News for hackers. Stuff that matters.

A comment on Solarwind, Fireeye, Microsoft and Cisco leaks are offered for sale. Parent comment

Re:Solarwind, Fireeye, Microsoft and Cisco leaks are offered... by zinekeller on Tuesday January 12, 2021 @07:17PM (#25756074)
One of the most challenging things Microsoft has faced when open-sourcing projects is the auditing stage. Windows is huge. Lots of code in Windows are not written by Microsoft or even by third-parties contracted by Microsoft. Some parts of Win32 code (that is backwards-compatible sensitive) are owned by third parties that are already long gone or absorbed by other third parties. This is the reason Microsoft cannot even release a binary version of Space Cadet Pinball even when they want to because it is now owned by EA (Surprise! Also see https://devblogs.microsoft.com/oldnewthing/20181221-00/?p=10...) and the same reason why they have removed the pre-2007 equation editor on their Office suite (https://support.microsoft.com/office/equation-editor-6eac7d7...). At one of its previous audits (for IE 7), they have to check if it was Spyglass code and replace the offending code which allows them to terminate their contract with (at the time) AOL.

Windows has many of these components, and they are even attributed when you know where to look. For example, the code for parts of the disk management utility, the spinning-disk defragmenter, and NTFS quota management were based from code provided by VERITAS Systems (which I am not even sure if the company still exists). The MP3 codec is provided by Fraunhofer (which still exists, but I'm sure that they will not agree to open-sourcing that codec). On the other hand, some of them are under permissive licenses or even the same code as other counterparts (while the BSD TCP/IP stack story ranges from code removed by Windows 2000 to simply an apocryphal tale) for example, the code by IJG for JPEG support is used extensively in Windows. The only built-in (L)GPL code used ever was the BRLTTY system (https://mielke.cc/brltty/index.html) and LibLouis (http://liblouis.org/), which was used for Braille accessibility (WSL2 used the Linux kernel, but they are arguably a different application with separate instances).

Edit: Microsoft's third-party disclosures: https://www.microsoft.com/en-us/legal/products/notices/win

[ Parent | on HN ]
Re:Solarwind, Fireeye, Microsoft and Cisco leaks are offered... by fartcannon on Tuesday January 12, 2021 @07:33PM (#25756238)
Strong case against using proprietary software in your code base, isn't it. What a mess.
[ Parent | on HN ]
Re:Solarwind, Fireeye, Microsoft and Cisco leaks are offered... by jodrellblank on Tuesday January 12, 2021 @08:10PM (#25756613)
Using proprietary software in their code base, they made billions and dominated ther market, crushing all competitors. Right now they charge people for access to the code.

On the other hand, they can't freely release the code, something which is of little benefit to them anyway. How is that a "strong case" against?

[ Parent | on HN ]
Re:Solarwind, Fireeye, Microsoft and Cisco leaks are offered... by fartcannon on Tuesday January 12, 2021 @08:11PM (#25756628)
Because the parent poster suggested they in fact wanted to open source more stuff but couldn't for these reasons. Therefore, it is a strong case against.
[ Parent | on HN ]
Re:Solarwind, Fireeye, Microsoft and Cisco leaks are offered... by jodrellblank on Wednesday January 13, 2021 @04:18PM (#25768107)
Maybe we're using different definitions of "strong case", I'm imagining it in a court of law, a case for going one way is "billions of dollars and market dominance" - that's a strong case. The case for changing direction is "in 30 years, giving your stuff away will be less legal trouble". That's true, but it's not a strong case for changing direction, it's a minor shrug. Strong meaning enough to overturn the competing arguments and push a different decision, not just "isn't wrong".
[ Parent | on HN ]
Re:Solarwind, Fireeye, Microsoft and Cisco leaks are offered... by stilist on Tuesday January 12, 2021 @10:01PM (#25757477)
Sure, but at the time they were creating the mess they were actively opposed to open-source software.
[ Parent | on HN ]
Re:Solarwind, Fireeye, Microsoft and Cisco leaks are offered... by mdoms on Tuesday January 12, 2021 @10:17PM (#25757593)
only if you believe that future open sourcing of your code base would bring greater benefit than the proprietary software itself, which seems very unlikely.
[ Parent | on HN ]
Re:Solarwind, Fireeye, Microsoft and Cisco leaks are offered... by ocdtrekkie on Tuesday January 12, 2021 @07:58PM (#25756501)
I've gotten the impression Microsoft is taking a "open source new stuff" approach... After enough years and refactors and replacements, hopefully most of Windows will be open source. Things like the Windows Terminal project and Windows Calculator going open source seem to suggest this is the case.
[ Parent | on HN ]
Re:Solarwind, Fireeye, Microsoft and Cisco leaks are offered... by anonymfus on Tuesday January 12, 2021 @09:28PM (#25757226)
But is there such third party owned code in the NT kernel? Open sourcing the kernel would bring the most benefit both for security and publicity.
[ Parent | on HN ]