Windows 2000 & Windows NT 4 Source Code Leaks 2764
PeterHammer writes "Neowin.net is reporting that Windows 2000 and Windows NT source code has been leaked to the internet. More on this as we hear it."
This discussion has been archived.
No new comments can be posted.
Windows 2000 & Windows NT 4 Source Code Leaks
Related Links Top of the: day, week, month.
"Protozoa are small, and bacteria are small, but viruses are smaller than the both put together."
it's true (Score:5, Insightful)
I for one would love to peek around in this, more out of curiosity than any desire to actually do something useful with it.
So much for security through obscurity (Score:5, Interesting)
Re:So much for security through obscurity (Score:5, Interesting)
Source helps, but it isn't everything.
Does anyone else just get a tingly feeling seeing this article sitting on top of an article on Open Source being less secure because of it's openness?
Re:It's a TRAP!!! /Adm. Ackbar (Score:5, Interesting)
Is there GPL code there?
Ask an auditing company to
diff NT4 2000 | grep -e yourcode
and get an answer.
I don't think they're playing SCO if they released just a part of it maybe but not the whole thing
Re:So much for security through obscurity (Score:5, Insightful)
Re:So much for security through obscurity (Score:5, Funny)
Re:So much for security through obscurity (Score:5, Informative)
Re:it's true (Score:5, Funny)
Re:it's true (Score:5, Interesting)
Seems a bit of a stretch to thing 'soft would have given all of these organizations the complete source tree. If they did, then I am far more amazed the source wasn't leaked a long time ago. It's a bit hard to believe 'soft licensed the entire build tree to anyone.
Makes a pretty good headline, though.
Re:it's true (Score:5, Funny)
:: prediction :: (Score:5, Interesting)
MS giving source code to countries (Score:5, Interesting)
Re:it's true (Score:5, Insightful)
I hope you weren't planning on ever contributing to any Open Source projects after doing that. If it's later demonstrated that you had access to the W2K source and contributed vaguely similar code (even by accident) to a project, it could have severe repercussions for that project.
I doubt Microsoft would leak it deliberately, but this does open the door to a whole SCO-esque can of worms from now on.
Re:it's true (Score:5, Insightful)
As much as I'd love to peek around in this, I won't risk it.
Re:it's true (Score:5, Insightful)
MOD PARENT UP (Score:5, Interesting)
That said, I'd love to get hold of the dll code that does the equivalent of a window manager in X. How cool would it be to swap out a dll on the Windows box at work and have a completely custom windowing environment?
Re:MOD PARENT UP (Score:5, Insightful)
Re:it's true (Score:5, Insightful)
Re:it's true (Score:5, Insightful)
You're assuming the law will be applied fairly and evenly.
Re:it's true (Score:5, Interesting)
In Microsoft's closed source world it would have been tough to know if someone had included code that was similar to something they had seen in the Linux ( or any other opensource) codetree. It will be interesting, if this windows code release (escape?) proves true, if any suspicious code is found.
Oh, no! I Looked! (Score:5, Funny)
100 GOSUB 7000 ; * Load stuff
110 GOSUB 900 ; * Show windows logo
120 GOSUB 20000 ; * Prompt for operator login
130 GOSUB 32000 ; * Fill half of memory with DLL's
140 GOSUB 16000 ; * Time waster loop
SCO Code in Win2000 (Score:5, Funny)
That is a MYTH (Score:5, Insightful)
IANAL but I do read Groklaw, and from what I understand copyright restricts the act of copying (duplicating). You can study someone's implimentation of something as much as you like, then go impliment something similiar yourself. As long as you do not copy the code verbatim you are not in violation of copyright law.
Otherwise, no student would be able to code having once looked at examples in a text book
The problem is, of course, proving one implimented the code oneself and did not in fact crib the whole thing from someone elses code, and the greater the similiarity (for code of sufficient complexity
In any event, it is a myth that, simply by looking at, or even studying, one set of code one is somehow "tainted" and unable to contribute to another, competing project, be it free or proprietary. To violate copyright law one must copy, not just receive inspiration from.
The dirty room and the clean room (Score:5, Informative)
As long as you do not copy the code verbatim you are not in violation of copyright law.
Copying of nonliteral elements is actionable infringement. That's why many reverse engineering firms have two separate teams: one to describe a piece of copyrighted code and another to implement it.
In any event, it is a myth that, simply by looking at, or even studying, one set of code one is somehow "tainted" and unable to contribute to another, competing project, be it free or proprietary. To violate copyright law one must copy, not just receive inspiration from.
Try telling that to the estate of George Harrison, who lost in Bright Tunes v. Harrisongs. It's possible to copy without knowing you're copying, and it's still infringement.
Re:That is a MYTH (Score:5, Insightful)
> I hope you weren't planning on ever contributing
> to any Open Source projects after doing that. If
> it's later demonstrated that you had access to
> the W2K source and contributed vaguely similar
> code (even by accident) to a project, it could
> have severe repercussions for that project.
IANAL but I do read Groklaw, and from what I understand copyright restricts the act of copying (duplicating). You can study someone's implimentation of something as much as you like, then go impliment something similiar yourself. As long as you do not copy the code verbatim you are not in violation of copyright law.
What you're saying about copyright is correct; but that probably isn't what MS would come after you (and your open source project) for. It'd be patent and trade secret violations.
That said, I don't know whether the unauthorized release of code would invalidate subsequent trade secret claims. On one hand, it seems crazy to lose trade secret protections because of an illegal or unauthorized act; OTOH, it seems crazy to call something a secret that, well, isn't. Maybe someone who is a lawyer can discuss.
Re:That is a MYTH (Score:5, Informative)
(IANAL and this is not legal advice. Go talk to PJ. At least she's a paralegal.)
Re:That is a MYTH (Score:5, Funny)
It was only a matter of time before people started saying this....
-Derek
Re:it's true (Score:5, Interesting)
There are probably paranoid governments who have teams who do this just this kind of work just to make sure those fabled NSA back doors in either are or aren't windows.
That leads to a fascinating question (Score:5, Interesting)
Re:it's true (Score:5, Funny)
Morbid curiosity perhaps. Considering the amount of backward compatibility in there, and the generations of tools and code frameworks used over the past decade and longer, I would expect the Windows code to be a BLOODY MESS. In fact it would probably be amusing to just grep for comments--"what does the next line do?!" or "what the h3ll were we thinking?!"
Re:it's true (Score:5, Funny)
15
fw calum $ grep -ir " fuck"
40
fw calum $ grep -ir " crap"
98
Should I have been doing this on the company firewall? Probably not.
Interesting Neowin comment (Score:5, Interesting)
Just my opinion / thoughts.
1) The software that builds and compiles Windows is very complex I doubt anyone could turn the source into a working system easily. Maybee it would be possible to compile certain parts. Plus even if you could it would take hours if not days to go through the process.
2) I don't see how this will let anyone find any obvious flaws, microsoft have software that does this all the time. I'm not saying its not a security risk but its not as simple as the journalists make out - as always.
3) This exact same scare happened about 7 years ago, I remember they were selling the source to NT4 at a local market on CD, doubt it was the real source code."
this could be really bad (Score:5, Insightful)
Re:this could be really bad (Score:5, Insightful)
The interesting part is the difference between Win2k and Linux. In both cases now, the black hats have access to the source code. However, there are more white hats who have access to the Linux codebase, which will make for some interesting long-term implications.
This also has the potential to solve the NSAKEY contriversy once and for all and provide some interesting insights into how Windows works. I'm wondering if, through the use of countries with more flexible copyright systems, it would be possible to document interesting attributes and then pass them back to WINE and other open-source folk.
Re:it's true (Score:5, Interesting)
The links circulated very fast and the servers started slowing and slowing down and then they died. The first ones did manage to get all the stuff. I envied them because I managed to get only couple megabytes.
It seemed real. Very real. Someone had broken into their development servers, stuffed the stuff to the web servers and escaped with it all.
There was some small mention about it on the Slashdot too but I couldn't find it right now. It seems the Microsoft was able to really sweep that one under the carpet. I wonder how.
There are people around with self compiled Windows XP copies, trust me. I envy them. I would gladly remove some features and tweak couple edges I am not now allowed to. Even though it would be a HUGE task.
So the now leaked source codes to NT/2k are mostly just boring and obsolete.
Re:it's true (Score:5, Funny)
Open Source (Score:5, Funny)
New Licensing Model (Score:5, Funny)
What, no GPFL? (Score:5, Funny)
Re:Open Source (Score:5, Funny)
Re:Open Source (Score:5, Funny)
Re:Open Source (Score:5, Insightful)
Server problems ALREADY... (Score:5, Informative)
Later isn't going to work, since the server was down even before it hit the Slashdot front page. I empathize with their server.
I did, however, managed to grab the news blurb (but not the, at that point, 214 comments) from the intermittent front page:
Torrent, anyone?
Re:Server problems ALREADY... (Score:5, Insightful)
How big are these files? I would expect the size of these tarballs to be comparable to Linux Kernel + GNOME + Mozilla + misc userland/bundled equivilents. If they are unexpectedly small (like less than a gig for W2K), then they are probably a hoax.
Re:Server problems ALREADY... (Score:5, Funny)
Argh! Trying to get rid of images of naked NeoWin people thinking about ramifications....
my eyes must be getting old (Score:5, Funny)
What now? (Score:5, Funny)
"We fix bugs in 24 to 40 hours, much faster than OSS."
Re:What now? (Score:5, Interesting)
Re:Now? Improve emulators! (Score:5, Insightful)
And CDs should not be copyrighted because they did not invent the photon used to read it.
If you take this to its logical extreme, any file is simply an extremely large digital number (millions of bits). How do you copyright a number? So it is then not possible to copyright ANY digital work.
What's the big deal? (Score:5, Funny)
For those that need more proof (Score:5, Interesting)
Re:For those that need more proof (Score:5, Interesting)
win2k/private/inet/urlmon/iapp/gnumakefile
win
win2k/priv
(and so on - many, many instances)
on the other hand, a few funny files:
win2k/private/inet/xml/xml/tokenizer/dll/
win2k/private/inet/xml/xml/dso/letter to children - 2.eml
and VERY interesting:
win2k/private/ntos/w32/ntuser/kerne
Re:For those that need more proof (Score:5, Funny)
AT LAST! The secret to beating Solitaire... This could perhaps be the most significant event of our times!
Maybe they will rethink Open Source... (Score:5, Funny)
-S
One a related note (Score:5, Funny)
Seriously, the previous article [slashdot.org] lambasting open source for being vulnerable is nothing when compared to eyes backed with malicious intent poring over Windows source code for new exploits. So much for security through ignorance.
Fortune (Score:5, Funny)
"Never trust an operating system you don't have sources for.
-- Unknown source"
Mirror With Comments (Score:5, Informative)
Hope it's all just a bluff.
Re:Mirror With Comments (Score:5, Funny)
Code (Score:5, Funny)
The Internet, however, being a polite sort of fellow and completely undesirous of the undoubtedly horrible ramifications of having such a beastie running around loose, gently replaced the source code and gave Windows a friendly pat on the head.
Do NOT read that code! (Score:5, Insightful)
Re:Do NOT read that code! (Score:5, Insightful)
Of course those of us who are also lawyers can safely read other peoples' code, because we know exactly what to do to avoid infringing. It is possible to extract knowledge from the code without breaching copyright, but...
Getting a copy of the code at all is a breach of copyright.
Re:Do NOT read that code! (Score:5, Informative)
I personally think it's a bad analogy, but even that isn't as far-fetched as you might think.
George Harrison (of Beatles fame) was succesfully sued for _subconsciously_ ripping off the song "He's So Fine" (in "My Sweet Lord"). See here [benedict.com] for more details.
So, no, I don't think worrying about IP contamination from looking at Windows source code is paranoid at all.
Re:Do NOT read that code! (Score:5, Insightful)
Yet if I learn to play guitar by among other things, listening to all of the Beatles songs and playing along, do the Beatles own the rights to any future song I write? Goddamn hell freakin no! How is that any different from learning things from viewing MS, or any other persons code?
I've learned to code by doing all sorts of things over the years. Among them, learning from coworkers code. Applying that knowledge at my current job doesn't make the propoerty of my current employer a derivitive work of my employer from 5 years ago, even though I had access to the source code of that previous job.
error.h (Score:5, Funny)
So, what does it say?
Not good (Score:5, Insightful)
If this is true... (Score:5, Insightful)
If this is true, today may be the day that everything changes.
In other news... (Score:5, Funny)
The comparator (Score:5, Interesting)
Here's the source (Score:5, Funny)
tin foil hat (Score:5, Insightful)
Step 1) Leak their source
Step 2) Sue Onen Source developers down the road because obviously they have studied the MS leaked source.
Step 3)
Ok but seriously, I'm not touching it. The last thing I need is Microsoft saying that I somehow owe something to them.
Jerks.
--
Mike
Now W. Russell Jones can put his story to the test (Score:5, Insightful)
I'm afraid we've reach a massive failure here in security by obscurity, but time will tell. If this is true and if there are lots of security holes discovered, I find it hard to believe even a company of Microsoft's size can respond quickly enough to keep the outbreaks down. This threat is why open source is better than what W. Russell Jones made it out to be. The threat of security failing because of leaking source just isn't there with open source.
-N
What's the big deal? (Score:5, Insightful)
Why ofcourse! (Score:5, Funny)
It's not a problem. (Score:5, Interesting)
On the plus side, some of the comments are fairly humorous, especially when you note who wrote them and look up where they are today.
Someone PLEASE... (Score:5, Interesting)
As someone mentioned, this would be fascinating to just read the comments. Would it be possible for someone to strip out all the code, leaving only the comments for each file, minus comment lines that ARE code? It would be GREAT just to read the "intention" and "questions" living in that code and be able to associate each with a filename. Purely for entertainment value. It would also be neat to compare comment-to-code ratio in areas of MS code.
Ryan Fenton
So... (Score:5, Insightful)
Here's some of it.... (Score:5, Funny)
The server is currently slashdotted, but I managed to download the first few lines of the Windows 2000 codebase. Here they are:
Pffft... (Score:5, Funny)
Mirror: An Insightful comment from Neowin (Score:5, Insightful)
ANONYMOUS DONOR CONTRIBUTES TO WINE (Score:5, Funny)
"This will really make it possible for non-Windows users to run more applications than ever using WINE on alternate operating systems like Linux," said one develper we spoke with.
Irony of ironies.... (Score:5, Funny)
Doubly ironic if it was a hole that MS has known about for months and not bothered to patch.
Triply ironic if someone finds said hole, patches it, and ships patched source back to MS.
Code leaks not new (Score:5, Informative)
Code leaks from Microsoft are not new. Check this article [cioupdate.com] at CIO Update about a code leak a year ago: (emphasis mine)
Microsoft Corp. said it is tracing a key piece of code from its Windows Server 2003 software that was leaked onto the Internet, triggering concerns about piracy problems ahead of the company's scheduled product release later this month. The volume-licensing key in question allows for unlimited installations of Microsoft's Windows Server 2003 server operating system, the next upgrade from Windows NT that is slated for release on April 24.
However, this seems only to be a partial leak, not comparable to this complete (if it's real) source code leak.
Seen it - nothing spectacular (Score:5, Interesting)
If this is a wind up, someone or people spent a long old time faking it. Microsoft notices and email addresses all over the place. They don't like the AIX compiler one little bit. Hardly any mention of Linux, GPL or GNU.
Actually quite a professional bunch of source files by all accounts. Appears to be using standard GNU Makefiles though. Yes, the 'f' word appears, as does the 's' word. Apparently Office 2k is broken in some respect that Win2k needed a tweak or some description.
Plenty of mentions of Internet Explorer, although I wouldn't like to say that we found 'IE' in the code, but then we aren't C experts at all. It does mention IE6 and Windows ME, so can't be all that old either. Does mention buffer overflows a fair bit, also plenty of 'hackhack' and 'bugbug' notes laying around.
In fact, nothing particularly spectacular found at all. We took a look, got bored, and went back to our normal work. Honest boss!
And no, we didn't try to compile it. We felt it was genuine enough though - not that we really cared. We did however note that if this lot is proven to be the real deal, Microsoft are going to be landed with one hell of a lot of security alerts for 2k/NT over the next six months.
Yours merely curious...
Re:Torrent? (Score:5, Funny)
emerge win2000
Re:Torrent? (Score:5, Funny)
ACCEPT_KEYWORDS="~x86" emerge win2000
Re:hmm seems a bit buggy (Score:5, Interesting)
Windows source code is not some deep dark secret that is locked in a vault, only let out during builds for the product releases.
*MANY* people have access to the Windows source code. A number of people in my own university have it. There are strict licensing considerations, but when has that ever worked before? Surprisingly, none of the people with source access has ever pulled off the stunt where it's broadcasted. I have always wondered why.
Re:hmm seems a bit buggy (Score:5, Insightful)
Because most people are paranoid enough to assume M$ watermarks each distributed copy to allow them to trace it back to the point of release. But now they are giving copies to governments like China and folks there just don't really give a damn about western notions of copyrights.
Re:hmm seems a bit buggy (Score:5, Insightful)
I agree. Remember, at the trial MS argued that opening or showing parts of Windows source code would be a threat to national security. Not long after that, they gave their source code to Russia, China, and many multi-national corporations and other organizations as part of their Shared Source initiative. Now, don't know where the source was leaked from, but 1 + 1 = ?
If in fact, this story is true, MS is riding against the wind here. It is feeling pressure from the Open Source while its security, software, and business models are based on keeping the source secret. If so, how long can they keep up?
Re:I'll believe it when I see it. (Score:5, Informative)
They focus primarily on windows tech, and have a knack for breaking stories about Windows- leaked builds of future versions, beta builds of service packs, etc. Whoever runs the site is well connected in Microsoft.
Re:I'll believe it when I see it. (Score:5, Informative)
Microsoft gave a talk at usenix: Windows A Software Engineering Odyssey [usenix.org]
This slide [usenix.org] indicates the full source is 50gb and took a week to setup and 2 hours a day to update.
That implies to me that people could have the whole source but it would huge.
Slide 24 talks about their new perforce [perforce.com] based system that only takes 3 hours to setup and 5 minutes to update.
Re:I'll believe it when I see it. (Score:5, Informative)
The odds of getting the full source: experience. (Score:5, Interesting)
This is incorrect.
Its funny how people build up ideas in their heads about what its like in a large corporation, somehow like a hollywood movie with lots of people with dark shades and guns ala "The Net".
No, inside Microsoft is a lot more like "Office Space" and anybody with motivation could get the entire source with little trouble.
Re:So is this the beginning of something... (Score:5, Insightful)
I'm not sure that kind of justification really works. It also doesn't help the open source community, IMHO. I can't agree with the "let's sink to their level" philosophy.
Re:The shit will hit the fan + Mirror (Score:5, Insightful)
Re:The shit will hit the fan + Mirror (Score:5, Interesting)
Re:Just don't use the code (Score:5, Interesting)
You beat me to the punch. This code leak could be a very good thing for Microsoft, and a trap for the open source community. I doubt that Microsoft intentionally planted this snare but if any future open source project even vaguely resembles this leaked code I have no doubt that Microsoft will open their full arsenal of lawyers.
Re:Just don't use the code (Score:5, Insightful)
In fact if you are involved with an Open Source project (especially Kernel and Window Manager projects) I suggest you do everything possible to avoid seeing this code.
Accusations of Taint are undoubtedly going to spring up from this, and you would be better to be well clear.
I will confess to a certain curiosity as to what the results of a comparator test would be though.
Re:Just don't use the code (Score:5, Funny)
"Microsoft is suing end-users of Linux due to the discovery that the latest version of the kernel incorporated Windows 2000 code. The discovery of the code theft was made after someone at Microsoft plugged a USB scanner into a system running the latest Linux kernel and received the Blue Screen of Death."
Re:Just don't use the code (Score:5, Insightful)
I remember someone on here, a while back during one of the SCO stories, wondered what would happen if Microsoft released the source code, but under such a devious license that contamination would be fatal to an open-source project.
Maybe someone at Microsoft thought that was a neat idea.
*** CONSPIRACY THEORY END ***
As far as looking at the code: the only real reason to examine it is to find new exploits. No developer is going to slave over that source in order to find bugs and repair them, since there is no legal way to do it.
Re:There is no evidence listed (Score:5, Funny)
A member of the Slashdot cult has admitted he has stolen the source code to Microsoft's Windows XP operating system. PickyH3D is the handle the low-karma hacker used when bragging of his accomplishment to the world. He has also issued a challenge to Microsoft's legal team with the statement that "there is no evidence". More on this as we hear it.