Microsoft Warning Leaked Code Traders

An anonymous reader writes "Broadand Reports notes that Microsoft is now sending snail mail warnings to downloaders of the leaked source code. They're also apparently working in conjunction with several un-named peer to peer vendors to send out legal warnings to any users who search for the leaked code. The notice on Microsoft's website has been updated to reflect the new warnings."

Traders or Traitors?

[tin_foil_hat]

I think the title should have read "MS Warns Leaked Code TRAITORS" considering that the code probably got leaked from one of their own.

From the MS Notice page:

Customers running Windows XP Service Pack 1 or Windows Server 2003 who have installed all of the latest updates are not impacted

In other words: "Dear companies running on W2K, please pay for upgrades ASAP. We would like more money. Thanks."

[/tin_foil_hat]

Re:Traders or Traitors?

Plenty of folks have access to Windows source, I know for a fact that these guys [slashdot.org] do, they ship their fault tolerant boxes with a heavily customized version of Windows.

Plenty of other vendors do, too. Plus plenty of third party developers who work on windows. Not every component in there was developed in house, after all. I remember a time when RealPlayer was part of the package, Real must have had some source back then.

Re:Traders or Traitors?

More from the MS notice page:

Subsequent investigation has shown this was not the result of any breach of Microsoft's corporate network or internal security, nor is it related to Microsoft's Shared Source Initiative or its Government Security Program, which enable our customers and partners, as well as governments, to legally access Microsoft source code.

So it wasn't an inside job, nor was their network compromised, nor any of the shared source partners leaked it. So... how did it get out in the open? The wind blew a stack of printed source code through an open window? The Underpants Gnomes (tm) took it? Someone left a CDROM on the seat of his BMW Z3 convertible and left the top down? What?

Re:Traders or Traitors?

The phenomenon is called "quantum jumping". The code jumped from one Quantum harddrive to another.

Re:Traders or Traitors?

I have his picture of Bill G. in my head walking around carrying a sack in the middle of the night going,
"Here kitty kitty.....
get back in this bag you little F---ing Batstard"

Re:Traders or Traitors?

The best part of all is that there's no cat.

Re:Traders or Traitors?

And it can't leap again until it has stopped some computer from working. And every hard drive it infects, its only hope is that its next leap will be the leap home....

Sounds like a good start for a mini-series....

Re:Traders or Traitors?

The leak came from a Microsoft partner, Mainsoft [mainsoft.com]. The partner's access to Microsoft source was given long before Microsoft started their "shared source" program.

BetaNews has the details [betanews.com].

Re:Traders or Traitors?

There are legitimate ways for people to get windows code that are outside of GSP or Shared source.

Think about this - the code that was leaked is older than the shared source program. Was shared source the very first time any institution ever got windows code ?

No.

I thought the answer on where this code came from was publicly known, and even discussed here ?

The microsoft statement above, to the best of my knowledge, is correct. (iow what i know doesn't disagree with that statement) If the specific details to back this up aren't widely known, I won't disclose them. IOW, they know how the code got out, and its none of the things you mention. Mostly the distinction is that people have an overbroad interpretation of who the shared source program covers.

OT - Re:Traders or Traitors?

Customers running Windows XP Service Pack 1 or Windows Server 2003 who have installed all of the latest updates are not impacted

The use of the word "impacted" here is classic corpo-Pentagon-speak.

The correct word is "affected." For a person to be "impacted" has an entirely different meaning.

You'd think Microsoft would care about the distinction, since they are so full of shit.

Re:Traders or Traitors?

Given that the code that was released is all older code, I have another reasonable theory about where it came from.

Remember a while back when it came out that a group of hackers had compromised MS's internal network and had access to it for over a month. At the time they admitted it they denied that the group obtained access to the source code. Of course they would deny it regardless of the truth or whether or not they knew. Basic damage control.

So say in the interest of avoiding getting too much attention directed at them, perhaps they waited until now to release what they found.

Just a thought, but it seems as reasonable as their assertions.

Re:I Dare You: +1, Patriotic

Here you go:

#include <bsod.h>
#include <gigsofdlls.h>

int main (void) {

if ( 1 ) {
BSOD();
}

return 0;
}

Re:I Dare You: +1, Patriotic

I can't seem to find the gigsofdlls header file...

Re:Traders or Traitors?

If Vegetarians like aninmals so much, why are they eating all their food?

Don't mess with MS

Don't mess with Microsoft, they have the money and the power to track you down, even on Internet and through P2P networks. And they will, this is just an example and a warning.

I will never download the source code and you should better not try too. Anyway what's the point in seeing/having it?

I think people don't really understand what having windows 2000 SP1 source code spreading on internet really means. That's quite important and even if it's only part of the source code it's already enough for the first exploits to appear.

The author was kind enough to tell us about the first one [slashdot.org], but I bet many others did find bugs and didn't report them because they are working on viruses and attacks using them.

Let's see what happens in the coming months. I'm already working on the switch from Windows 2003 Server to Linux in my company for this exact reason.

Re:Don't mess with MS

Don't mess with Microsoft, they have the money and the power to track you down

if this is true, then why haven't I gotten my $245 [snopes.com] from Bill yet? I forwarded that email to a zillion friends, waited two weeks, and still no check.

Re:Don't mess with MS

The money was real, they just couldn't believe you had any friends :)

Re:Don't mess with MS

"Don't mess with Microsoft, they have the money and the power to track you down, even on Internet and through P2P networks. And they will, this is just an example and a warning."

I have the power to track people through P2P, too. I've found people in my apartment complex on the networks. I've even met a few friends that way. Too bad that doesn't mean that I'm a multi-billion dollar company.

Please note, it is absurdly easy to track people on the networks. It is not indicative MS power, or their legal muscle.

As for seeing & having it, one major point is that you CAN. What was once taboo is now freely available (sorta), and people are reveling in like. To draw a completely inaccurate parallel, it's like the sexual revolution of the 70s/80s in the US.

Otherwise, I agree with your post.

Re:Don't mess with MS

I'd definitely have to second the parent. I'm in high school, and I know a little C++ (I took the APCS AB exam and got a 5), and I've played around with Linux. Basically, I couldn't really do anything with the source (even if I should ever chance to look upon it) beyond reading the code, and I don't really have any desire to go beyond that anyway.

Ultimately, like the parent said, it's the taboo that makes it interesting. If Microsoft had just posted the code on its website, I might not even be interested, but all the effort they're exerting has attracted my attention.

Bad Reasoning

What will happen when the Linux project servers for the version you use get breached. Or what if there are exploits that can't be fixed immediatly?

Switching off of Windows sounds great to me, as I really dislike using it, but your reasoning sounds a bit flawed. If it's because the software's buggy and prone to exploitation, great. But if it's just because some code got leaked.. and OSS software generally has all the code available all the time.. then your reasoning sounds a little flawed.

Any software will have flaws. It's inevitable. Knee jerk reactions too those flaws generally aren't a good idea though.

Re:Bad Reasoning

Software will have flaws, or if not "flaws" exactly, incompatibilies. But flaws and security issues are 2 different things. Bugs don't have to lead somewhere. You can't account for every possibility when you write a program, but it's how the integral error handling type functions of your program handles those things you didn't think of, and when you're writing programs for which security is an issue, those problems shouldn't lead anywhere they're not supposed to go.

Past security comparisons between Linux and Window

There have been many security comparisons between Linux and Windows, and the conclusions have always been mixed. One reason is because of the scope of the included software - because it's "free" Linux distributions usually include the kitchen sink, so there are more packages to count security exposures in. Another reason is multiple counting - one exposure across multiple distributions. Yet another factor not well estimated has been the severity of the exposures.

But these security exposures have all been in an environment where Linux source was generally available for inspection, and Windows source wasn't. A corollary of this is that most of the Linux exposures have been proactively reported, prior to being exploited. With Windows that's not so clear.

In the future, there's not reason to expect Linux security exposures to change significantly, except through becoming a bigger target because of increased usage. But the fundamentals of bugs, bug reporting, bug fixing, and security haven't changed.

The future story for Windows is different now, because some source has become available. *Maybe* some people will begin proactive security work on the source, and *maybe* Microsoft will roll that work into fixes. But for certain, others wearing differnt color hats will be examining that code for security exposures, too.

Re:Bad Reasoning

There's a big difference here. While only the virus writers are looking through the leaked Windows source, OSS is under heavy scrutiny from many parties. Most people who find a potential exploit in OSS will report it to someone who can write a patch, or they will do it themselves. Just look at MS' attempts to stop the distribution of the source, how many able programmers with good intentions will take the risk to read it?

Of course there are flaws in OSS too, but there's a much greater chance the good guys will find them first.

Re:Bad Reasoning

Switching off of Windows sounds great to me, as I really dislike using it, but your reasoning sounds a bit flawed. If it's because the software's buggy and prone to exploitation, great. But if it's just because some code got leaked.. and OSS software generally has all the code available all the time.. then your reasoning sounds a little flawed.

The vital difference, at least in theory, is that FLOSS developers are operating under the assumption that any would-be attacker can see the source, so they have to make damn sure it's secure. Microsoft developers, on the other hand, have been relying for years on security through obscurity, and have therefore been less careful.

This is obviously not going to be true in every case. BIND's developers, for example, are evidently entirely unaware that the source code is being distributed freely, or else they're relying on security-through-ugly-kludginess. Contrariwise, I'm sure that there are plenty of developers at Microsoft who care very much about security, but their managers see that sales are good despite the bugginess of the code, so they allocate their developers' time to new features instead of bugfixes.

The fact that Microsoft or any software company thinks it's a disaster to have the source leaked is, however, a cardinal sign of poor engineering. They should be pissed, perhaps, but not terrified.

Re:Don't mess with MS

"...released source code is horrible for security. Look at OpenBSD..."

Just maybe there is a difference between an open development process, like OpenBSD, where incremental changes are examined before becoming part of the production code and dumping on the web hundreds of meg of source of a finished product which has an installed base of millions. Open source OS's get security from having many people looking at code submissions and the opportunity to find and fix dangerous bugs before they are exploited. Making a bunch of Windows source code available on the net does neither of these things.

Re:Don't mess with MS

Yeah, released source code is horrible for security. Look at OpenBSD, all those servers just waiting to get hacked in to. Maybe now Microsoft will actually have to, I don't know...eliminate exploits instead of waiting for them to appear, then fixing them after it's too late (if it isn't already).

Here is the real crux of the problem. You are pointing at the wrong thing.

It is not whether the source is open and available that makes it insecure or more secure.

It is whether the soruce was developed as open source. It matters that all those eyeballs were watching while the source was being written. Taking a buggy closed source program and suddenly opening the source simply means that all of the bugs will be discovered, and exploited. Developing a program as open source means that those security problems often don't live long enough to reach a release. Even when they do, they are patched rapidly.

In fact, it simply may say more about the users or "administrators" than the availability of source. Remember the Bind 8 vulnerability? Remember how many servers run Bind 8? Remember how fast everything was upgraded all over the planet? Remember <Microsoft virus of the week>? Remember how many servers were vulnerable to that? Remember how slowly those vulnerable servers were upgraded? Even when the fix was available before the exploit? Now which of these two widely used software program vulnerabilities caused a huge upheavel affecting society as a whole?

Re:Don't mess with MS

See, the real reason MS doesn't want the code spreading is because they are embarassed at the frequency the word ``fuck'', ``shit'', and ``BUGBUG'' occurs in code comments (13, 577, and 7462 times, a little bird told me).

That, and the whole stolen-intelllectual-property thing.

That said, while they are certainly within their rights, it seems to me like the cat's outta the bag. They won't be able to stop the real malicious types, the virus writers and pirates, so they may as well save their time. For that matter, they'd released enough source to governments and researchers that it was bound to happen sooner or later.

Re:Don't mess with MS

"fuck" 13 times
"shit" 577 times
"BUGBUG" 7462 times

having your source code stolen and released on the net for others to read...
priceless.

But seriously, if i had the source (which i don't) and a whole bunch of free time, I'd go through it line by line and find all the errors and post up a patches page and send it over to Microsoft so that they could fix it. Too bad they don't have the balls to just say it's out in the open and ask the community to read it over and fix it for them :P I guess that's primarily because they don't have a strong community.

Re:Don't mess with MS

I think people don't really understand what having windows 2000 SP1 source code spreading on internet really means. That's quite important and even if it's only part of the source code it's already enough for the first exploits to appear.

The author was kind enough to tell us about the first one, but I bet many others did find bugs and didn't report them because they are working on viruses and attacks using them.

Isn't it interesting that after a few days of access to the source code, exploits are appearing for obvious bugs; yet MS have had the source code available to themselves for years but still managed to neither find nor fix these same obvious problems.

Note also that in the past, lack of access to the source hasn't prevented the *ahem* occasional exploit being developed anyway.

Re:Don't mess with MS

Anyway what's the point in seeing/having it?

To learn how to cheat at Solitaire?

kazaa, bittorrent, emule/edonkey?

is kazaa one of the vendors? is there anything they can do about emule [sf.net] or edonkey [edonkey.com] users?

the latter seem to traffic especially in things like leaked source RARs, and since most of the central servers are overseas and operated independently (and 'overnet' seems truly peer to peer with no central servers), it would be tough to crack down on them, besides having a bunch of fake clients that harvest IPs. anyone know if they do this?

(i imagine the same concept would apply for bittorrent [bitconjurer.org] downloaders -- except BT relies on central tracking servers which would be comparatively easy to shut down.)

seems like a natural, uh, application, for the freenet project ;) [sourceforge.net]

ah well. it's kinda scary that even the largest/richest software co in the world can't stop the spread of their IP, and that it takes only one person.

-fren

Re:kazaa, bittorrent, emule/edonkey?

"You can break the law if it's disobedience against Microsoft, RIAA labels, Disney or any other mean big business. But you can't break the law when it comes to GPL code."

Odd that, that on a community website, people don't have a problem with attacking those known to be actively hostile to the general public, yet they seem to stick up for projects which consist of lots of normal people giving their time freely for the benefit of society.

You'd have thought that we should teach people to believe whatever the lawmakers tell them to think. After all, if something is illegal, it must be immoral.

Re:kazaa, bittorrent, emule/edonkey?

This is slashdot.
You can break the law if it's disobedience against Microsoft, RIAA labels, Disney or any other mean big business.

Thanks to precisely the "big business" you refer to, the idea of "do it because the law says so" has lost any meaning. Once upon a time, people respected the law, and usually obeyed it. They respected police, and thanked them for doing a hard job and protecting the community.

Now, people look at the law as a neverending set of snares that can catch even the most "upright" among us, for things that no one in their right mind considers an actual crime; at the same time, big business routinely engages in activities that even the most "ethically challenege" among us considers an abominable abuse of people and "the system", without committing the least misdemeanor. People consider police mere thugs, officially carrying out the whims of our megalomaniacal AG, and unofficially engaging in far more nefarious activity (rape, torture, extortion, "abuse of position", etc), which their "Policeman's Bill of Rights" makes exceedingly difficult to catch them at, let alone punish them for.

Possession of a joint will get you a heavier sentence than DUI, yet the government responds by requiring breathalizers in new cars.

Downloading a song worth less than $5 leads to a $150,000 fine (payable via bankruptcy or a "mere" $3k extortion rackett that even several of our corrupt state SCs have called fradulently misleading, since it doesn't prevent later suit by the actual copyright holders).

I could go on, but I don't want to start ranting, and those two seem the most relevant to recent Slashdot posts.

Basically, society no longer cares what the "law" says, because more and more people realize that the "law" says whatever the Honorable Senator from Disney wants it to say. Using it to defend your position compares well to using a pool of sewage runoff to take a bath in - You don't actually accomplish your goal, and you come out smelling like shit.

Once upon a time ...

Once upon a time, people respected the law, and usually obeyed it. They respected police, and thanked them for doing a hard job and protecting the community.

Specifically, that was from 12:30 to 3:45 PM, October 24th, 1955.

Just in case anyone was curious.

Re:kazaa, bittorrent, emule/edonkey?

I think the parent post was saying "That's just wrong." as in "That's just wrong for the U.S. to do that." and then cites examples in other countries where the penalties are more in line with reality.

If you ask me, the fact that the legislators are considering the Orwellian and moronic concept of a car breathalyzer shows that there is no deterrent against drunk driving, but of course, why bother to enforce existing law when you can simply pass new ones?

If the U.S. Constitution were written today, it would be 12000 pages long and be understandable by only three people in the world, two of whom would be driven insane and the other would kill himself out of frustration. It's wonderful that the law of the U.S. could be spelled out simply enough to fit on the back of a cereal box. It's a travesty that U.S. law has become so complex no person could ever understand it all, leave alone be able to obey it all. We are all criminals, and when someone in the government wants to get you, they simply need to figure out what obscure, byzantine law you are ignornantly breaking and proceed to enforce it.

Re:kazaa, bittorrent, emule/edonkey?

"It's elementary that laws don't decide right and wrong. Every American should know that, forty years ago, it was against the law in many states for a black person to sit in the front of a bus; but only racists would say sitting there was wrong." --Stallman

from http://www.gnu.org/philosophy/why-free.html

Re:kazaa, bittorrent, emule/edonkey?

And why shouldn't the comparison be made?

The civil rights movement was about protest, peaceably, against laws that were widely seen as unjust. So is this. If you feel a law is wrong, disobey it -- as long as no one else actually gets harmed -- and be prepared to suffer the consequences, but make sure that your experiences get widely publicized as examples of how laws are used to justify things that morally seem wrong.

Change takes time (a lot happened during the civil rights movement) and a lot of people went to jail for what they did, but in the end, the protests worked. Just because the issues aren't as, er, black and white (pun semi-intended!) doesn't mean some level of comparison isn't valid.

If no one protests when bad laws are passed, then not only will those bad laws stay on the books but even more bad laws will be passed in the future since it can be 'gotten away with' by those who want to push said laws through.

Re:kazaa, bittorrent, emule/edonkey?

This is slashdot. You can break the law if it's disobedience against Microsoft, RIAA labels, Disney or any other mean big business. But you can't break the law when it comes to GPL code. Mod it flamebait, whatever, but look at the trends of moderations here anyways.

Yes, you're on SLASHDOT. When you're HERE, you may notice that people support Linux and the Mac (thanks to OS X) and don't really like MS. That's OUR culture.

Over on the Microsoft-Zealot boards, you'd notice that they support Microsoft's law-breaking as "smart business", while they attack the GPL as communist, a cancer, etc. Don't try to convince us to "play nice" with the people who are trying to kill us, please. Because *they're* not going to play nice, and any "sympathy for the devil" we adopt will end up with us dead.

law

Nothing like being moderated up for encouraging people to break the law.

If peoples' ability to disseminate information serves as a message to corporations that their attempts to turn the US into a police state won't work, then I can live with that.

Re:law

If peoples' ability to disseminate information serves as a message to corporations that their attempts to turn the US into a police state won't work, then I can live with that.

Orrrrrr you could go through VALID channels and work for reform of intellectual property laws. Because as it stands now, if you trade in MS's intellectual property, it's WELL within their legal rights to come after you.

If you don't like it, do something about it. Something BESIDES breaking the law anyway because it suits you and hiding behind "civil disobedience".

Re:kazaa, bittorrent, emule/edonkey?

So I guess the founding fathers of the US should have been modded down...or Harriet Tubman or Dr. Martin Luther King (and others that broke segregation laws)?

It's rather unfortunate that people like yourself base your morals on what papa gub'ment tells you they should be.

Re:kazaa, bittorrent, emule/edonkey?

ah well. it's kinda scary that even the largest/richest software co in the world can't stop the spread of their IP, and that it takes only one person.

Not scary at all. I'd say it is a good thing that not even one of the most powerful forces on this planet can stop information from spreading across the web. Information wants to be free, remember?

Re:kazaa, bittorrent, emule/edonkey?

I haven't downloaded the leaked source (because I don't care), but I *DID* search for it [jigle.com] (on Jigle and NovaSearch) for shits'n'giggles.

I can't believe that Microsoft is actually threatening to "send out legal warnings to any users who search for the leaked code." Even SEARCHING for it? Please bite me.

According to Jigle, over 1,600 people are currently sharing the source on the edonkey network, which is quite a lot when compared to the average file (including pr0n vids).

--

Best threat of all

You download it, you gotta run it!

Re:Best threat of all

Over reacting?
You know, the entire non open source software world has access to the full source code of all GPL software and they do not seem to worried about being tainted by it. Just because the source is there does not mean you have to copy from it and the fact that you have it does not make you automatically guilty that either.

Can't take it back

Once its leaked on the Internet, you can't take it back. People WILL take a peek at it. If Microsoft really needs to be convinced, they should talk to Pam and Tommy :)

Re:Can't take it back

and paris hilton

Re:Can't take it back

and janet jackson

can I be modded funny too?

Re:Can't take it back

Sure, I'll mod you up... whoops.

Nevermind.

Re:Can't take it back

Yeah, it's like that old pool analogy:

Putting something in the Internet is like peeing in a swimming pool. You just can't take it back.

I can see the letter now

Dear Sir, Please, please, please don't look for more exploits in our code! We've got enough already to keep us busy for the next decade or so. Signed, Your pals at Microsoft.

MS Snail Mail

Probably a package that weighs 5 pounds, doesn't open right, has about 2 sentences of actual use, and then crubmles while being read.

Re:MS Snail Mail

don't forget the license on the inside that tells you what terms you agreed to when you opened it.

silly question

how are they able to know who's downloading the files from p2p network?
is that you big bro?

Re:silly question

Most p2p network have search facilities. The search is done on a server, and the server is able to (and probably already does) log who searches for what. A server hosting a torrent can do the same, but since those are more often volunteers themselves, they probably won't.

Now that the source code is leaked, MS will probably get a lot safer, with all those hackers and crackers exploiting their bugs and thus revealing them ;-)

Re:Leaked on Purpose?

CTO: 2k isn't safe anymore... you set aside funding for Longhorn, right?
CFO: Yeah, we put $100,000 in 10-year T-bonds yesterday...

does anyone think they'll find the source?

but does anyone think MS will find the source that leaked the source?

(pun intended)

Warnings?

I thought the thing to do nowadays was to sue the pants off downloaders. Is M$ trying to play good guy warning downloaders rather than suing them?

Re:Warnings?

What noone picked up on is MSFT is SNAIL MAILING downloaders.

No matter the text of the letter, the implication in recieving a snail mail vs. an e-mail is obvious: "WE KNOW WHO YOU ARE AND WHERE YOU LIVE, MOFO!"

Re:Warnings?

I certainly hope noone downloaded it through my wireless network..... That would be so incredibly lousy....

THAT IS PERFECT.

They're also apparently working in conjunction with several un-named peer to peer vendors to send out legal warnings to any users who search for the leaked code.

Oh my God, that's great.

Anyone want to suddenly start hopping on kazaa and posting spoofed search requests for "leaked windows 2000 code" which appear to be coming from the IP addresses of the White House, the Dennis Hastert re-election campaign, various randomly selected people, entire blocks inside of Time-Warner...

It could be like a p2p reverse honeypot.

Once a few thousand people start getting threatening legal notices from MS for something they didn't do, what happens next?

Re:THAT IS PERFECT.

Then, the MS legal department will send threatening letters to other MS departments.

Well, if it's good enough for Fox... ;-)

Nothing like security through lawyers.

This has got to work even better than security through obscurity.

How did it leak?

Subsequent investigation has shown this was not the result of any breach of Microsoft's corporate network or internal security, nor is it related to Microsoft's Shared Source Initiative or its Government Security Program

How did it leak?

Freenet

Now do you understand why we need Freenet [slashdot.org]?

Re:Freenet

Ahh yes, for all those LEGITIMATE uses for P2P networks, such as distributing MP3's and leaked source code, right?

And Slashdotters STILL don't understand why so many people and companies perceive that most traffic on P2P networks involves either porn, infringed music/movies/software.

Suggestions like in the parent post do no favors for establishing legitimacy for P2P netowrks.

Wait.

Does this mean that Windows is open source. Is it cool to use Windows yet?

Re:Wait.

Is it cool to use Windows yet?

No. Wait until someone imagines a Beowulf cluster of it

I used to have the compiled code

But it was kinda buggy.

I'm skeptical

While it may be illegal to steal source code that is privately held. I don't know that it is illegal to view it once it has been released. Perhaps someone has a more educated viewpoint. But this seems like a scare tactic without much legal standing.

Re:I'm skeptical

It is not illegal to view it. It is illegal to download it.

Re:I'm skeptical

you are completely uninformed. It is illegal to:

1. Distribute it
2. Use parts of it as your own

It is not illegal to:

1. Possess a copy of it
2. Read the code
3. Think about what you have read
4. Talk about what you have read

Re:I'm skeptical

Actually, I believe it's illegal to upload it, rather than download it.

This is roughly the same as picking up a set of photocopies you see sitting on the curb. Copywritten or not, you haven't done anything wrong by picking them up, as you didn't violate the author's copyright.

The person who made the copies is violating the copyright (originally two words, godamnit!) not the person who picked them up.

This is one of the issues with the RIAA going after Recipients, rather than Source.

If I buy stolen goods at a garage sale, and the cops find me, they take them away and give them back to the owners. They arrest the thief, not the poor sucker who bought the goods.

I'll at least give Redmond credit for issuing warnings rather than subpoenas. Though "Searching for phrase != downloading files I shouldn't have access to."

now it makes sense

I was wondering why when I tried compiling it, it stopped halfway through and I heard Madonna's voice scream, "What the fuck do you think you're doing?"

MS warnings in the mail

Dear Peer-to-Peer user,

Please do not download our source code or we will be forced to sue you. We are not kidding, we will sue you. Seriously, we'll sue...

Sincerly,

Bill Gates

Reply
Dear Bill.

Please stop poluting the internet with your crappy source. Every time I search for porn now, I get coppies of some crappy pile of shit called winedows or something. Furthermore, don't even talk to me about frivilous litigation bub. I wrote that book.

Besides, your source leak is stealing my valuable press. How am I supposed to dump my stock if I can't pump it first.

P.S. Thanks for the license fees.

Yours in infamy,

Darl.

For those sharing the source...

... or just using the P2P networks, PeerGuardian can help. I reject about 250 requests per day on the Emule network from tracking companies. Here's about 40 minutes worth:

Connection Rejected: 12.222.39.72 - Communications Resources PGIPDB (02-19-2004 @ 17:49:19)
Connection Rejected: 12.222.39.72 - Communications Resources PGIPDB (02-19-2004 @ 17:50:00)
Connection Rejected: 12.222.39.72 - Communications Resources PGIPDB (02-19-2004 @ 17:50:42)
Connection Rejected: 12.222.39.72 - Communications Resources PGIPDB (02-19-2004 @ 17:56:11)
Connection Rejected: 12.222.39.72 - Communications Resources PGIPDB (02-19-2004 @ 17:56:55)
Connection Rejected: 12.222.39.72 - Communications Resources PGIPDB (02-19-2004 @ 17:57:37)
Connection Rejected: 12.222.39.72 - Communications Resources PGIPDB (02-19-2004 @ 17:59:00)
Connection Rejected: 12.222.39.72 - Communications Resources PGIPDB (02-19-2004 @ 17:59:44)
Connection Rejected: 12.222.39.72 - Communications Resources PGIPDB (02-19-2004 @ 18:00:26)
Connection Rejected: 12.222.39.72 - Communications Resources PGIPDB (02-19-2004 @ 18:08:53)
Connection Rejected: 12.222.39.72 - Communications Resources PGIPDB (02-19-2004 @ 18:09:35)
Connection Rejected: 12.222.39.72 - Communications Resources PGIPDB (02-19-2004 @ 18:10:16)
Connection Rejected: 12.222.39.72 - Communications Resources PGIPDB (02-19-2004 @ 18:18:51)
Connection Rejected: 12.222.39.72 - Communications Resources PGIPDB (02-19-2004 @ 18:19:34)
Connection Rejected: 12.222.39.72 - Communications Resources PGIPDB (02-19-2004 @ 18:20:14)
Connection Rejected: 12.222.39.72 - Communications Resources PGIPDB (02-19-2004 @ 18:28:40)
Connection Rejected: 12.222.39.72 - Communications Resources PGIPDB (02-19-2004 @ 18:29:24)
Connection Rejected: 12.222.39.72 - Communications Resources PGIPDB (02-19-2004 @ 18:30:06)

You can get it from Methlabs.org. Windows only as far as I know.

That is a slick tool.. haven't heard of it before.

It looks like they have a fairly extensive IP block list. It shouldn't be too hard to get this list to work w/ IPtables.

My question -- will IPtables run "okay" with a few thousand block rules?

ms warning

I must have found one of these warnings - when I downloaded "Windows_source_code.zip", all it contained was a .wav file of Bill Gates cussing at me.

A warning which is also a record

Seeing that MS is sending out warning to those downloaders, it already knew who they are, thus it could be just a warning to those downloaders that if any exploits were out, they will be the first to be investigated.

exploit is a known issue?

On Monday, February 16, Microsoft began investigating a reported exploit on versions of Internet Explorer allegedly discovered by an individual studying the leaked source code. This exploit is a known issue that Microsoft had discovered internally and addressed with the latest release of Internet Explorer -- Internet Explorer 6.0 Service Pack 1.

Um, don't usually like to argue semantics, but what was discovered was a security vulnerability (bug) in the code, not an "exploit".

Devising and revealing a method to take advantage of this problem (a virus, worm, bitmap) is an "exploit", right?

They can sue me for WHAT?

To sum up the article:

Microsoft can now sue you for...

...taking a leak!

<rimshot/>

The Leak Source

For those of you still looking for the leaked source code here it is:

#include "windows.h"
#include "system_errors.h"
#include "stdlib.h"
#include "msdos_bugs.h"

char make_prog_look_big[1600000];

main()
{
if (detect_OS2())
freeze();

if (detect_cache())
disable_cache();

if (fast_cpu())
set_wait_states(lots);

set_mouse(speed, very_slow);
set_mouse(action, jumpy);
set_mouse(reaction, sometimes);
set_icons(UGLY);

print("Welcome to Windoze 3.11111");

if (system_ok())
crash(to_dos_prompt);
else
system_memory = open("a:\swp0001.swp", O_CREATE);

while(1) {
sleep(5);
get_user_input();
sleep(5);
act_on_user_input();
sleep(5);
if (rand() < 0.9)
crash(complete_system);
}
return(unrecoverable_system);
}

I don't get it!

Subsequent investigation has shown this was not the result of any breach of Microsoft's corporate network or internal security, nor is it related to Microsoft's Shared Source Initiative or its Government Security Program, which enable our customers and partners, as well as governments, to legally access Microsoft source code. Microsoft reaffirms its support for both the Shared Source Initiative and the Government Security Program.

I just don't get it. No security breach. Not related to the SSI, nor GSP. Then how did it leak???? Psychics?

Re:I don't get it!

Then how did it leak????

Well you see, the bathroom door was locked...

Someone got kicked off their ISP...

... because they put up an archive called "kernel-source-2.6.3.tar.bz2"

No one actually checked what it contained but blindly assumed it was windows. Heh. Funny world.

Re:Someone got kicked off their ISP...

Don't know if you were joking, but some folks really got MS Office war3z letters from the BSA for putting up OpenOffice downloads.

Re:Someone got kicked off their ISP...

Don't know if you were joking, but

It's no joke:

Subject: [linux-elitists] Microsoft goes after Linux kernel downloaders?
Date: Mon, 16 Feb 2004 20:15:28 -0600

I went trolling, and it seems I caught the biggest fish of them all.

When the story about the MS leak appeared on Slashdot this past week,
I thought I'd have a bit of fun. A post entitled "Kernel source here,"
which pointed to a torrent of Linux 2.6.2, was all it took to hook
about a thousand would-be NT and 2000 source downloaders.

"You can find the build applications and such with Google already."

I trickled the torrent out at about 1k/s for the first few hours, then
let it go full-speed once we'd crossed over 600 active
participants. Let 'em all have the punchline at once.

Imagine my surprise when my DSL stops working this morning, I call my
provider, and I learn that I've been accused of copyright
infringement. I argued that I was doing absolutely nothing wrong, and
they turned service back on. After I asked to see the accuser's email,
they forwarded the below. Sure enough, it's a bona fide valentine from
MS Legal:

J.K. Weston
Microsoft Corporation
One Microsoft Way
Redmond, WA 98052
[e-mail]
Tel: [phone]

14 Feb 2004

URGENT/IMMEDIATE ATTENTION REQUIRED
VIA ELECTRONIC MAIL

[My ISP]

Re: NOTICE OF POTENTIAL UNLAWFUL DISTRIBUTION OF MICROSOFT SOURCE
CODE AT: [one of my IPs]

Date of Infringement: Detail below.

Dear [My ISP]:

We have received information that one of your users as identified
above by the SITE/URL [My IP] may have engaged in the unlawful
distribution of Microsoft's source code for Windows 2000, and/or
Windows NT4, by distributing and offering for download these source
code files via a peer-to-peer network.

Since you own this IP address, we request that you take appropriate
action against the account holder under your Abuse Policy/Terms of
Service Agreement.

The IP they chose wasn't the tracker, it was a system participating as
a torrent peer. This makes me wonder if there are a thousand other
P2P Linux 2.6.2 downloaders enjoying MS' Feb 14 love.

Now, admittedly I was just asking for it by hinting at something that
might offend the big giant. Still, it took them three or four days to
issue this letter. In the meantime, shouldn't they have been able to
find someone capable of cracking open a .tar.bz2? Did nobody raise the
question of how a leaked CD fits into a 32m file?
___________________________________________ ____

Q: How do they know the snail addy of web users?

A: Why oh why did I register with Insta-Trace?!?

$100 for forwarding this email...

Holy crap, Microsoft can find your physical mailing address if you download their source code...

Does that mean those people I laughed at in high school for circulating that thing about Bill Gates sending you $100 for forwarding this email were RIGHT?!

Damn, now I wish I'd been stupid enough to send that thing on - I could use an extra hundred bucks.

I got a letter from Microsoft today...

It had a EULA shrinkwrapped to it that said "Upon opening this letter I am hereby agreeing to..." so I just tossed it in the trash. I guess I'll wait till one of the letters gets leaked online, then I can just download it.

Too little too late...

The code is out, it wont come back.
There are hundreds and hundreds of sources in emule, and thousands have been downloading (5k requests the last 5 days). Not to mention irc, ftps, kazaa , winmx and the other stuff.

As an educated guess i would say that at least 50-100.000 people have the source currently on their harddisc.
Whoever wants it now has it....

Stop trading MS codes

We should respect MS copyrights just as we expect MS to respect GPL. Sure MS may be dirty, but we are better than them.

Re:Stop trading MS codes

The parents is what people should be saying here. Respect others as you would have them respect you, regardless of how evil/vile they are. MS may be a convicted monopoly and leveraging computer and software companies, but trading their copyrighted code illegally is not justified.

Don't go to their level. Be better.

Yadda yadda yadda

We should respect MS copyrights just as we expect MS to respect GPL. Sure MS may be dirty, but we are better than them.

I don't have their code, nor do I want it. But I realize that even if every single Linux user/GPL supporter refused to look at it or download it, it would still spread like wildfire. People download stuff like this just to say that they have it. I have a friend who is somewhat of a "collector" of things like this. He has no programming background whatsoever, he just wants to say that he has it. (ironically, he is actually in school getting a law degree with a concentration in Intellectual Property)

The cat-genie is out of the bag-bottle.

Horse

Barn Door
Close

Oh wait.....

NOW they tell me :(

After I get my network connection killed

My message from Microsoft

When the news of the leak broke, I jumped on edonkey and downloaded it. Got this email via my ISP a couple days later, I've since deleted the code (it's not that interesting to me anyway. Bunch of BSD code in there tho...)

Microsoft Corporation
One Microsoft Way Redmond, WA 98052
14 Feb 2004 18:45:44 GMT
URGENT/IMMEDIATE ATTENTION REQUIRED VIA ELECTRONIC MAIL
Re: NOTICE OF POTENTIAL UNLAWFUL DISTRIBUTION OF MICROSOFT SOURCE CODE AT: [my IP address]
Date of Infringement: Detail below.

Dear [my ISP]: We have received information that one of your users as identified above by the SITE/URL [my IP address] may have engaged in the unlawful distribution of Microsoft's source code for Windows 2000, and/or Windows NT4, by distributing and offering for download these source code files via a peer-to-peer network. Since you own this IP address, we request that you take appropriate action against the account holder under your Abuse Policy/Terms of Service Agreement. We also kindly request that you forward this notice promptly to the user of the IP address listed above at the time and date stated.

To the user at [my IP address]: The unauthorized copying and distribution of Microsoft's protected source code is a violation of both civil and criminal copyright and trade secret laws. If you have downloaded and are making the source code available for downloading by others, you are violating Microsoft's rights, and could be subject to severe civil and criminal penalties. Microsoft demands that you immediately (1) cease making Microsoft's source code available or otherwise distributing it, (2) destroy any and all copies you may have in your possession, and (3) provide us any and all information about how you came into possession of this code. Microsoft takes these issues very seriously, and will pursue legal action against individuals who take part in the proliferation of it source code. We look forward to your prompt cooperation. Should you need to contact me, I can be reached at the address above or at [e-mail].
Very truly yours,

Initial Infringement Timestamp: 14 Feb 2004 05:01:23 GMT
Recent Infringement Timestamp: 14 Feb 2004 05:01:23 GMT

Inside Microsoft...

Ballmer: "Hey, Bill. Some intern from down in engineering came up with this great idea. No, don't worry, I fired him -- how dare he propose such a thing <grins evilly>"

Gates: "Interesting Steve... What's this idea?"

Ballmer: "Well, suppose we leaked the 2K and NT4 sources on the Internet."

Gates: "I'm not sure I follow."

Ballmer: "Think about it. We've got stagnating revenue streams from companies who are still using NT4 and 2000. We've got people continually hacking our software. Are you seeing the connection here?"

Gates: "Sure, I get you: release the source code, so hackers can analyze it to find all the holes. We get free QA, and in the meantime, we can pressure our customers to upgrade to XP, because it's not vulnerable to these source code attacks. Thus, getting more money for us, from people who wouldn't have otherwise upgraded. Brilliant!"

Ballmer: "You're catching on. And hey, I just thought of an extra bonus! We can track down people who actually download the source code and sue them. That way, we get another auxiliary revenue stream from court, make ourselves look good by appearing to 'fight hackers,' and strengthen the hostile attitudes held toward open source software by linking them to our stolen source code! Another inch closer to having a lock-hold on the Supreme Court when they finally make the big decisions about the validity of intellectual property!"

Gates: "Why, this could have a favorable impact on the outcome of the SCO case, could it not?"

Ballmer: "Sure. Those stupid Linux fanboys and their 'take over the world' nonsense. They don't understand who they're playing ball with."

What's wrong with copyright law

Another inch closer to having a lock-hold on the Supreme Court when they finally make the big decisions about the validity of intellectual property!

Funny, but it's worth pointing out that the USSC is not going to be making any big decisions about the validity of intellectual property... the US Constitution explicitly provides Congress with the right to make IP laws and even provides a brief rationale for them.

What Congress should be looking at, though, is whether or not the current laws make any sense at all. What is really bizarre to me is this notion that you can keep something secret and yet still have copyright protection on it.

The original reasoning behind copyright as we know it (as opposed to the true original reasoning, which was about facilitating censorship by the British Crown) was to enable authors to retain limited control of their published works, in order to encourage them to publish. When you publish a book, the content is out there for the world to see and potentially copy; there's no way to publish a book and keep it secret at the same time, so some legal protections are necessary if we want to enable authors to control and profit from their work.

These "legal protections" are really limitations on what society is allowed to do with the work, in other words, freedoms we choose to give away, and the reason this is a good trade is because (a) it makes more material available now for people to read, learn from and build off of and (b) it ultimately puts more material in the public domain for anyone to use however they see fit when the copyright expires.

Patents are really the same idea applied to a different space: Getting the details of inventions published for everyone to read theoretically encourages more invention. With patents, there's a *requirement* that the details be published, because unlike a book, it often is possible to keep secret the details of a piece of machinery.

Even for copyrights, there is and always has been a sort of a requirement to publish -- under current law you cannot sue over copyright unless you have registered your work with the copyright office, and doing that requires you to submit a copy to them, placing it in the public record. Kind of. In the case of code, you only have to submit a few pages from the beginning and the end. The rationale behind copy registration was primarily to establish ownership, not to publish, because when all of this was set up publishing was just a given. Because that was the rationale, when code copyrights came along it was deemed too burdensome to deal with full printouts of the registered code (because they're really, really big) and, of course, the copyright office wouldn't have had any idea what to do with magnetic media.

So now we've arrived at a situation that cannot have been expected or planned by the designers of the system: You can obtain copyright protection on something that you never published and never have to publish, even when you go to court to enforce your rights. The "trade" is no longer a trade, because society no longer gets to benefit from seeing what it is giving you protection for. There's no requirement that the code *ever* be published, even after the copyright has expired (assuming current copyrights ever will expire).

In my opinion, it should only be possible to obtain protection for what you publish. If you want to keep your source secret and only publish binaries, fine. You get copyright protection for the binaries and you can use trade secret law to protect your source code -- but remember the caveat in trade secret law that once it's published it's no longer a secret, so you can only go after the person who gave it away the first time.

On the other hand, if you want the full protection of copyright law applied to your source code, then you have to publish the code, at least before going to court over it. Publish *all* of it. I don't think the US Copyright Office of 2004 will have any trouble at all understanding how

Stomp out IP

Microsoft says that it working with the FBI. How many DIY programmers could ever claim that they were getting help from the FBI to track down people who had pirated their software? This is an example of how intellectual property only exists to benefit the rich and powerful who can get the authorities to do their policing for them. Microsoft has the FBI. I guess the rest of us would have to resort to rent-a-cops and DIY cease-and-desist letters.

Not Just P2P

I got two calls yesterday from my on-campus network administrator's office asking to speak to my room mate. This is odd because I believe he downloaded it through a DC++ connection, as he seems to avoid bittorrent for some reason. All they asked was that he removed the source from his computer, I don't think there were any other consequences. Anyone else have a similar experience?

Microsoft still insists...

...that the leak didn't come from a breach in security at either their network or the networks of any corporate or government partner. In short, it didn't come from anyone who has the source. Right.

They are also still toeing the line that it was code from NT and 2000. Conveniently omitting XP and Server 2003 from the list. Aren't those OSes built on the same codebase? Isn'y it possible that they are also potentially affected? Wouldn't want to scare people with our latest OSes, now would we? And for those that haven't upgraded (most businesses?), upgrading now looks safer than not.

Also of note in the release is that not just IE 5.5 and older are succeptable to the expoloit that was released, but non-SP1 IE6 as well.

Re:Copyright and GPL

Well personally i find it pretty shitty that some corporation thinks it has the right to tell me what i can and cannot 'search' for. Microsoft, go fuck yourselves, you let the code out, its in the open, you cant make that go-away.

Makes you wonder...

why Microsoft isn't so rabid about stopping the spread of Windows XP and 2000 ISOs on filesharing services...

-Jem

Good news

Trying to stop the source code is like throwing $20 bills from a manhattan balconey, and going down and trying to collect them all back.

Theres a great deal of ill feeling towards Microsoft, thanks to their annoying crashing OS, and anyone threatened with a lawsuit will be actually determined to send out the source code anonymously.

What I'm extremely interested in, is if someone has successfully compiled the code and tested it. I'm interested in knowing what parts of windows the code is from. Hopefully we get the kernel + binary execution segments so WINE is developed as well as SAMBA. I think as soon as we can run win32 binaries properly on Linux, along with at least directx8, linux will be a MUCH bigger competitor of both Microsoft and Apple.

It is a massive right-wing conspiracy...

...to poison the Wine Project [winehq.org] I tell you! Microsoft will claim wine dev team all had access to source-code! It's a trap, Wine developers must pull their net access cables from the walls immediately before it too late! Sign-off now!!!!!! We will contact you later by smoke signal to let you kow when its all clear.

Trust no one!

.signature

EVERYBODY already has it!

If the local state-run university my sons attends is any indication, everybody who wants a copy ALREADY has it!!

My son says that every computer science student he knows already has downloaded a copy and that students are eagerly trading copies among themselves!

Makes you think...

Statement from Microsoft Regarding Illegal Posting of Windows Source Code

Last updated: Feb. 18, 2004, 9:00 a.m. PST

REDMOND, Wash., Updated Feb. 18, 2004 -- On Thursday, February 12, Microsoft became aware that portions of the Microsoft Windows 2000 and Windows NT 4.0 source code were illegally made available on the Internet. Subsequent investigation has shown this was not the result of any breach of Microsoft's corporate network or internal security, nor is it related to Microsoft's Shared Source Initiative or its Government Security Program, which enable our customers and partners, as well as governments, to legally access Microsoft source code. Microsoft reaffirms its support for both the Shared Source Initiative and the Government Security Program.

Now heres the thought-provoking question of the day:

If the leak was not caused by a network security breach, a physical security breach, a troubled-employee, or it's code sharing initiatives; how the hell was the code leaked? They said it wasnt network security, and it wasnt internal security (which takes away a physical security breach or a troubled employee), and it wasnt't its code sharing initiatives... Makes you wonder... how the hell did the code get out?

Answer this and get a cookie.

Interesting evaluation of the source code

From Kuro5hin... [kuro5hin.org]

taking

Taking something off of the internet, is like taking pee out of a swimming pool...

Microsoft is Big Brother

Has anyone noticed that the RIAA has tried for two years to figure out how to connect an IP address to a snailmail address with out resorting to subpeonas, yet M$ did it in about 4 days? Has this not raised any eyebrows, made anyone look over their sholder, or consider buying a Mac, Unix, Linux, OS/2, anything not Microsoft box. In fact I'm probably putting myself at risk just by typing this. Oh crap, there here already...

Here's one way MS could find P2P users

One way Microsoft could be finding P2P users would be to be running clients on all P2P networks with a copy of the leaked code being shared. Then:

Copy down the IP address of anyone who starts a multi-source download
Kill the download
Whois lookup
Letter to the ISP.

Of course if they're distributing it in that manner so that the hash codes match, does that qualify as them legally giving it away?

So has it made it onto Usenet yet?

Is a search illegal?

Where does it say that a search is illegal.. Regardless of what i search for..

Possession of information is illegal in some cases.. Distribution is illegal in other cases.. But *searching*?

Screw them...

only scary part is that some p2p people are willing to cooperate with a entity that has NO LEGAL POWERS...

How did they get the home address?

They didnt goto court to supeona the information, how are they getting the home address of people so quickly?

Is that even legal for them to do ( assuming they didnt get a court order. ... )

I used to work for Mac OS X

The first companys named for inspection are google, sony playstation and Mac OS X.

I used to work for MacOSX, but they fired me. Now I work for Playstation.

Re:You people are missing an important point.

Copyrights might have been extended by Congress, but they can still lapse if they aren't defended comensurate to their value.

That's trademarks, not copyrights.

Re:You people are missing an important point.

but they can still lapse if they aren't defended comensurate to their value.

So....you're saying MS should just do nothing?

Re:You people are missing an important point.

Copyright cannot lapse per se, the right is unconditionally granted and there is no concept of abandonment (which you can do with patents and trademarks): however, if a copyright owner didn't take any action against infringements - when it knew that they were happening - it could be a good arguement that the owner has "allowed" an implicit license to come into effect. This is just a common legal principle of estoppel: if you passively consent to something, it becomes difficult to later turn around and retract.