Forgot your password?
typodupeerror
Microsoft

Microsoft Warning Leaked Code Traders 833

Posted by CmdrTaco
from the thats-a-bit-creapy dept.
An anonymous reader writes "Broadand Reports notes that Microsoft is now sending snail mail warnings to downloaders of the leaked source code. They're also apparently working in conjunction with several un-named peer to peer vendors to send out legal warnings to any users who search for the leaked code. The notice on Microsoft's website has been updated to reflect the new warnings."
This discussion has been archived. No new comments can be posted.

Microsoft Warning Leaked Code Traders

Comments Filter:
  • Don't mess with MS (Score:3, Insightful)

    by zeux (129034) * on Thursday February 19, 2004 @04:39PM (#8331311)
    Don't mess with Microsoft, they have the money and the power to track you down, even on Internet and through P2P networks. And they will, this is just an example and a warning.

    I will never download the source code and you should better not try too. Anyway what's the point in seeing/having it?

    I think people don't really understand what having windows 2000 SP1 source code spreading on internet really means. That's quite important and even if it's only part of the source code it's already enough for the first exploits to appear.

    The author was kind enough to tell us about the first one [slashdot.org], but I bet many others did find bugs and didn't report them because they are working on viruses and attacks using them.

    Let's see what happens in the coming months. I'm already working on the switch from Windows 2003 Server to Linux in my company for this exact reason.
  • by frenetic3 (166950) * <houston@nosPam.alum.mit.edu> on Thursday February 19, 2004 @04:40PM (#8331326) Homepage Journal
    is kazaa one of the vendors? is there anything they can do about emule [sf.net] or edonkey [edonkey.com] users?

    the latter seem to traffic especially in things like leaked source RARs, and since most of the central servers are overseas and operated independently (and 'overnet' seems truly peer to peer with no central servers), it would be tough to crack down on them, besides having a bunch of fake clients that harvest IPs. anyone know if they do this?

    (i imagine the same concept would apply for bittorrent [bitconjurer.org] downloaders -- except BT relies on central tracking servers which would be comparatively easy to shut down.)

    seems like a natural, uh, application, for the freenet project ;) [sourceforge.net]

    ah well. it's kinda scary that even the largest/richest software co in the world can't stop the spread of their IP, and that it takes only one person.

    -fren
  • silly question (Score:5, Insightful)

    by deadmongrel (621467) <karthik@poobal.net> on Thursday February 19, 2004 @04:41PM (#8331346) Homepage
    how are they able to know who's downloading the files from p2p network?
    is that you big bro?
  • by junkymailbox (731309) * on Thursday February 19, 2004 @04:44PM (#8331400)
    This has got to work even better than security through obscurity.
  • Freenet (Score:3, Insightful)

    by agentZ (210674) on Thursday February 19, 2004 @04:44PM (#8331407)
    Now do you understand why we need Freenet [slashdot.org]?
  • by lambent (234167) on Thursday February 19, 2004 @04:47PM (#8331462)
    "Don't mess with Microsoft, they have the money and the power to track you down, even on Internet and through P2P networks. And they will, this is just an example and a warning."

    I have the power to track people through P2P, too. I've found people in my apartment complex on the networks. I've even met a few friends that way. Too bad that doesn't mean that I'm a multi-billion dollar company.

    Please note, it is absurdly easy to track people on the networks. It is not indicative MS power, or their legal muscle.

    As for seeing & having it, one major point is that you CAN. What was once taboo is now freely available (sorta), and people are reveling in like. To draw a completely inaccurate parallel, it's like the sexual revolution of the 70s/80s in the US.

    Otherwise, I agree with your post.
  • Bad Reasoning (Score:4, Insightful)

    by Inhibit (105449) on Thursday February 19, 2004 @04:47PM (#8331465) Homepage Journal
    What will happen when the Linux project servers for the version you use get breached. Or what if there are exploits that can't be fixed immediatly?

    Switching off of Windows sounds great to me, as I really dislike using it, but your reasoning sounds a bit flawed. If it's because the software's buggy and prone to exploitation, great. But if it's just because some code got leaked.. and OSS software generally has all the code available all the time.. then your reasoning sounds a little flawed.

    Any software will have flaws. It's inevitable. Knee jerk reactions too those flaws generally aren't a good idea though.
  • by Anonymous Coward on Thursday February 19, 2004 @04:47PM (#8331466)
    From the M$ web site: "Microsoft source code is both copyrighted and protected as a trade secret."

    Got that one half right:

    1) yup it's copyrighted and you can't have the code.
    (so far so good)

    2) there are no legal protections for "trade secrets" --- it means nothing that the "trade secrets" were leaked other than it's a violation of 1)

  • by Erratio (570164) on Thursday February 19, 2004 @04:47PM (#8331473)
    Yeah, released source code is horrible for security. Look at OpenBSD, all those servers just waiting to get hacked in to. Maybe now Microsoft will actually have to, I don't know...eliminate exploits instead of waiting for them to appear, then fixing them after it's too late (if it isn't already).
  • by fembots (753724) on Thursday February 19, 2004 @04:48PM (#8331486) Homepage
    Seeing that MS is sending out warning to those downloaders, it already knew who they are, thus it could be just a warning to those downloaders that if any exploits were out, they will be the first to be investigated.
  • Re:Freenet (Score:5, Insightful)

    by TrollBridge (550878) on Thursday February 19, 2004 @04:50PM (#8331512) Homepage Journal
    Ahh yes, for all those LEGITIMATE uses for P2P networks, such as distributing MP3's and leaked source code, right?

    And Slashdotters STILL don't understand why so many people and companies perceive that most traffic on P2P networks involves either porn, infringed music/movies/software.

    Suggestions like in the parent post do no favors for establishing legitimacy for P2P netowrks.

  • by pantycrickets (694774) on Thursday February 19, 2004 @04:51PM (#8331544)
    (i imagine the same concept would apply for bittorrent [bitconjurer.org] downloaders -- except BT relies on central tracking servers which would be comparatively easy to shut down.)

    Which is what they seem to have done. I got it off of torrent, but now all the links seem dead.

    It's interesting.. they were playing it down so much when it was announced, but then I guess reality struck. "Professional" analysts were saying it would have no impact on security, and less than a week later already an exploit was released based on the source. Albeit a pretty worthless exploit (IE5), but still. The point is.. if you read through the source, you'll see how much stuff was ripped from much earlier stuff (NT, IE3, etc).. so it's safe to assume that much of XP is based on that source. Much of their programming/security methodologies remain unchanged I'm sure.
  • by Anonymous Coward on Thursday February 19, 2004 @04:53PM (#8331580)
    I'm already working on the switch from Windows 2003 Server to Linux in my company for this exact reason.

    It took leaked source code to make you switch? Man, hackers and spammers have been taking advantage of exploits in Winndows for years without the source code! If that wasn't enough to convince you, why switch now?
  • Re:Public patches? (Score:2, Insightful)

    by fembots (753724) on Thursday February 19, 2004 @04:56PM (#8331627) Homepage
    But how many people are willing to install an anonymous patch? It is more risky than having the machine unpatched.

    On top of that, most 'pa-and-ma' users will not find such patch - come on, they can't even find the official updates!
  • Re:I'm skeptical (Score:3, Insightful)

    by stratjakt (596332) on Thursday February 19, 2004 @04:58PM (#8331663) Journal
    How do you figure that?

    If someone hacked JK Rowlings computer, and leaked the "source" for the next Harry Potter book, would it be OK to donwload and read it?

    It's their copyrighted work. It's at least as illegal to download the Windows source as it is to download copyrighted films or music w/o permission.
  • by imsabbel (611519) on Thursday February 19, 2004 @04:59PM (#8331671)
    The code is out, it wont come back.
    There are hundreds and hundreds of sources in emule, and thousands have been downloading (5k requests the last 5 days). Not to mention irc, ftps, kazaa , winmx and the other stuff.

    As an educated guess i would say that at least 50-100.000 people have the source currently on their harddisc.
    Whoever wants it now has it....
  • by Bull999999 (652264) on Thursday February 19, 2004 @04:59PM (#8331682) Journal
    We should respect MS copyrights just as we expect MS to respect GPL. Sure MS may be dirty, but we are better than them.
  • by DragonMagic (170846) on Thursday February 19, 2004 @05:01PM (#8331706) Homepage
    This is slashdot.

    You can break the law if it's disobedience against Microsoft, RIAA labels, Disney or any other mean big business.

    But you can't break the law when it comes to GPL code.

    Mod it flamebait, whatever, but look at the trends of moderations here anyways.
  • patches via email (Score:2, Insightful)

    by bstil (652204) on Thursday February 19, 2004 @05:01PM (#8331709)
    If the leaked source code reveals any more Windows security issues, I'll just wait until Microsoft Corporation emails me an .EXE file patch.

    ;)
  • law (Score:5, Insightful)

    by sacrilicious (316896) on Thursday February 19, 2004 @05:02PM (#8331731) Homepage
    Nothing like being moderated up for encouraging people to break the law.

    If peoples' ability to disseminate information serves as a message to corporations that their attempts to turn the US into a police state won't work, then I can live with that.

  • by dpilot (134227) on Thursday February 19, 2004 @05:03PM (#8331747) Homepage Journal
    There have been many security comparisons between Linux and Windows, and the conclusions have always been mixed. One reason is because of the scope of the included software - because it's "free" Linux distributions usually include the kitchen sink, so there are more packages to count security exposures in. Another reason is multiple counting - one exposure across multiple distributions. Yet another factor not well estimated has been the severity of the exposures.

    But these security exposures have all been in an environment where Linux source was generally available for inspection, and Windows source wasn't. A corollary of this is that most of the Linux exposures have been proactively reported, prior to being exploited. With Windows that's not so clear.

    In the future, there's not reason to expect Linux security exposures to change significantly, except through becoming a bigger target because of increased usage. But the fundamentals of bugs, bug reporting, bug fixing, and security haven't changed.

    The future story for Windows is different now, because some source has become available. *Maybe* some people will begin proactive security work on the source, and *maybe* Microsoft will roll that work into fixes. But for certain, others wearing differnt color hats will be examining that code for security exposures, too.
  • by Anonymous Coward on Thursday February 19, 2004 @05:04PM (#8331759)
    Information doesn't want to be anything. It's people that want it to be free, or not free, depending entirely on their agenda and what they have to gain.
  • by DragonMagic (170846) on Thursday February 19, 2004 @05:04PM (#8331771) Homepage
    The parents is what people should be saying here. Respect others as you would have them respect you, regardless of how evil/vile they are. MS may be a convicted monopoly and leveraging computer and software companies, but trading their copyrighted code illegally is not justified.

    Don't go to their level. Be better.
  • by bluprint (557000) on Thursday February 19, 2004 @05:07PM (#8331818) Homepage
    So I guess the founding fathers of the US should have been modded down...or Harriet Tubman or Dr. Martin Luther King (and others that broke segregation laws)?

    It's rather unfortunate that people like yourself base your morals on what papa gub'ment tells you they should be.
  • Re:Bad Reasoning (Score:5, Insightful)

    by The Wannabe King (745989) on Thursday February 19, 2004 @05:08PM (#8331838)
    There's a big difference here. While only the virus writers are looking through the leaked Windows source, OSS is under heavy scrutiny from many parties. Most people who find a potential exploit in OSS will report it to someone who can write a patch, or they will do it themselves. Just look at MS' attempts to stop the distribution of the source, how many able programmers with good intentions will take the risk to read it?

    Of course there are flaws in OSS too, but there's a much greater chance the good guys will find them first.

  • by Anonymous Coward on Thursday February 19, 2004 @05:08PM (#8331839)
    a show of hands, please, from every programmer who forgot to delete some irritable or obscene comment that came back to haunt him later

    a second show of hands from every programmer who has added a comment line, easter egg or meaningless fragment of code to his work as a digital fingerprint, much like the bogus entries you'll find in any telephone book

  • Re:I'm skeptical (Score:5, Insightful)

    by leerpm (570963) on Thursday February 19, 2004 @05:10PM (#8331864)
    It is not illegal to view it. It is illegal to download it.
  • by Vainglorious Coward (267452) on Thursday February 19, 2004 @05:10PM (#8331865) Journal

    I think people don't really understand what having windows 2000 SP1 source code spreading on internet really means. That's quite important and even if it's only part of the source code it's already enough for the first exploits to appear.

    The author was kind enough to tell us about the first one, but I bet many others did find bugs and didn't report them because they are working on viruses and attacks using them.

    Isn't it interesting that after a few days of access to the source code, exploits are appearing for obvious bugs; yet MS have had the source code available to themselves for years but still managed to neither find nor fix these same obvious problems.

    Note also that in the past, lack of access to the source hasn't prevented the *ahem* occasional exploit being developed anyway.

  • by rjelks (635588) on Thursday February 19, 2004 @05:13PM (#8331919) Homepage
    Microsoft hasn't been going after the p2p clients at all. They're using the RIAA's technique of calling the ISP that owns the ip address and having the ISP send a warning letter. If they wanted to make an example, a strong possibility, they could sue the user in court just as easily. Just because a p2p service is based in a far away country, don't think you're safe or anonymous. If you're in windoze, just run your commandline and type 'netstat' the next time you're downloading from p2p.

    -
  • by gnu-generation-one (717590) on Thursday February 19, 2004 @05:13PM (#8331923) Homepage
    "You can break the law if it's disobedience against Microsoft, RIAA labels, Disney or any other mean big business. But you can't break the law when it comes to GPL code."

    Odd that, that on a community website, people don't have a problem with attacking those known to be actively hostile to the general public, yet they seem to stick up for projects which consist of lots of normal people giving their time freely for the benefit of society.

    You'd have thought that we should teach people to believe whatever the lawmakers tell them to think. After all, if something is illegal, it must be immoral.
  • Stomp out IP (Score:5, Insightful)

    by deathofcats (710348) on Thursday February 19, 2004 @05:14PM (#8331933) Homepage
    Microsoft says that it working with the FBI. How many DIY programmers could ever claim that they were getting help from the FBI to track down people who had pirated their software? This is an example of how intellectual property only exists to benefit the rich and powerful who can get the authorities to do their policing for them. Microsoft has the FBI. I guess the rest of us would have to resort to rent-a-cops and DIY cease-and-desist letters.
  • by JaredOfEuropa (526365) on Thursday February 19, 2004 @05:14PM (#8331936) Journal
    More from the MS notice page:
    Subsequent investigation has shown this was not the result of any breach of Microsoft's corporate network or internal security, nor is it related to Microsoft's Shared Source Initiative or its Government Security Program, which enable our customers and partners, as well as governments, to legally access Microsoft source code.
    So it wasn't an inside job, nor was their network compromised, nor any of the shared source partners leaked it. So... how did it get out in the open? The wind blew a stack of printed source code through an open window? The Underpants Gnomes (tm) took it? Someone left a CDROM on the seat of his BMW Z3 convertible and left the top down? What?
  • by TrollBridge (550878) on Thursday February 19, 2004 @05:18PM (#8332016) Homepage Journal
    "It's rather unfortunate that people like yourself base your morals on what papa gub'ment tells you they should be."

    And it's unfortunate that people like yourself try to equate petty crime like copyright infringement to some kind of noble civil rights struggle. Some of you will do anything to justify not wanting to pay for the software you use.

  • Re:silly question (Score:2, Insightful)

    by Cousin Scuzzy (754180) on Thursday February 19, 2004 @05:20PM (#8332052)
    What does it matter if Microsoft knows that you searched for the code online? It's either sharing or downloading the code that's illegal, not searching for it.

    The IP addresses of those sharing the code may be available from the server, but isn't the download conducted peer to peer? If so, it's sharing the code that would be dangerous, not searching for it or downloading it.
  • Re:Freenet (Score:3, Insightful)

    by freeweed (309734) on Thursday February 19, 2004 @05:20PM (#8332054)
    Slashdotters STILL don't understand why so many people and companies perceive that most traffic on P2P networks involves either porn, infringed music/movies/software.

    I understand perfectly well why that pereception exists. It's because is true. Not all, but most traffic on P2P networks does involve what you listed. Most money in the US has traces of cocaine in it. The implication being that most money has been used in the (highly illegal) drug trade. Does that do any favours for the legitimacy of money? Personally, I didn't realize we were trying to make KaZaa OK with Grandma and Grandpa. In 1995, I couldn't care less if people wanted to think the "interweb" was filled with nothing but kiddie porn (which was a popular perception at the time). I feel the same for P2P today. Let people demonize it all they want, it's still not going away.

    When people advocate something like Freenet, and you shoot it down because it "illegitimizes P2P", you're missing the point. What's illegal in one country (criticizing the government) isn't necessarily illegal in another. Or hell, even wrong. Maybe someone out there thinks source code shouldn't be protected by law. Maybe in some countries it ISN'T. The point of Freenet is to allow that someone to post it, free of persecution. You can't advocate free speech based on "well, this part of speech is wrong".
  • by samdu (114873) <samdu&ronintech,com> on Thursday February 19, 2004 @05:23PM (#8332092) Homepage
    ...that the leak didn't come from a breach in security at either their network or the networks of any corporate or government partner. In short, it didn't come from anyone who has the source. Right.

    They are also still toeing the line that it was code from NT and 2000. Conveniently omitting XP and Server 2003 from the list. Aren't those OSes built on the same codebase? Isn'y it possible that they are also potentially affected? Wouldn't want to scare people with our latest OSes, now would we? And for those that haven't upgraded (most businesses?), upgrading now looks safer than not.

    Also of note in the release is that not just IE 5.5 and older are succeptable to the expoloit that was released, but non-SP1 IE6 as well.
  • by pla (258480) on Thursday February 19, 2004 @05:27PM (#8332175) Journal
    This is slashdot.
    You can break the law if it's disobedience against Microsoft, RIAA labels, Disney or any other mean big business.


    Thanks to precisely the "big business" you refer to, the idea of "do it because the law says so" has lost any meaning. Once upon a time, people respected the law, and usually obeyed it. They respected police, and thanked them for doing a hard job and protecting the community.

    Now, people look at the law as a neverending set of snares that can catch even the most "upright" among us, for things that no one in their right mind considers an actual crime; at the same time, big business routinely engages in activities that even the most "ethically challenege" among us considers an abominable abuse of people and "the system", without committing the least misdemeanor. People consider police mere thugs, officially carrying out the whims of our megalomaniacal AG, and unofficially engaging in far more nefarious activity (rape, torture, extortion, "abuse of position", etc), which their "Policeman's Bill of Rights" makes exceedingly difficult to catch them at, let alone punish them for.

    Possession of a joint will get you a heavier sentence than DUI, yet the government responds by requiring breathalizers in new cars.

    Downloading a song worth less than $5 leads to a $150,000 fine (payable via bankruptcy or a "mere" $3k extortion rackett that even several of our corrupt state SCs have called fradulently misleading, since it doesn't prevent later suit by the actual copyright holders).

    I could go on, but I don't want to start ranting, and those two seem the most relevant to recent Slashdot posts.

    Basically, society no longer cares what the "law" says, because more and more people realize that the "law" says whatever the Honorable Senator from Disney wants it to say. Using it to defend your position compares well to using a pool of sewage runoff to take a bath in - You don't actually accomplish your goal, and you come out smelling like shit.
  • by Anonymous Coward on Thursday February 19, 2004 @05:28PM (#8332186)
    Yeah, right.... then, why, my fellow capitalist, do they have a coffee shop and comfy chairs at B&N?
  • by Stallmanite (752733) on Thursday February 19, 2004 @05:33PM (#8332252) Homepage
    "It's elementary that laws don't decide right and wrong. Every American should know that, forty years ago, it was against the law in many states for a black person to sit in the front of a bus; but only racists would say sitting there was wrong." --Stallman

    from http://www.gnu.org/philosophy/why-free.html
  • Good news (Score:3, Insightful)

    by mnmn (145599) on Thursday February 19, 2004 @05:38PM (#8332313) Homepage
    Trying to stop the source code is like throwing $20 bills from a manhattan balconey, and going down and trying to collect them all back.

    Theres a great deal of ill feeling towards Microsoft, thanks to their annoying crashing OS, and anyone threatened with a lawsuit will be actually determined to send out the source code anonymously.

    What I'm extremely interested in, is if someone has successfully compiled the code and tested it. I'm interested in knowing what parts of windows the code is from. Hopefully we get the kernel + binary execution segments so WINE is developed as well as SAMBA. I think as soon as we can run win32 binaries properly on Linux, along with at least directx8, linux will be a MUCH bigger competitor of both Microsoft and Apple.

  • Yadda yadda yadda (Score:5, Insightful)

    by gosand (234100) on Thursday February 19, 2004 @05:39PM (#8332315)
    We should respect MS copyrights just as we expect MS to respect GPL. Sure MS may be dirty, but we are better than them.

    I don't have their code, nor do I want it. But I realize that even if every single Linux user/GPL supporter refused to look at it or download it, it would still spread like wildfire. People download stuff like this just to say that they have it. I have a friend who is somewhat of a "collector" of things like this. He has no programming background whatsoever, he just wants to say that he has it. (ironically, he is actually in school getting a law degree with a concentration in Intellectual Property)

    The cat-genie is out of the bag-bottle.

  • by zootread (569199) <[moc.oohay] [ta] [daertooz]> on Thursday February 19, 2004 @05:45PM (#8332401)
    This is slashdot.
    You can break the law if it's disobedience against Microsoft, RIAA labels, Disney or any other mean big business


    Don't forget marijuana-related "crimes."

    "You can break the law as long as you honestly believe that it is wrong." -Gandhi

  • Makes you think... (Score:5, Insightful)

    by mtwalkup (745000) on Thursday February 19, 2004 @05:53PM (#8332518)
    Statement from Microsoft Regarding Illegal Posting of Windows Source Code


    Last updated: Feb. 18, 2004, 9:00 a.m. PST

    REDMOND, Wash., Updated Feb. 18, 2004 -- On Thursday, February 12, Microsoft became aware that portions of the Microsoft Windows 2000 and Windows NT 4.0 source code were illegally made available on the Internet. Subsequent investigation has shown this was not the result of any breach of Microsoft's corporate network or internal security, nor is it related to Microsoft's Shared Source Initiative or its Government Security Program, which enable our customers and partners, as well as governments, to legally access Microsoft source code. Microsoft reaffirms its support for both the Shared Source Initiative and the Government Security Program.


    Now heres the thought-provoking question of the day:

    If the leak was not caused by a network security breach, a physical security breach, a troubled-employee, or it's code sharing initiatives; how the hell was the code leaked? They said it wasnt network security, and it wasnt internal security (which takes away a physical security breach or a troubled employee), and it wasnt't its code sharing initiatives... Makes you wonder... how the hell did the code get out?

    Answer this and get a cookie.
  • by Anonymous Coward on Thursday February 19, 2004 @05:54PM (#8332532)
    If said small children saw it, and the children's parents didn't teach them the words already, and their proper use, then I can't see it being a problem. There are worse things to happen than seeing a bad word, that's for sure...
  • by snake_dad (311844) on Thursday February 19, 2004 @05:54PM (#8332535) Homepage Journal
    I'm not allowed to run a server, but I could put it up on the webspace that comes with the account.
  • by Crispy Critters (226798) on Thursday February 19, 2004 @05:54PM (#8332536)
    "...released source code is horrible for security. Look at OpenBSD..."

    Just maybe there is a difference between an open development process, like OpenBSD, where incremental changes are examined before becoming part of the production code and dumping on the web hundreds of meg of source of a finished product which has an installed base of millions. Open source OS's get security from having many people looking at code submissions and the opportunity to find and fix dangerous bugs before they are exploited. Making a bunch of Windows source code available on the net does neither of these things.

  • Civil Disobedience (Score:2, Insightful)

    by red floyd (220712) on Thursday February 19, 2004 @06:03PM (#8332650)

    But you can only call it "Civil Disobedience" if you're willing to face the consequences of your act (and not try to weasel out of it).
  • by Saeger (456549) <farrellj AT gmail DOT com> on Thursday February 19, 2004 @06:10PM (#8332745) Homepage
    I haven't downloaded the leaked source (because I don't care), but I *DID* search for it [jigle.com] (on Jigle and NovaSearch) for shits'n'giggles.

    I can't believe that Microsoft is actually threatening to "send out legal warnings to any users who search for the leaked code." Even SEARCHING for it? Please bite me.

    According to Jigle, over 1,600 people are currently sharing the source on the edonkey network, which is quite a lot when compared to the average file (including pr0n vids).

    --

  • by Anonymous Coward on Thursday February 19, 2004 @06:12PM (#8332766)
    but the janet jackson clip wasn't "illicitly" distributed via the internet p2p--as were the pamela and paris clips. her clip was broadcast to millions of people during the superbowl.

    but sure, i'd give you a funny mod anyway....
  • weaseling (Score:3, Insightful)

    by sacrilicious (316896) on Thursday February 19, 2004 @06:21PM (#8332879) Homepage
    you can only call [something] "Civil Disobedience" if you're willing to face the consequences of your act (and not try to weasel out of it).

    Point #1: I don't think anybody in this thread has weighed in on whether facing consequences is or is not part of their plan.

    Point #2: If someone chooses to break the law in an effort to cause change, what authority defines what "weaseling out of the consequences" is and its bearing on whether the term civil disobedience applies? Would Rosa Parks have been weaseling out if she'd accepted legal representation from a better attorney? Websters says that "civil disobedience" is:

    refusal to obey governmental demands or commands especially as a nonviolent and usually collective means of forcing concessions from the government
    I didn't notice anything in there regarding facing consequences or weaseling out. I wonder if the dictionary people are up to date.

    Point #3: What does it matter whether an illegal action gets to be called civil disobedience as long as the action has the desired effect?

    If it will make anyone happy, then by all means people can invent a new term that categorically denotes breaking the law with the ultimate intent to increase freedom but with the specific proviso that the lawbreaker does not intend to face consequences. Then those same people can get busy debating just exactly what shall be deemed "facing consequences". Be sure to let us all know how it comes out, we'll be on the edges of our bus seats.

  • by Anonymous Coward on Thursday February 19, 2004 @06:22PM (#8332888)
    Dude, the GPL is not the same as MS EULA's.

    I don't see any reason to support a crappy system of copyright, instead of a good one.

    You "insightful" folks realize there's a big difference between the GPL and the MS EULA's, right????

    MS EULA -- requires the FBI to enforce

    GPL - requires Ebon Mogwhatever from the FSF to send an email to a company, maybe 2-3 over a few months, and the issue gets resolved.

    I don't get these "moral high" ground comments. I don't like MS copyrights, I like GPL copyrights, that's about all there is to it. MS copyrights take too much effort to enforce.. laws that are broken by millions of people every day are not good laws.

    Note to microsoft and FBI: I have no interest in the MS source code, heck I'm on dialup!.. please don't put me in Gitmo for my comments, I love america, just want to see copyright returned to the founding father's original vision.
  • by nolife (233813) on Thursday February 19, 2004 @06:26PM (#8332924) Homepage Journal
    Over reacting?
    You know, the entire non open source software world has access to the full source code of all GPL software and they do not seem to worried about being tainted by it. Just because the source is there does not mean you have to copy from it and the fact that you have it does not make you automatically guilty that either.
  • by yotaku (26455) on Thursday February 19, 2004 @06:29PM (#8332969) Homepage
    the source code available to themselves for years but still managed to neither find nor fix these same obvious problems
    All of the exploits that have been appearing out of the source code leak had all been fixed prior to the leak. At least all of the ones that I have heard about. This includes the one that was posted here on /.

    I know I've seen plenty of obvious open source exploits that had been around for years too. So don't give me that crap about open source projects being imunne to stupid errors.

    The fact of the matter is that these are very large projects. No one is going to argue that windows isn't a large project. And with any large project there are ALWAYS going to be bugs. It is inherent in software engineering.
  • Re:I'm skeptical (Score:5, Insightful)

    by Bagheera (71311) on Thursday February 19, 2004 @06:36PM (#8333045) Homepage Journal
    Actually, I believe it's illegal to upload it, rather than download it.

    This is roughly the same as picking up a set of photocopies you see sitting on the curb. Copywritten or not, you haven't done anything wrong by picking them up, as you didn't violate the author's copyright.

    The person who made the copies is violating the copyright (originally two words, godamnit!) not the person who picked them up.

    This is one of the issues with the RIAA going after Recipients, rather than Source.

    If I buy stolen goods at a garage sale, and the cops find me, they take them away and give them back to the owners. They arrest the thief, not the poor sucker who bought the goods.

    I'll at least give Redmond credit for issuing warnings rather than subpoenas. Though "Searching for phrase != downloading files I shouldn't have access to."

  • by bfg9000 (726447) on Thursday February 19, 2004 @06:38PM (#8333057) Homepage Journal
    This is slashdot. You can break the law if it's disobedience against Microsoft, RIAA labels, Disney or any other mean big business. But you can't break the law when it comes to GPL code. Mod it flamebait, whatever, but look at the trends of moderations here anyways.

    Yes, you're on SLASHDOT. When you're HERE, you may notice that people support Linux and the Mac (thanks to OS X) and don't really like MS. That's OUR culture.

    Over on the Microsoft-Zealot boards, you'd notice that they support Microsoft's law-breaking as "smart business", while they attack the GPL as communist, a cancer, etc. Don't try to convince us to "play nice" with the people who are trying to kill us, please. Because *they're* not going to play nice, and any "sympathy for the devil" we adopt will end up with us dead.
  • by ztirffritz (754606) on Thursday February 19, 2004 @06:52PM (#8333218)
    Has anyone noticed that the RIAA has tried for two years to figure out how to connect an IP address to a snailmail address with out resorting to subpeonas, yet M$ did it in about 4 days? Has this not raised any eyebrows, made anyone look over their sholder, or consider buying a Mac, Unix, Linux, OS/2, anything not Microsoft box. In fact I'm probably putting myself at risk just by typing this. Oh crap, there here already...
  • by Buran (150348) on Thursday February 19, 2004 @06:52PM (#8333222)
    And why shouldn't the comparison be made?

    The civil rights movement was about protest, peaceably, against laws that were widely seen as unjust. So is this. If you feel a law is wrong, disobey it -- as long as no one else actually gets harmed -- and be prepared to suffer the consequences, but make sure that your experiences get widely publicized as examples of how laws are used to justify things that morally seem wrong.

    Change takes time (a lot happened during the civil rights movement) and a lot of people went to jail for what they did, but in the end, the protests worked. Just because the issues aren't as, er, black and white (pun semi-intended!) doesn't mean some level of comparison isn't valid.

    If no one protests when bad laws are passed, then not only will those bad laws stay on the books but even more bad laws will be passed in the future since it can be 'gotten away with' by those who want to push said laws through.
  • Re:I'm skeptical (Score:3, Insightful)

    by Anonymous Brave Guy (457657) on Thursday February 19, 2004 @07:11PM (#8333456)
    Let's PLEASE avoid the whole "copying isn't theft" argument... it's old and a waste of time. The judge most likely would say that they are the same.

    Before five million slashbots jump in here, I'll point out that the above is clearly untrue: there are enormous legal differences between infringing copyright and theft, and the judges haven't, don't and probably won't say they are the same. Ethically, it's an entirely different question, of course; I'm surprised none of the big media groups has yet started campaigning to make knowingly viewing illegally copied material an offence.

  • by Nom du Keyboard (633989) on Thursday February 19, 2004 @07:34PM (#8333743)
    One way Microsoft could be finding P2P users would be to be running clients on all P2P networks with a copy of the leaked code being shared. Then:

    Copy down the IP address of anyone who starts a multi-source download
    Kill the download
    Whois lookup
    Letter to the ISP.

    Of course if they're distributing it in that manner so that the hash codes match, does that qualify as them legally giving it away?

    So has it made it onto Usenet yet?

  • by lambent (234167) on Thursday February 19, 2004 @07:35PM (#8333758)

    Traceroute is your friend. Port scanning is your friend. Social Engineering will make you a new best friend at the ISP central office.

    And in general, knowing the topography of the network you are on is a good idea.

    Trust me on this ... when you are on p2p, you are NOT alone.
  • by Darby (84953) on Thursday February 19, 2004 @07:48PM (#8333921)
    Given that the code that was released is all older code, I have another reasonable theory about where it came from.

    Remember a while back when it came out that a group of hackers had compromised MS's internal network and had access to it for over a month. At the time they admitted it they denied that the group obtained access to the source code. Of course they would deny it regardless of the truth or whether or not they knew. Basic damage control.

    So say in the interest of avoiding getting too much attention directed at them, perhaps they waited until now to release what they found.

    Just a thought, but it seems as reasonable as their assertions.

  • Re:Bad Reasoning (Score:4, Insightful)

    by Angst Badger (8636) on Thursday February 19, 2004 @07:54PM (#8333971)
    Switching off of Windows sounds great to me, as I really dislike using it, but your reasoning sounds a bit flawed. If it's because the software's buggy and prone to exploitation, great. But if it's just because some code got leaked.. and OSS software generally has all the code available all the time.. then your reasoning sounds a little flawed.

    The vital difference, at least in theory, is that FLOSS developers are operating under the assumption that any would-be attacker can see the source, so they have to make damn sure it's secure. Microsoft developers, on the other hand, have been relying for years on security through obscurity, and have therefore been less careful.

    This is obviously not going to be true in every case. BIND's developers, for example, are evidently entirely unaware that the source code is being distributed freely, or else they're relying on security-through-ugly-kludginess. Contrariwise, I'm sure that there are plenty of developers at Microsoft who care very much about security, but their managers see that sales are good despite the bugginess of the code, so they allocate their developers' time to new features instead of bugfixes.

    The fact that Microsoft or any software company thinks it's a disaster to have the source leaked is, however, a cardinal sign of poor engineering. They should be pissed, perhaps, but not terrified.
  • by ninjamonkey (694442) on Thursday February 19, 2004 @08:00PM (#8334040) Homepage

    Microsoft will take all appropriate legal actions to protect its intellectual property. These actions include communicating both directly and indirectly with those who possess or seek to possess, post, download or share the illegally disclosed source code.
    So does this mean that if I go into a P2P program and do a search for "Windows 2000 Source", I am seeking to possess the sourcecode?

    That would be a pretty big assumption by Microsoft!

    The first thing I did when I heard the source had been leaked was to hop on my favorite P2P network and search to see how many people had it. I did _NOT_ download it. If, for whatever reason, I get a letter in the mail from Microsoft ( highly doubt it ), I will be so pissed off. I mean, what would be the next step? If someone does a Google News search for "Leaked Microsoft Source", they're attempting to locate a place to download it?
  • Re:Bad Reasoning (Score:3, Insightful)

    by Darby (84953) on Thursday February 19, 2004 @08:01PM (#8334045)

    But if it's just because some code got leaked.. and OSS software generally has all the code available all the time.. then your reasoning sounds a little flawed.


    At first thought it sounds flawed, but you're ignoring one major factor. The source for Linux has always been open. The source for Windows has always been closed.

    Now it is possible that there are security vulnerabilities in Linux which have been there for a long time, but it is unlikely that there are a lot of bad ones.

    This doesn't apply to brand new code added to Linux, of course.

    If MS were to release their entire codebase for their latest OS today, there would almost certainly be many very serious issues since far fewer people with the appropriate skills have gone through it. Given the severity of the exploits found without the code, this is a reasonable assumption.

    Now after a few years this discrepancy would go away, and all other things being equal, there would be about an equal number in each.

    Get it?

  • by Moofie (22272) <lee@ringofsaturn.3.1415926com minus pi> on Thursday February 19, 2004 @08:44PM (#8334479) Homepage
    States don't get to take away Constitutionally guaranteed liberties. That's why we have a Constitution.

    No, I don't feel guilty when I exercise my inalienable human rights, even if it does get Microsoft's nose out of joint. They can go screw.

    So I should feel guilty if I read some code that I downloaded from the Internet? I didn't pick any locks or hack any computers to steal it. I've done nothing wrong. Microsoft fumbled their trade secret, and now it's out there. They might be able to make a case for copyright infringement, but unless and until I damage them, they've got no real case.

    And, in point of fact, I HAVEN'T downloaded the code, because there are few things I'm less interested in than Microsoft's 600 mb of crap.
  • by juglugs (652924) on Thursday February 19, 2004 @09:14PM (#8334775) Homepage
    Really?

    How exactly do you know that?

    Seems like they may be a scapegoat - their CEO says that they didn't do it - thats the same amount of evidence that says that Microsoft didn't do it...

    Are we believing the Microsoft Marketing Machine when they say that their security was not breached? I mean, they've never had security issues before have they?



  • by ConceptJunkie (24823) on Thursday February 19, 2004 @09:33PM (#8334994) Homepage Journal
    I think the parent post was saying "That's just wrong." as in "That's just wrong for the U.S. to do that." and then cites examples in other countries where the penalties are more in line with reality.

    If you ask me, the fact that the legislators are considering the Orwellian and moronic concept of a car breathalyzer shows that there is no deterrent against drunk driving, but of course, why bother to enforce existing law when you can simply pass new ones?

    If the U.S. Constitution were written today, it would be 12000 pages long and be understandable by only three people in the world, two of whom would be driven insane and the other would kill himself out of frustration. It's wonderful that the law of the U.S. could be spelled out simply enough to fit on the back of a cereal box. It's a travesty that U.S. law has become so complex no person could ever understand it all, leave alone be able to obey it all. We are all criminals, and when someone in the government wants to get you, they simply need to figure out what obscure, byzantine law you are ignornantly breaking and proceed to enforce it.

  • by Anonymous Coward on Thursday February 19, 2004 @09:51PM (#8335165)
    dude, let it go. Haven't you ever hung around a LAN before? Like say, a school lab or the college intranet. You visit your friends across the hall, check out their IP, run tcpdump, sniff some AIM and unencrypted HTTP traffic. After enough information gathering, you can pretty much deduce the network topology, whether static/dynamic IPs are being assigned, which octets are assigned in which building, etc. It doesn't take long before you have enough info to stalk^D^D^D^D^D recognize the traffic from the red-haired girl next door.

    MS and RIAA have this power too, they could just hire PI's to do the snarfing....unfortunately, this is illegal without a warrant so the information gathered would be inadmissable to court. It just makes it easier to force the ISPs to give you the info, that way they can multitask while waiting for the courts and ISPs to comply (or not).
  • by gaspyy (514539) on Friday February 20, 2004 @02:36AM (#8337176)
    Information wants to be free, remember? ... unless it's your information...
  • by NickSemyonov (529251) on Friday February 20, 2004 @06:10AM (#8337912)
    This close vs. open source security issue reminds me of crypto stuff. In crypto world it is good custom to assume that your crypto algo is known and you cannot rely just on fact that nodoby knows which algo exactly you are using.
    IMHO the same with closed source - people doesn't see the source code but they can try to reverse engineer the code and even steal the code - in this case all your security goes down the tubes. Remember Morris worm [worm.net] - Morris discovered buffer overflow bug in UNIX sendmail by reading the closed source he had access in DEC and wrote an exploit.
    Such things will happen time to time and you will see how many new viruses for Win2K will appear shortly after this leak.

    No sig is a good sig.

From Sharp minds come... pointed heads. -- Bryan Sparrowhawk

Working...