Microsoft Warning Leaked Code Traders 833
An anonymous reader writes "Broadand Reports notes that Microsoft is now sending snail mail warnings to downloaders of the leaked source code. They're also apparently working in conjunction with several un-named peer to peer vendors to send out legal warnings to any users who search for the leaked code. The notice on Microsoft's website has been updated to reflect the new warnings."
Traders or Traitors? (Score:5, Interesting)
I think the title should have read "MS Warns Leaked Code TRAITORS" considering that the code probably got leaked from one of their own.
From the MS Notice page:
Customers running Windows XP Service Pack 1 or Windows Server 2003 who have installed all of the latest updates are not impacted
In other words: "Dear companies running on W2K, please pay for upgrades ASAP. We would like more money. Thanks."
[/tin_foil_hat]
Leaked on Purpose? (Score:2, Interesting)
Warnings? (Score:5, Interesting)
How did it leak? (Score:3, Interesting)
How did it leak?
Re:kazaa, bittorrent, emule/edonkey? (Score:5, Interesting)
Not scary at all. I'd say it is a good thing that not even one of the most powerful forces on this planet can stop information from spreading across the web. Information wants to be free, remember?
I'm skeptical (Score:5, Interesting)
Why waste their time? (Score:1, Interesting)
Public patches? (Score:2, Interesting)
patches are available to make it more secure from Big Brother, and more stable.
Is this the beginning of the Kazaa-Lite-ing of windows?
For those sharing the source... (Score:5, Interesting)
Connection Rejected: 12.222.39.72 - Communications Resources PGIPDB (02-19-2004 @ 17:49:19)
Connection Rejected: 12.222.39.72 - Communications Resources PGIPDB (02-19-2004 @ 17:50:00)
Connection Rejected: 12.222.39.72 - Communications Resources PGIPDB (02-19-2004 @ 17:50:42)
Connection Rejected: 12.222.39.72 - Communications Resources PGIPDB (02-19-2004 @ 17:56:11)
Connection Rejected: 12.222.39.72 - Communications Resources PGIPDB (02-19-2004 @ 17:56:55)
Connection Rejected: 12.222.39.72 - Communications Resources PGIPDB (02-19-2004 @ 17:57:37)
Connection Rejected: 12.222.39.72 - Communications Resources PGIPDB (02-19-2004 @ 17:59:00)
Connection Rejected: 12.222.39.72 - Communications Resources PGIPDB (02-19-2004 @ 17:59:44)
Connection Rejected: 12.222.39.72 - Communications Resources PGIPDB (02-19-2004 @ 18:00:26)
Connection Rejected: 12.222.39.72 - Communications Resources PGIPDB (02-19-2004 @ 18:08:53)
Connection Rejected: 12.222.39.72 - Communications Resources PGIPDB (02-19-2004 @ 18:09:35)
Connection Rejected: 12.222.39.72 - Communications Resources PGIPDB (02-19-2004 @ 18:10:16)
Connection Rejected: 12.222.39.72 - Communications Resources PGIPDB (02-19-2004 @ 18:18:51)
Connection Rejected: 12.222.39.72 - Communications Resources PGIPDB (02-19-2004 @ 18:19:34)
Connection Rejected: 12.222.39.72 - Communications Resources PGIPDB (02-19-2004 @ 18:20:14)
Connection Rejected: 12.222.39.72 - Communications Resources PGIPDB (02-19-2004 @ 18:28:40)
Connection Rejected: 12.222.39.72 - Communications Resources PGIPDB (02-19-2004 @ 18:29:24)
Connection Rejected: 12.222.39.72 - Communications Resources PGIPDB (02-19-2004 @ 18:30:06)
You can get it from Methlabs.org. Windows only as far as I know.
PR Boom (Score:2, Interesting)
We've already come to the agreement that this code shouldn't be seen by anyone who is currently contributing or even could possibly in the future contribute to OSS.
The only thing MS stands to lose here is an influx of possible exploits caused by bad code. It's not the full source so it's not like it'll compile to something useful (i.e. piracy).
Maybe they SHOULD go after these folks...but as BGates said recently, hackers are good for MS software because hackers test/break systems, thus making MS improve. Which PR spin will win this one out?
Re:Don't mess with MS (Score:2, Interesting)
already got one (Score:2, Interesting)
Just for searching? (Score:1, Interesting)
That tempts me to go searching on Kazaa just to draw it in, and then sue the bastards for harassment.
Re:Bad Reasoning (Score:4, Interesting)
Re:So, like, WHY is this bad? (Score:3, Interesting)
1) If I find a bug that lets me execute code on a windows machine, the average hacker a) tells people about it gets it fixed because he has the best interest of MS and users at heart or b) exploits it for some notoriety or monetary gain. Even if 99% of people choose a), if any choose b), viruses and worms means everyone is affected. Sure, they could patch it, but slow patch adoption rates and slow patch creation rates (look how long the ASN1 patch took to get fixed) means any exploit has a long shelf life.
2) Somewhat related to 1) above, they said that if they are more secure because they keep the source guarded. It is no longer, people may start thinking it's less secure. Security through obscurity only works if the code is obscured.
3) From what I hear (haven't seen it) the code looks pretty amateur in places. MS is a huge company, and not a monolith. Some of the code will be low quality. They just plain look bad.
My ISP called me to warn me (Score:2, Interesting)
Im in UK. I havent seen/heard of anyone else getting this (Happend to me on monday) suprised it took till today for it to be brought to light, must admit it makes me somewhat relived to see that their just warning about it, must say I was really $hitting myself at one point. Hell I dont even know C/C++ I was just curious to take a look.
Re:Someone got kicked off their ISP... (Score:5, Interesting)
Re:Warnings? (Score:5, Interesting)
No matter the text of the letter, the implication in recieving a snail mail vs. an e-mail is obvious: "WE KNOW WHO YOU ARE AND WHERE YOU LIVE, MOFO!"
That is a slick tool.. haven't heard of it before. (Score:5, Interesting)
My question -- will IPtables run "okay" with a few thousand block rules?
Re:silly question (Score:3, Interesting)
Now, that's luxery!
YARITE (Score:2, Interesting)
What does concern me is how MS is running after those who are obtaining the leaked code. Is an FBI group standing over every P2P system, and then providing user information to MS? Please! Or is the media running multiple [shortnews.com] reports [internetwk.com] on behalf of MS, about those receiving [informationweek.com] warnings, while in fact this entire affair is a media stunt?
Re:Don't mess with MS (Score:3, Interesting)
Great point! Building it will be just about impossible, and even if you do get it to build (somehow
Windows is built using the latest internal versions of the vc compiler and such and for true release builds there are all kinds of post-build "magic" tools (vulcan,lego,etc) run on that code before it really becomes production.
I can definitely understand some desire to look at this "forbidden" code, but when you really think about it, what the heck would you really do with it?
Re:kazaa, bittorrent, emule/edonkey? (Score:3, Interesting)
But... (Score:2, Interesting)
Makes you wonder... (Score:4, Interesting)
-Jem
Re:Warnings? (Score:2, Interesting)
Re:kazaa, bittorrent, emule/edonkey? (Score:2, Interesting)
deja vu (Score:1, Interesting)
***
AN OPEN LETTER TO HOBBYISTS
By William Henry Gates III
February 3, 1976
An Open Letter to Hobbyists
To me, the most critical thing in the hobby market right now is the lack of good software courses, books and software itself. Without good software and an owner who understands programming, a hobby computer is wasted. Will quality software be written for the hobby market?
Almost a year ago, Paul Allen and myself, expecting the hobby market to expand, hired Monte Davidoff and developed Altair BASIC. Though the initial work took only two months, the three of us have spent most of the last year documenting, improving and adding features to BASIC. Now we have 4K, 8K, EXTENDED, ROM and DISK BASIC. The value of the computer time we have used exceeds $40,000.
The feedback we have gotten from the hundreds of people who say they are using BASIC has all been positive. Two surprising things are apparent, however, 1) Most of these "users" never bought BASIC (less than 10% of all Altair owners have bought BASIC), and 2) The amount of royalties we have received from sales to hobbyists makes the time spent on Altair BASIC worth less than $2 an hour.
Why is this? As the majority of hobbyists must be aware, most of you steal your software. Hardware must be paid for, but software is something to share. Who cares if the people who worked on it get paid?
Is this fair? One thing you don't do by stealing software is get back at MITS for some problem you may have had. MITS doesn't make money selling software. The royalty paid to us, the manual, the tape and the overhead make it a break-even operation. One thing you do do is prevent good software from being written. Who can afford to do professional work for nothing? What hobbyist can put 3-man years into programming, finding all bugs, documenting his product and distribute for free? The fact is, no one besides us has invested a lot of money in hobby software. We have written 6800 BASIC, and are writing 8080 APL and 6800 APL, but there is very little incentive to make this software available to hobbyists. Most directly, the thing you do is theft.
What about the guys who re-sell Altair BASIC, aren't they making money on hobby software? Yes, but those who have been reported to us may lose in the end. They are the ones who give hobbyists a bad name, and should be kicked out of any club meeting they show up at.
I would appreciate letters from any one who wants to pay up, or has a suggestion or comment. Just write to me at 1180 Alvarado SE, #114, Albuquerque, New Mexico, 87108. Nothing would please me more than being able to hire ten programmers and deluge the hobby market with good software.
Bill Gates
General Partner, Micro-Soft
Which law? (Score:1, Interesting)
And I ask, "WHICH LAW?"; that is, what law would I be breaking if I do download this leaked source code?
Is it only a copyright violation, exactly akin to downloading Pirates of the Caribbean (except for the thugs are better-armed...)?
Would I somehow be found guilty of DMCA violation? I doubt "compilation is an effective encryption process" would fly in court.
Unless I'm wrong (and please correct me if I am!), the only law being broken here is that of copyright.
And, is it not true that only the _unauthorised distributor_ of the copyrighted material is punishable? It seems to me that these letters from M$ are probably like "Do not redistribute what you've already got, or we'll _____."
Unless someone explains otherwise, I'm going to suppose that it's effectively just fine to download the source, as long as I don't share it myself. Of course, this is only an academic exercise to me as I'm WHOLLY uninterested in that particular source code. If I were, I'd probably suggest ++caution.
What's wrong with copyright law (Score:5, Interesting)
Another inch closer to having a lock-hold on the Supreme Court when they finally make the big decisions about the validity of intellectual property!
Funny, but it's worth pointing out that the USSC is not going to be making any big decisions about the validity of intellectual property... the US Constitution explicitly provides Congress with the right to make IP laws and even provides a brief rationale for them.
What Congress should be looking at, though, is whether or not the current laws make any sense at all. What is really bizarre to me is this notion that you can keep something secret and yet still have copyright protection on it.
The original reasoning behind copyright as we know it (as opposed to the true original reasoning, which was about facilitating censorship by the British Crown) was to enable authors to retain limited control of their published works, in order to encourage them to publish. When you publish a book, the content is out there for the world to see and potentially copy; there's no way to publish a book and keep it secret at the same time, so some legal protections are necessary if we want to enable authors to control and profit from their work.
These "legal protections" are really limitations on what society is allowed to do with the work, in other words, freedoms we choose to give away, and the reason this is a good trade is because (a) it makes more material available now for people to read, learn from and build off of and (b) it ultimately puts more material in the public domain for anyone to use however they see fit when the copyright expires.
Patents are really the same idea applied to a different space: Getting the details of inventions published for everyone to read theoretically encourages more invention. With patents, there's a *requirement* that the details be published, because unlike a book, it often is possible to keep secret the details of a piece of machinery.
Even for copyrights, there is and always has been a sort of a requirement to publish -- under current law you cannot sue over copyright unless you have registered your work with the copyright office, and doing that requires you to submit a copy to them, placing it in the public record. Kind of. In the case of code, you only have to submit a few pages from the beginning and the end. The rationale behind copy registration was primarily to establish ownership, not to publish, because when all of this was set up publishing was just a given. Because that was the rationale, when code copyrights came along it was deemed too burdensome to deal with full printouts of the registered code (because they're really, really big) and, of course, the copyright office wouldn't have had any idea what to do with magnetic media.
So now we've arrived at a situation that cannot have been expected or planned by the designers of the system: You can obtain copyright protection on something that you never published and never have to publish, even when you go to court to enforce your rights. The "trade" is no longer a trade, because society no longer gets to benefit from seeing what it is giving you protection for. There's no requirement that the code *ever* be published, even after the copyright has expired (assuming current copyrights ever will expire).
In my opinion, it should only be possible to obtain protection for what you publish. If you want to keep your source secret and only publish binaries, fine. You get copyright protection for the binaries and you can use trade secret law to protect your source code -- but remember the caveat in trade secret law that once it's published it's no longer a secret, so you can only go after the person who gave it away the first time.
On the other hand, if you want the full protection of copyright law applied to your source code, then you have to publish the code, at least before going to court over it. Publish *all* of it. I don't think the US Copyright Office of 2004 will have any trouble at all understanding how to manage data delivered on a stack of DVD-ROMs.
Re:kazaa, bittorrent, emule/edonkey? (Score:2, Interesting)
As is, by the way, transmitting Microsoft's source code.
Re:Don't mess with MS (Score:5, Interesting)
Here is the real crux of the problem. You are pointing at the wrong thing.
It is not whether the source is open and available that makes it insecure or more secure.
It is whether the soruce was developed as open source. It matters that all those eyeballs were watching while the source was being written. Taking a buggy closed source program and suddenly opening the source simply means that all of the bugs will be discovered, and exploited. Developing a program as open source means that those security problems often don't live long enough to reach a release. Even when they do, they are patched rapidly.
In fact, it simply may say more about the users or "administrators" than the availability of source. Remember the Bind 8 vulnerability? Remember how many servers run Bind 8? Remember how fast everything was upgraded all over the planet? Remember <Microsoft virus of the week>? Remember how many servers were vulnerable to that? Remember how slowly those vulnerable servers were upgraded? Even when the fix was available before the exploit? Now which of these two widely used software program vulnerabilities caused a huge upheavel affecting society as a whole?
Interesting evaluation of the source code (Score:4, Interesting)
From Kuro5hin... [kuro5hin.org]
Re:Stomp out IP (Score:1, Interesting)
Re:kazaa, bittorrent, emule/edonkey? (Score:1, Interesting)
From a previous article on this topic:
File: windows_2000_source_code.zipG Kv54~o6A
G Kv54~o6A/windows_2000_source_code.zip
Key: CHK@JANQuMJMYGNWPVWyfwBwyXPsgBwPAwI,LeWue01uUKoEM
Bytes: 213748207
CHK@JANQuMJMYGNWPVWyfwBwyXPsgBwPAwI,LeWue01uUKoEM
Of course if you don't have Freenet yet (what are you waiting for?) you'd do good to visit http://www.freenetproject.org [freenetproject.org]
idea (Score:2, Interesting)
Re:Don't mess with MS (Score:5, Interesting)
Ultimately, like the parent said, it's the taboo that makes it interesting. If Microsoft had just posted the code on its website, I might not even be interested, but all the effort they're exerting has attracted my attention.
I got an email from billy (gates) boy (Score:1, Interesting)
J.K. Weston
Microsoft Corporation
One Microsoft Way
Redmond, WA 98052
jkweston@microsoft.com
Tel: (425) 703-5529
16 Feb 2004 12:11:33 GMT
URGENT/IMMEDIATE ATTENTION REQUIRED
VIA ELECTRONIC MAIL
*
Re: NOTICE OF POTENTIAL UNLAWFUL DISTRIBUTION OF MICROSOFT SOURCE CODE AT: *
Date of Infringement: Detail below.
Dear *:
We have received information that one of your users as identified above by the SITE/URL * may have engaged in the unlawful distribution of Microsoft's source code for Windows 2000, and/or Windows NT4, by distributing and offering for download these source code files via a peer-to-peer network.
Since you own this IP address, we request that you take appropriate action against the account holder under your Abuse Policy/Terms of Service Agreement.
We also kindly request that you forward this notice promptly to the user of the IP address listed above at the time and date stated.
To the user at *:
The unauthorized copying and distribution of Microsoft's protected source code is a violation of both civil and criminal copyright and trade secret laws. If you have downloaded and are making the source code available for downloading by others, you are violating Microsoft's rights, and could be subject to severe civil and criminal penalties.
Microsoft demands that you immediately (1) cease making Microsoft's source code available or otherwise distributing it, (2) destroy any and all copies you may have in your possession, and (3) provide us any and all information about how you came into possession of this code.
Microsoft takes these issues very seriously, and will pursue legal action against individuals who take part in the proliferation of it source code. We look forward to your prompt cooperation. Should you need to contact me, I can be reached at the address above or at jkweston@microsoft.com.
Very truly yours,
By
J.K. Weston
CaseID: *
Infringers IP Address: *
Initial Infringement Timestamp: 16 Feb 2004 06:36:03 GMT
Recent Infringement Timestamp: 16 Feb 2004 06:36:03 GMT
Notice ID: *
Don't mess with the **AA either. No, wait... (Score:3, Interesting)
Right, just like the **AA have been doing. I'm betting they have a comparable amount of money, and they're certainly willing to use legal muscle, but look where that's got them...
A more interesting spin I didn't see anybody mention yet is that if, as P2P music-sharing advocates constantly claim, it's legal to download and only illegal to distribute under US copyright law, then Microsoft's claims are unfounded (and probably incorrect legal advice -- oops). Alternatively, the P2P music-sharing advocates have been talking a crock all along, and are about to see a rather unfortunate legal precedent set from a surprising direction. Any takers?
Re:THAT IS PERFECT. (Score:1, Interesting)
This would mean MS could not differentiant a legitimate source code seeker vs. someone who is infected.
It'd be a thing of beauty that MS would have their own hands tied, due to their own poor code quality.
Is a search illegal? (Score:3, Interesting)
Possession of information is illegal in some cases.. Distribution is illegal in other cases.. But *searching*?
Screw them...
only scary part is that some p2p people are willing to cooperate with a entity that has NO LEGAL POWERS...
Re:kazaa, bittorrent, emule/edonkey? (Score:3, Interesting)
No it's not scary at all. It's not even surprising. The only thing about this that's surprising is that it hasn't happened sooner.
There's a lot of talk about 'information wants to be free' which is basically bullshit. Information doesn't actually want anything. It doesn't have the squishy bits made of meat that you need to be able to 'want' something.
Instead it's a basic property of information - if it's put in the presence of a copying mechanism, it will be copied. And if you're trying to stop it, you've already lost as soon as the information in question gets outside of your organization.
Re:Don't mess with MS (Score:3, Interesting)
Because obviously you know that running experimental networking services on your computer that require you to punch holes in your firewall, and allowing you to receive hundreds of connections per second, is obviously secure
How did they get the home address? (Score:4, Interesting)
Is that even legal for them to do ( assuming they didnt get a court order.
Don't search? (Score:1, Interesting)
Re:Someone got kicked off their ISP... (Score:5, Interesting)
It's no joke:
Subject: [linux-elitists] Microsoft goes after Linux kernel downloaders?
Date: Mon, 16 Feb 2004 20:15:28 -0600
I went trolling, and it seems I caught the biggest fish of them all.
When the story about the MS leak appeared on Slashdot this past week,
I thought I'd have a bit of fun. A post entitled "Kernel source here,"
which pointed to a torrent of Linux 2.6.2, was all it took to hook
about a thousand would-be NT and 2000 source downloaders.
"You can find the build applications and such with Google already."
I trickled the torrent out at about 1k/s for the first few hours, then
let it go full-speed once we'd crossed over 600 active
participants. Let 'em all have the punchline at once.
Imagine my surprise when my DSL stops working this morning, I call my
provider, and I learn that I've been accused of copyright
infringement. I argued that I was doing absolutely nothing wrong, and
they turned service back on. After I asked to see the accuser's email,
they forwarded the below. Sure enough, it's a bona fide valentine from
MS Legal:
J.K. Weston
Microsoft Corporation
One Microsoft Way
Redmond, WA 98052
jkweston@microsoft.com
Tel: (425) 703-5529
14 Feb 2004
URGENT/IMMEDIATE ATTENTION REQUIRED
VIA ELECTRONIC MAIL
[My ISP]
Re: NOTICE OF POTENTIAL UNLAWFUL DISTRIBUTION OF MICROSOFT SOURCE
CODE AT: [one of my IPs]
Date of Infringement: Detail below.
Dear [My ISP]:
We have received information that one of your users as identified
above by the SITE/URL [My IP] may have engaged in the unlawful
distribution of Microsoft's source code for Windows 2000, and/or
Windows NT4, by distributing and offering for download these source
code files via a peer-to-peer network.
Since you own this IP address, we request that you take appropriate
action against the account holder under your Abuse Policy/Terms of
Service Agreement.
The IP they chose wasn't the tracker, it was a system participating as
a torrent peer. This makes me wonder if there are a thousand other
P2P Linux 2.6.2 downloaders enjoying MS' Feb 14 love.
Now, admittedly I was just asking for it by hinting at something that
might offend the big giant. Still, it took them three or four days to
issue this letter. In the meantime, shouldn't they have been able to
find someone capable of cracking open a
question of how a leaked CD fits into a 32m file?
__________________________________________