95+98+ME+NT+2000+XP+2003+CE)?

Furthermore, the most of the code in a given operating system belongs to the drivers. If it's the important 15%, then it could be completely irrelevant that you don't have the 85% that deal with graphics cards and similar.

Re:So the question is

[confused one]

It's reportedly Windows 2000 Service Pack 1. That's why it's not complete -- it's the code necessary to create the components of the service pack

Re: So the question is

[Black Parrot]

> Actually, it's supposedly only 15% of the source code.

They'll be in trouble, if it's the 15% that works.

Re:So the question is

[GoofyBoy]

I can't wait for the Windows 2000 Phantom Edit version

Re:So the question is

[Xpilot]

Has anyone actually built this code?

Gandalf: No! Don't ever use it!

Frodo: How do we know it's source to the One OS of the Dark Lord?

Gandalf tosses a CD-R into the burner, and burns Windows.Source.Code.w2k.nt4.wxp.tar onto it. When the CD is done, there are glowing fiery letters on it.

Frodo : I can't read the fiery letters.

Gandalf : There are few who can. The language is that of Redmond, which I will not utter here. In the common tongue, it says "One OS To Rule Them All, One OS To Find Them, One OS To Bring Them All And With The NDA Bind Them"

Frodo: Take the source code Gandalf!

Gandalf : Noo! Do not tempt me with it! I dare not take it! Not even to keep it safe! You must understand Frodo, that I would be tempted to use this source code, for good. To disclose hidden API's, help the WINE project. But through me, all of open source would be tainted, and the LawyerWraiths of The Dark Lord will sure destroy us.

Frodo : But it cannot stay here!

Gandalf : No, no it can't.

Frodo : What must I do?

Gandalf : It must be sent to the fires of /dev/null, where it will be undone, and we will be kept safe from the Lawyers of Evil.

So remember folks, don't download it, or look at it, or attempt to build it! It is evil, and answers only to the hand of The Dark One.

Re:So the question is

[mikesmind]

So remember folks, don't download it, or look at it, or attempt to build it! It is evil, and answers only to the hand of The Dark One.

Genesis 3
1 Now the serpent was more subtil than any beast of the field which the LORD God had made. And he said unto the woman, Yea, hath God said, Ye shall not eat of every tree of the garden?
2 And the woman said unto the serpent, We may eat of the fruit of the trees of the garden:
3 But of the fruit of the tree which is in the midst of the garden, God hath said, Ye shall not eat of it, neither shall ye touch it, lest ye die.
4 And the serpent said unto the woman, Ye shall not surely die:
5 For God doth know that in the day ye eat thereof, then your eyes shall be opened, and ye shall be as gods, knowing good and evil.
6 And when the woman saw that the tree was good for food, and that it was pleasant to the eyes, and a tree to be desired to make one wise, she took of the fruit thereof, and did eat, and gave also unto her husband with her; and he did eat.

The account continues in verse seven if you don't know how it turned out. I agree with Groklaw's advice. Leave it be!

Re:So the question is

[VelocityBoy09]

Has anyone actually built this code?

I did. 200 megs of compressed source, 22 hours of compiling, and all I got was "Notepad.exe"

Re:So the question is

[Anonymous Coward]

You're lucky. You've got yourself a half decent text editor there. Imagine if you'd taken 200 gigs of compressed source, 22 days of compiling, and found that you only ended up with emacs.

Re:So the question is

[unformed]

Yeah, but with Emacs, at least I would've gotten a decent OS.

One editing change needed in story

[burgburgburg]

long-time Redmond partner Mainsoft.

formerly long-time Redmond partner Mainsoft.

From Rich Bowen's blog...

[tcopeland]

...right here [drbacchus.com]:

Second, we're going to see lawsuits in the next 2 years where Microsoft identifies code in Linux, added after February 10, 2004, which are either copied from, or influenced by, the Windows source code. And, as absurd as this is, it will be used to have, as Microsoft would say, a chilling effect on innovation.

Hm. I bet Andrew Morton has better things to do then trawl through WinNT code. Staying away from it does seem safest, though...

Re:From Rich Bowen's blog...

[guacamolefoo]

...right here:

Second, we're going to see lawsuits in the next 2 years where Microsoft identifies code in Linux, added after February 10, 2004, which are either copied from, or influenced by, the Windows source code. And, as absurd as this is, it will be used to have, as Microsoft would say, a chilling effect on innovation.

Hm. I bet Andrew Morton has better things to do then trawl through WinNT code. Staying away from it does seem safest, though...

Part of future kernen maintenance should probably include comparisons against this code, just to be safe. The worst possible thing would be for some witless idiot to include any of it into any OSS project and have this miss final review.

IMHO, rather than chortling over this disclosure, I'd rather have the code be kept completely secret by MSFT. Unfortunately, information is hard to keep secret when so may people have it.

GF.

You Should Not Be Cheering

[Pave Low]

What occured here looks like corporate espionage and theft, plain and simple. Whoever leaked this should be caught, and sent to Federal pound-you-in-the-ass prison. I know everyone here loves to hate on M$ (hahah funny), but nobody deserves to have their hard earned work lifted without their permission.

Re:You Should Not Be Cheering

[Wireless Joe]

"...nobody deserves to have their hard earned work lifted without their permission..."

I agree...just ask Burst.com [pbs.org]

Re:You Should Not Be Cheering

[koh]

The main prejudice may be caused by nastier side-effects such as a grep and analyse on all source code comments.

Imagine the impact, if, say, the following comment is found in the IE PNG rendering engine :

// don't know what this struct member does,
// maybe transparency ?? too lazy to lookup
// docs, leave as is for now

This would be a hard time for PR given their current objectives... and I don't even think about security-related comments ;)

(Disclaimer: this example is FICTIOUS. I do not have access to the code in any way. If such a comment is found, I hereby promise to imediately cease and desist watching Deadzone.)

from the eweek article

[squarefish]

References to MainWin can also be found throughout the leaked source files, which do not compile into a usable form of Windows.

I don't think any code can claim this, no matter M$ says

BBC Q&A

[MoonFog]

BBC also has a Q&A [bbc.co.uk] on the recent event, including thoughts on how this may impact Microsoft themselves.

Microsoft has said that this represents about 15% of the total source code for the operating system. It is not enough to recreate the operating system.

Re:BBC Q&A

[ZoneGray]

Sure, it's only 15% of the code... but the only missing component is Internet Explorer.

Mainsoft is to blame...

[JamesP]

THe most astonishing phrase is this:
Analysis indicates files within the leaked archive are only a subset of the Windows source code, which was licensed to Mainsoft for use in the company's MainWin product. MainWin utilizes the source to create native Unix versions of Windows applications.

Mainsoft says it has incorporated millions of lines of untouched Windows code into MainWin.

WHAT?!?!!?!??

This can't be the first time

[Schemat1c]

The company I worked for 12 years ago was licensed to get part of the Windows 3.1 code in order to interface our product with theirs. There must be 1000's of companies that do this and have been doing this. I'm amazed it took this long for someone to finally steal it and post it.

This is serious

[Sparky77]

Now that the source code to Paint is out there, we can expect many derivative works to surface in the coming months. The impact on the graphics software market will be devestating.

Re:This is serious

[orthogonal]

Now that the source code to Paint is out there, we can expect many derivative works to surface in the coming months. The impact on the graphics software market will be devastating.

But, but, Microsoft spent thousands of man-hours of laborious and innovative research to come up with the Bitmap format!

Oh dear god! Will the secret of the Bitmap format be made available to just anyone?

The world will be turned upside down!

it escaped!

[Extrymas]

"It is not clear at this point how the three and a half year-old source code escaped Mainsoft."

You know.. It's simple: code wants to be free

Its because they trusted Linux!!!!!!

[GoofyBoy]

>The leaked code includes 30,915 files and was apparently removed from a Linux computer used by Mainsoft for development purposes.

I wonder what Linux security hole allowed that to happen.

LAUGH, ITS A JOKE.

What about the .eml files?

[enosys]

What about the .eml files? You wouldn't have those in Linux.

Re:Its because they trusted Linux!!!!!!

[theCoder]

I don't think this situation is good for anyone.

You're wrong -- it's good for Microsoft.

No competitor to MS can look at the code and expect to survive a lawsuit (at least if they compete well enought with MS). So, MS isn't going to lose any money like that.

Piracy isn't an issue -- Windows is already pirated enough, and MS probably profits from it in the end anyway.

As far as new vulnerabilities being discovered, well, MS already gets a mostly free ride from 90% of the population (who think they're computer viruses, not Outlook worms), so it doesn't matter that much, and probably won't hurt their bottom line (all they really care about in the end).

In the end, MS gets lots of free publicity as the victim. I don't see a downside for them.

Which is it?

[onyxruby]

Is this damaging because 15% of the source to the NT / W2K tree was leaked and we're all suddenly vulnerable or is this no big deal since the code is three years old and it's only 15%? I haven't heard anyone talking about DRM, activation or serial code being in the leak, so I just don't see how this could affect MS other than to help interoperability of other software.

How long will it take?

[StuWho]

Gentlemen, Ladies, I welcome you to the Microsoft Sweepstake. Crackers and Virus Writers are already in their places, competing for the trophy of being first to write a new exploit using this source code as their inspiration.

Current favourite, the author of MyDoom, but many youngsters are looking to make their mark in this prestigious contest

Grab a beer, sit back, and enjoy this great sporting occassion - sponsored by Microsoft, Security Through Obscurity.

Swearing?

[thung226]

I'm shocked to find out that there is profanity in the comments/code. Anybody know specifically what they say? Seems a bit unprofessional.

M$ Programmer: Well, nobody's going to read this anyway, so "\\f*ck this bullsh*t"

For personal projects, this is fine (I've vented a bit in my personal coding projects), but I would never do anything like that at work...

Re:Swearing?

[omega9]

$ grep -Hirn "fuck" /usr/src/linux/*|wc -l

43

$ grep -Hirn " shit " /usr/src/linux/*|wc -l

14

And one occurrance of "piss". There're more, but I''m not spending more then a minute on this.

should we be looking at this stuff?

[mr_burns]

I'm reminded that last time there was a windows source leak we were all encouraged NOT to look at it, so that we wouldn't have to deal with the source ending up in Linux.

Seems like a good idea, but...

Was it ESR that made that nifty app to compare SCO and Linux sources? Could it be fiddled with to see if Linux or other free/open source code made it's way into windows?

It would be quite a coup if we could somehow legally show that they stole from the community without having to deal with the gnarly mess of windows code finding it's way into Linux.

I'm not implying that such a thing HAS happened, but we're presented with an opportunity here.

Security by obscurity?

[RT Alec]

This may illustrate one of the halmarks of open source software-- that software open to prying eyes is inherently more secure than closed source. I won't be surprised if digging through the source reveals a number of exploitable security flaws, perhaps many more than have been revealed with the source closed!

To paraphrase Bruce Schneier, if I give you the plans to my safe, and 100 identical safes with the combinations so you can study the locking mechanism in detail, and you still can't crack my safe-- that's security!

A Prediction ...

[starfire-1]

Maybe I'm a little jaded, but my guess is that in about a year, when we're closer to the Longhorn release, Microsoft will claim that the heritage Win2000/NT4 core is "too compromised" because of this leak and officially discontinue support prior to its seven year life-cycle. Along then along with Win98, everyone will be compelled to migrate to their new products.

Just a thought... :)

Remember the Apple leak?

[k98sven]

Anyone around here remember when the Apple QuickDraw code was leaked 1989?

It started quite a big ruckus, with the media making it out to be the entire OS, and the FBI starting what has been described as more or less a witch-hunt on 'hackers'..

I would not be surprized to see a repeat of that, substituting 'hackers' for 'file-sharers'..

Will this increase calls for stronger DRM?

[G4from128k]

I'm sure that Microsoft now wishes that it source code files had been locked into self-expiring, heavily encrypted, copy-resistant file formats. Events like this can only increase demands for "Trusted Computing" initiatives that prevent accidental or intentional leakage of security-sensitive intellectual property.

Given that so many companies outsource or collaborate with a far-flung global network of suppliers -- I'm sure MSFT need only whisper about the threat of leaked trade secrets to get corporate IT to adopt DRM/Trusted computing for everyday use.

Security through obscurity?

[Gothmolly]

Everyone is panicking about how revelation of the source will open Windows up to hacks. In an ideal world, knowing how good code is written shouldn't give away the 'hacks'. In this case, MS is rightfully fearing review of places where they fail to check string lengths or buffer sizes, the way that they handle exceptions (if they do), the way that their logic copes, or fails to cope, with unexpected input.
However, good code wouldn't have this problem, string lengths would be checked, there wouldn't be hardcoded passwords, components that are not supposed to trust one another really don't, etc.
This exposure of the source may reveal just how crappy their code is. If its not crappy, I don't see necessarily how its more 'hackable'. Apache is open, and nobody hacks it to pieces on a daily basis. Can you imagine what would happen if the source of IIS was leaked?

Possible "culprit" found

[Zocalo]

According to this article [theregister.co.uk] at the Register, it looks like tracking the source of the leak wasn't that hard owing to very specific comments in the code. The theory is that it's the old tale of boss gets new PC, user inherits old PC and so on at Mainsoft, one of Microsoft's partners. The twist in the tale this time is that the in this case the PC may have ended up on the desk of someone who recognised the code for what it was and decided to post it.

If this is true, then I suspect that the list of possible culprits is very short and some poor sap who didn't think things through is going to be in *very* hot water indeed early next week.

Honeypot?

[guacamolefoo]

This may be a little paranoid, but is it possible that this whole thing is a honeypot, and now MS can go around pulling SCO type stunts on OSS projects?

Doesn't this smell?

[Cytlid]

Is it just me or does this smell like a stealth PR stunt to you? Gee... source code gets leaked... this hits a few communities right in the nose. Now MS can say "See, open source is bad because all these new viruses are made because our source was leaked" and "File-sharing is bad because this is how this is moving around the internet". It's just too conveniently making MS look like a victim.

Does this mean

[DangerSteel]

We can finally get Clippy integrated into OpenOffice?

Heck just go for it and make it part of KDE and Gnome !

Bad for security...

[haeger]

I think this could be very bad for Windows security (yeah, oxymoron, I know). This is bad news for all that in some way have to support windows at work.
Since we all agree that all code has bug in them and since this code is out we can safely assume that some bugs will be found.
Now all the white-hat hackers are prevented by law to take a look at the code and since all black-hat hackers don't give a damn about that law, those who run windows are in a pretty bad place right now. Even worse than usual actually.

Oh well, the windows admins who like working overtime will love the coming year I suspect.

.haeger

here's my bet

[CAIMLAS]

I've given this topic considerable thought, and here are the possible conclusions I've reached.

1) MS will use this source leak in the future to claim that various open source projects (Samba, Gnome, KDE, OpenOffice(?), linux) that get new features which MS finds competitive are 'derivative' works, regardless of whether or not the developers actually looked at the source.
2) There will be enough people looking at this source for large portions of the code's functionality essentially entering into 'public domain', with people writing up how the components work. It will be essentially impossible for anyone to do 'virgin' development on 'windows-like' features for anything, as the information on precisely what the Windows version does will only be 2 steps of association from the programmer.
3) MS will pull a 'patent' or 'trade secret' violation claim on Samba/Linux/GNOME/KDE, in addition to pulling the .NET framework out from underneath the Linux community (by claiming patent infringement again). Two shovels of dirt on the grave of linux.

From my interpretation, this all seems quite feasable given current legal atmosphere. Any lawyers here have a comment on this?

Entertainment value of media "experts"

[paco verde]

The funniest part of this whole thing has been the industry pundits explaining the ramifications of the source release in various media outlets.

The best I've seen today is on crn.com [crn.com] by some joker named Winell from Econium [econium.com]. He manages to say with a straight face:

"Unlike Linux desktops, which is like the wild wild west and not controlled and enhanced all the time, Windows users have come to take a quality controlled operating system for granted and not have to worry about a bad release," Winell said. "We hope that Microsoft can swiftly identify how the code got released, prosecute the perpetrator and build a barrier/security patch to protect against intrusions."

Mr. Winell has obviously never used Windows ME if he thinks Microsoft quality control prevents "bad releases". You know Econium must be a real player when the title of their home page is "Welcome to Econium who is a solutions provider."

The classic yesterday was Laura Didio from Yankee Group [yankeegroup.com] comparing OSS hackers to suicide car bombers. [internetnews.com]

Nothing like an embarassing Microsoft moment to get the "experts" out from under their rocks.

Re:Entertainment value of media "experts"

[eddy]

It should be noted that the Didio quote as since been removed from that article, but here it is for those who missed it. Don't ever forget this one, this is straight from Yankee Group [yankeegroup.com] and they should not be allowed to get away with it without a public apology IMHO:

"With the open source community, there are a large percentage of tinkers and 'ankle biters' who are trying their hand at hacking. Some are even communicating with each other. So it only takes one or two of these groups sharing information to be able to pull something off. When you have this type of passion, it's hard to fight because these people are like virtual suicide car bombers."

Is this people you'd want to buy services of? I don't consider myself "PC" in the least, but this is so fucking wrong and off the track it's not funny.

Re:Entertainment value of media "experts"

[paco verde]

Here's some general contact information for Yankee Group off their website:

Media Relations and
General Inquiry
Kim Vranas
Director of Marketing
[e-mail]
Voice: 617.880.0214
Fax: [phone]

Linux leaked too

[wstearns]

In a related story, Linus Torvalds was forced to announce today that the source code for the Linux operating system was made public on the Internet.
"We're not sure how it was leaked. What's up there certainly looks legitimate, and we've had some reports that some of it even compiles. It appears it may have been leaked back in August, 1991, originally to an FTP server in Finland."
There are at least 3 servers that appear to have Linux source code available, although online discussions indicate that there may be many more. There is speculation that the code can e acquired through FTP, Gopher, HTTP, Bittorrent, Rsync, SMB, NFS, AFS, Freenet, and that people may even be _selling_ CS's and DVD's with the code.
SCO was quick to comment that "After they copied those 5 lines from one of our header files, the {deleted} deserved it. As soon as we find a person in our company that knows how to download a file, we'll be comparing every line of Linux to this stuff we bought from AT&T. Oh hey! We've already found something - they copied the word '#include' from us!" The phone interview was cut short as Mr. McBride was called away to launch a new lawsuit.
Law enforcement agencies have been contacted and are investigating, but the process is slow as the officers are heard to exclaim "Wow, it has a GUI?", "Damn, this is stable - I can't crash it at all!", "Whadda you mean, Office is included?", and "How do I turn off the grappling hook and use the rocket launcher?"

comparing MS code to OSS code

[moojin]

has anybody attempted to use the code analyzer that was developed for the SCO / IBM case. it would interesting to see if there were any similarities between MS code and the multitude of OSS code.

Seriously, don't download this shit!

[danila]

Guys, let me warn you, this is nothing to laugh about! DON'T TOUCH THAT STUFF! Two of my friends work in Motorola research laboratory. Yesterday one of the downloaded the code at home and then they both looked at it. One of them was lucky - his retina burned the second he saw the code. The second did not escape that easily. His eyes glued to the screen, his hands typing madly... the paramedics found him 20 minutes later clutching the mouse and writhing in agony. After 2 hours in intensive care he (or, rather what left of him) was sent home. Today, after they were not let into the office building, both of them got pink slips by courier mail.

A cousin of a girlfriend of my former classmate yesterday went to the university computer lab to print his essay. He catched a glimpse of some code on the screen and didn't even thought about it for a second. When he returned home, he logged on to sourceforge.net and before anyone could stop him, he tainted a dozen software projects there. Shit, two perfectly good Xeon servers had to be scrapped and replaced with clean machines in a hurry.

That's just crazy, this code is the strongest shit I ever saw... oh, fuck, forget what I just said - "the strongest shit I ever heard about and never saw". It's worse than the GPL, it taints your code so quickly you can't even notice that. PLEASE, FOR THE SAKE OF EVERYTHING GOOD IN THIS WORLD, DON'T DOWNLOAD THE CODE.

Copy this message and send it to all your friends! You need to warn them not to look at the code! POST IT ON FORUMS AND MESSAGE BOARDS! THIS IS AN EVIL PLOT TO TAINT ALL CODE IN THIS WORLD! DON'T LET THIS HAPPEN!

Re:Seriously, don't download this shit!

[MrPink2U]

A friend of mine looked at the source code yesterday. He immediately recieved a phone call from a man who identifed himself as Bill Gates. The man whispered to him, "Seven days..." and then just hung up.

Creepy huh?

MainSoft statement

[theCat]

This is from their web site:

Statement to the Media Regarding Microsoft Source Code Leak

Mainsoft has been a Microsoft partner since 1994, when we first entered a source code licensing agreement with Microsoft. Mainsoft takes Microsoft's and all our customers' security matters seriously, and we recognize the gravity of the situation.

We will cooperate fully with Microsoft and all authorities in their investigation

We are unable to issue any further statement or answer questions until we have more information.

From Mike Gullard, Chairman of the Board, Mainsoft Corporation

Sigs

[tiny69]

I wonder how many people on /. will start using comments or code snippets from the windows source in their sigs?

Re:Traces back to Mainsoft?

[sp00]

Microsoft will probably use this to thier advantage: "The leaked code ... was apparently removed from a Linux computer "

Re:Traces back to Mainsoft?

[cozziewozzie]

The link seems to be slashdotted, but isn't that the company which ported IE to Unix and was rumoured to be doing something similar for MS Office?

Re:source out on the open

[QEDog]

I want someone to change de Blue Screen of Death by a Red Screen that says "Switch to Linux!"

Re:source out on the open

[AnonymousNoMore]

Thats a good point.

1) Leak unimportant proprietary source and bait competing open source developers to download.
2) Initiate legal action against "tainted" developers contributing to open source projects.
3) Continue to PROFIT!!!

Re:source out on the open

[Frymaster]

access to the Windows source... may legally impair their ability to make contributions to open source resembling anything that exists in Windows.

windows developers have had access to gpl'd source for well over a decade... but that hasn't legally impaired their ability to make their products.

any legal action against opensource projects by microsoft relating to these leaks will still have to demonstrate that:

1. the opensource code was copied from the leaked nt code
2. the nt code wasn't boosted from opensource projects first

Re:source out on the open

[bark]

I remember reading that Steve Balmer and Bill Gates specifically FORBID any MS employees from reading / accessing GPL'ed code unless given express permission from somewhere high up.

They had their "don't touch gpl" rule in place for quite a few years now. But they can access BSD licensed code and incorporate them freely.

Just because they had access doesn't mean MS employees are out to break the law ...

it works in reverse too. To microsoft, all this free linux code floating around on the net is a huge temptation for its employees to cut some corners and potentially land ms in big legal trouble ... sounds familiar to all these conspiracy theories floating around about the leaked win2k source, doesn't it?

Re:source out on the open

[the_mad_poster]

Windows kernel gets the kernel GPL'd

How can a site so full of OSS supporters have so many people so ignorant of how software licensing works? Yes, if they were found to be infringing the GPL they COULD GPL the whole kernel, but that would be stupid. They would just pay damages for infringement and remove the GPL code from future releases. This "viral licensing" bullshit is so idiotic, I can't understand how it got started. I blame SCO.

THAT old saw again.

[dmaxwell]

For the kajillionth time, putting GPLed code into a proprietary codebase DOES NOT make the whole thing GPLed. If MS did put GPLed code into one of their products accidentally or otherwise and then distributed it, that is copyright violation. The GPL does not rely on contract law and therefore CANNOT specify the penalty for violating it. Since the GPL is a straight copyright license pure copyright law applies. This means MS' hypothetical penalty would be between them, a court of law and the aggreived FOSS project.

The judge is such a case is unlikely to order MS' codebase GPLed. MS would have to either put out a sanitized patch for the code in question or pay the developers for an alternative license. The exact circumstances of the case would determine what if any punitive damages MS would have to pay in addition to recompensating the developers.

MS would have the OPTION of making the entire contaminated codebase GPLed to satisfy the license but I doubt they would take that option. They could do it for the FUD value but since the aggrieved FOSS project wouldn't accept that as a settlement, MS would just have to do something else. Imagine that! A FOSS project could rule out an MS product being GPLed to PREVENT harm to a project or FOSS in general.

Re:source out on the open

[nvrrobx]

While you are absolutely correct, he with the most money wins in the US court system.

Microsoft will just sue you into oblivion, and when you run out of money, they'll have won.

Yea, but what if.....

[StressGuy]

Say, a retired programmer took a look at the leaked Windows source code then published a "code specification" that another (still employed) programmer could look and and then write a program to meet that specification. Technically, he never saw the source code, in fact, he need never even know that the "code specification" was inspired by the leaked Windows source.
.
. ...just thinking out loud, as it were....

Re:Yea, but what if.....

[Eil]

If it came to it, I highly doubt that would hold up legally. Besides, much of the stuff in Windows is patented, and there's simply no way to re-implment it (different code or no) without violating a patent.

Why in the hell do you want to copy windows anyway? Open source to me is about making new or simply better software. (Speaking generally to everyone here, not just the parent...) If you absolutely must have win32 compatibility, then buy a Windows license like everyone else. If that's not acceptable, then figure out a solution that doesn't require win32 compatibility. But for god's sake, don't be a common criminal and steal someone else's implementation.

I digress. Chances are pretty good that writing a specification from such crufty code (and a good deal of it is crufty) would be more difficult than legally reverse-engineering a working implementation anyway.

Re:Windows developers do not read GPL source

[pla]

if the developers of B have never read the source of A, or anything derived from A, it's pretty sure that B will not look like A.

Except, in the realm of software, that just doesn't apply. A "best way" often exists to accomplish some simple task, and 20 good developers would all independantly "discover" that way. Even in more complicated code, you'll see a large overlap of broader ideas, all arising independantly

This makes one of my peeves about software patents... Patents include the critiria of non-obviousness. If 20 developers would all come up with the same solution, that seems like a pretty damned obvious technique, IMO.

Take the XOR'ed image patent, for example... Even ignoring the idea of prior art (which IMO existed), using XOR to put one image on top of another such that you can later remove the superimposed image cleanly (ie, a mouse cursor over a background), even a moron would use XOR. Yet, the USPTO still decided to grant that one.

So yes, very similar works do arise, totally independant of each other, in the field of software engineering. Unfortunately, considering our legal system's pro-corporate bias, that will most likely work against us. Rather than believing that Billy G and Linus both came up with printf("Hello World\n");, this source release will quite likely suffice to convince the courts that various open source projects "stole" such trivial statements from Microsoft code.

Or to borrow a joke from the SCO threads, "Wow, look at all of the i++; statements those damned open source commies used, just like in SCO's code!"

alternate universe

[SirSlud]

i cannt re-iterate how stupid all thie fear is ....

check out this alternate universe:

musicians are fucked. apparently, we can't look at other peoples copywritten music without 'taining' our ability to write original music.

everybody from bach to bon jovi is now in violation of copywright law. musicians have henceforth been instructed never to look at somebody elses music lest they be sued later for copying the notes and rhythms.

harumph. this is rediculous.

Re:source out on the open

[djh101010]

I mentioned that yesterday and was called some sort of IP alarmist. THIS IS SERIOUS - if you now or in the future contribute your own IP to the open-source world, don't look at Microsoft's source code. You won't learn anything useful, and more importantly, you need to be able to truthfully say "I've never seen it, and specifically and intentionally avoided getting a copy of it or looking at it".

The odds of coming up with something vaguely similar to their stuff is high enough that it's not worth being accused of copying their work. The best defense against such an accusation is to have never seen their work.

If I were a tinfoil-hat kind of person, I'd wonder if this isn't some sort of SCO-ish related thing.

Re:source out on the open

[Krunch]

The link to the Groklaw's article is here [groklaw.net].

Re:source out on the open

[s4m7]

Billy in the land of the underpants gnomes:

Step 1: 'accidentally' release windows source
Step 2: Secretly hire unafiliated programmer to copy blocks of windows source to OSS projects (comments intact)
Step 3: Sue IBM/RedHat/Novell into the ground
Step 4: Profit!

Re:No step 2 necessary for step 3

[sulli]

Does that mean *BSD is finally, after all that, dying?

Re:No step 2 necessary for step 3

[Jerf]

And you think the entire community, including IBM and other companies that have bet the farm or at least huge sums of money on OSS are just going to roll over and take it?

If the lawsuits get too frivolous, not even Microsoft will be immune to countersuits, plus such massive lawsuits aren't going to be "free" in reputation terms, either. ("Gee, if all Microsoft can produce is lawsuits, maybe they aren't such a leading company after all?")

Besides, so they prove some small chunk of code is encumbered. (It is virtually inconceivable that huge chunks of code will make it in.) So we rip it out and keep going. Killing any given iteration of Apache may be possible, but taking down the entire thing legally is going to be quite a feat! (And remember that unlike SCO, Microsoft is limited by the fact that they are still selling software; they can't for instance go after the GPL in a really serious way because they'd likely end up invalidating their own licenses; "Unenforcable GPL" is good FUD but would be an atrocious court strategy for them!)

It's not hopeless, not by a long shot. I won't say they couldn't make a real annoyance of themselves and I won't say Total Open Source victory is some sort of inevitability, but it's not hopeless.

Re:source out on the open?: conspiracy theory

[d.valued]

This is not a trivial problem.

Though many of us - myself included - would not mind a peek into the collective mindshare of the Evil One, one cannot look into the abysss and return unchanged.

Sorry. Debated last night with philosophy majors. They won, six shots to five black and tans.

To translate it bluntly: This is still copyrighted code, owned by Microsoft. Duping even their "badly-written routines" into an inocuous place may lead to an SCO-esque attack in the near future , claiming violations in certain filesystem and mounting routines, or possibly something involving Samba, or a myriad of other wincompatibility issues.

It feels like a tactic that may be conceived by some bright bulb in MS Legal to bring conflict to the competition, or at least stifle development past current kernels.

I am starting to get the shakes that I get in a poker game when my all-in bet is called when I have pocket kings. (Last time that happened, the opponent had A-J suited. He flopped aces-up. I swore loudly.)

I am not a lawyer. I play one online, and I'm studying for the patent bar, but I don't pretend to dish out legal advice. Still, if I go all-in, I have the goods.

Re:source out on the open

[jruschme]

The Groklaw warning echoes thoughts I had as soon as I heard the comments on the radio about how a competitor could use MS's IP in a competing product. That said, the conspiracy theorist in me wonders if it's possible that Microsoft orchestrated the leak themselves in the hopes of polluting one or more Open Source products (e.g., Linux Kernel, Wine, etc.) and then later launching a series of SCO-style lawsuits. Think about it...

1. Release portions of an older baseline which have already been fixed/replaced (to minimize the hacker potential), but are algorithmically distinctive enough to be recognized if they were used in another product.
2. Wait for a well-meaning open source user to submit one of the pieces as a patch to the Linux kernel
3. Scan new kernels for distictive algorithm. When found
4. Launch expensive lawsuit at RedHat, Lindows, et al. Demand injunctions against distribution, damages, etc.

Or maybe, I've just read too much SCO-IBM coverage here. --John

Re:source out on the open

[jtrascap]

I like the way this guy thinks - and I think this too.

Let's do some math..and since we're talking conspiracy theory here, we only need to use addition!

* MS "kills off" the old OSs, but not enough corp users move
* MS goes security nuts and publicizes ever patch. Let's not mention that some patches take 6 months to come...
* Release the code through a "trusted partner" - MS supports lots of partners which, via programming, politics or press, support the beast in return.
* Frightened CEOs scream - CIOs look at updating to XPee vs. training staff on Linux and OpenOffice. Looks ok, until...
* Frightened CEO's PowerPoint presentation doesn't work right

SOLUTION:
* CEO - "Upgrade!"
* MS = PROFIT!

C'mon - add to the panic...It's Fun!

Re:It was lifted from a Linux Box

[sqlrob]

Or an idiot developer working on a linux box happened to check in the core file with other work.

I've seen junk like that before, so it's entirely possible.

Re:This may sound crazy, but M$ would likely gain.

[koh]

Obviously the only answer for companies stuck with M$, move to XP

No. Windows 2000 is NT 5.0, XP is 5.1 and Server 2003 is 5.2. Notice the minor version bump which indicates that all these releases share a lot a code.

It is reasonable to think they want to have users switch to Longhorn (does anybody know if it will be NT 5.3 or 6.O ?), but then the leak occured too soon, for they're not ready yet.

Re:DON'T TOUCH IT

[spitzak]

This seems to be a popular opinion, but it is false.

You are buying into the same FUD Microsoft is spewing about the GPL.

Just looking at the code does not "taint" you. There are plenty of ex-Microsoft employees who have looked at Microsoft source code and have then contributed to non-Microsoft projects (not just OSS, but closed-source from competing companies). Really, are you claiming that a coder that has seen Microsoft's code is legally impossible to employ except at Microsoft? What if some poor sap has seen both Microsoft's code and a competitor like Suns? They can't ever work on software again anywhere?

Conversely Microsoft hires people all the time that have looked at GPL code. They don't seem worried that these people are "tainted" despite the fact that their public announcements would seem to indicate that it is impossible for such people to work there.

The person/company in trouble is the one that made the code available. Apparently this is somebody at Mainsoft, who should be punished hard. This sort of behavior is extremely damaging to IT!