Leaked MS sourcecode found to be littered with profanity - Tilted Forum Project Discussion Community

kel · 02-13-2004, 07:46 AM

http://news.bbc.co.uk/2/hi/technology/3485545.stm

Quote:

Q&A: Microsoft source code leaked

Microsoft has admitted that some of the source code for its widely used operating systems have been leaked on to the internet. BBC News Online explains what has happened and what the consequences will be.

The leak of Windows code is a huge embarassment

What has happened?

Some of the core computer code for Microsoft's Windows NT 4 and Windows 2000 products has been found circulating online. The files are reportedly proving very popular on file-sharing networks such as Kazaa and chat nets such as IRC.

What is source code?

It is the raw computer language written by programmers as they put together an application. When a program is compiled to become a working program this code is scrambled and becomes unreadable.

Commercial software firms guard source code for their products very carefully because rivals that get access to it could find out how their products work and copy them. A software company's source code is the equivalent to Coke's recipe for its fizzy drink.

What has been leaked?

So far there are only details about the leak of source code for Windows 2000, even though Microsoft has said that some of the code for NT4 is also online.

The Windows 2000 code is a 203MB chunk that expands to about 600MB - enough to fill one CD.

Microsoft has said that this represents about 15% of the total source code for the operating system. It is not enough to recreate the operating system.

The leaked chunk contains library and text files, scripts, executable programs and raw computer code. It seems to date from 25 July 2000.

Why is this a problem for Microsoft?

Code for Windows 2000 and NT4 has been leaked

For several reasons.

Firstly, it is yet another security lapse during a month that has seen the appearance of the fastest spreading virus ever as well as the discovery of yet another critical vulnerability in the Windows operating system.

Secondly, Microsoft's growth has come about because of its tight control of its intellectual property - the source code of its products. This has helped it maintain a stranglehold on the desktop computer market. That hold has been demonstrably loosened now. Rivals could use it to get a better idea of how Windows works and help them compete against Microsoft.

Thirdly, it might be the last straw for people tired of the security headaches that Windows creates.

Fourthly, for Microsoft to have this code paraded in public is hugely embarrassing. Not least because the code is littered with profanity and might show that many Microsoft programmers do not do a very good job.

In the past independent programmers that have deconstructed other Microsoft applications have been shocked at what they found within the code. Rivals and critics will be able to see exactly how Microsoft staff do their work.

Is this going to mean more security problems for Microsoft products?

It is too soon to say. Certainly knowing exactly how something works will be useful to anyone that wants to attack it, but few malicious hackers need an intimate knowledge of Windows to create havoc. Many of the viruses doing the rounds are simply copycat versions of older pernicious programs.

Virus writers tend to be lazy and build on the efforts of others. Few are likely to trawl through the millions of lines of code and go to the trouble of working out where new vulnerabilities can be found.

However, it just takes one dedicated vandal to do the work and the tools will be available to all

Microsoft has said it is more an intellectual property problem than it is a security issue.

Who has access to Windows source code?

Windows XP builds on the leaked code

Lots of people in thousands of organisations. Microsoft runs the Shared Source Initiative that lets researchers and key customers and business partners get a look at the basic code for many of its products. Up to 90% of the source code for Windows products has been shared over the years.

The only parts that Microsoft does not let anyone see are the bits dealing with product activation, its use of cryptography and code from other firms it cannot license directly.

This initiative was started to counter the success of the open source movement which is based around the freedom to inspect and play with the source code of computer programs.

Is this the first time this has happened?

It is the first leak of Windows source code though early releases of the various versions of Windows regularly circulate before they are official unveiled.

This leak is not thought to be related to the hack attack on Microsoft's corporate network that took place in October 2000.

Also, years ago code to version 6.22 of DOS was leaked online but no-one cared because it was so old.

So am I the only one who includes profanity in his code?

When I am writing the development versions and I want to trace output I usually put profane statements in so I can see the sequence and repetition of things. Am I the only one?
When I had to implement red-black trees things got quite messy, when I go final I always do a replaceall of the output statements to put them in comments.

But they stay in the source code because I might need to debug later...

Fallon · 02-13-2004, 08:17 AM

In all my coding, I've never really used profanity. If there was something that I needed to find later, I'd either mark the line with a wierd ~!~! thing, or just remember the line. Prollay why half my projects haven't been finished...

yakimushi · 02-13-2004, 08:25 AM

I'd REALLY like to see some examples from the source, I'll bet some of it is pretty damn funny.

Fallon · 02-13-2004, 11:12 AM

Ya, but I bet seeing the source or at least openly stating you've seen it or posting pieces of it would be a bad move.

webfiend · 02-13-2004, 11:03 PM

Quote:

Originally posted by Fallon
Ya, but I bet seeing the source or at least openly stating you've seen it or posting pieces of it would be a bad move.

Definitely. There's no way I'm going anywhere near that code, or anything that I think might be derived from it. Of course I'm curious, but it's not worth the potential legal risks. I'll stick to reading over Open Source code, thank you very much

platypus · 02-14-2004, 06:16 PM

I have been programming for about 20 years and have always been quite, uhhh, spirited with my code comments. The problem arises when one extends their colorful prose to include variable names and printed text. As often happens late in a project (or late at night) when frustration sets in, I will begin naming variables in a way that quite reflects my mood.

for (c*nt = 0; c*nt < f*cked; c*nt++) {
...
if (myass > 10) {
...
while (thiscouldntsuckmore) {
...

About 10 years ago I was pulling an all-nighter on a project that was due the next day. Early in the morning, the program was giving fits and I, being exhausted, frustrated and a little punchy, started really dressing up my code as I tried to chase down one last error. I wrote some code to display in a message box the value of a less-than-professionally name variable. After I fixed the problem, I promptly forgot about the message box code.

At the client's office later that morning, I proceeded to show off the new features. Suddenly up pops a message box...

"Mangey Testicle = 1000"

I explained that it was a technical term. Move along. Nothing to see here.

My partners and I have since instituted the "Prime Directive". No code, comments, or variables of a questionable nature. We, of course, break the Prime Directive constantly. So all code must still be searched against a list of possible infractions before going out the door.

Latch · 02-14-2004, 08:41 PM

Examples:

(I got this from fark.com, where a Farker had posted saying they got this from /., where someone had grepped the source code and posted this in the comments section... sooooo.. I've never seen the code myself

(oh.. also.. I changed stuff from the fark filter to the way it was originally)

webapp.cpp: // HighContrast mode is turned on. This totally fucks our style sheet as most of it will
copy.c:// want to fuck with.
util.cpp:// the fucking alpha cpp compiler seems to fuck up the goddam type "LPITEMIDLIST", so to work
util.cpp:// around the fucking peice of shit compiler we pass the last param as an void *instead of a LPITEMIDLIST
util.h:// the fucking alpha cpp compiler seems to fuck up the goddam type "LPITEMIDLIST", so to work
util.h:// around the fucking peice of shit compiler we pass the last param as an LPVOID instead of a LPITEMIDLIST
windbgrm .c: // The user fucked up
verinfo.h: * !DOING SO FUCKS THE BUILD PROCESS!
map.c: // !!!this is fucked if a map goes to multiple physical devices

conman.cxx:// BUGBUG - DON'T DO THIS SHIT.
mnddlg.cpp: // this shit's read only
ctl3d.c: // Some ugly shit goin' on here!
capdib.c: // Holy shit, couldn't change formats, time to punt!
capdib.c: // Holy shit, couldn't change formats, time to punt!
capdib.c: // Holy shit, couldn't change formats, time to punt!
rle.c: // lets do some majic shit so the compiler generates "good" code.

Fark Link: http://forums.fark.com/cgi/fark/comm...?IDLink=832715

Sleepyjack · 02-15-2004, 09:45 PM

I don't use profanity for any variable, class etc names, however in commenting and output statements, quite often, i'll swear if i am getting frustrated

Most of it has been for school/uni stuff, so before handing in the source code for any assignments i do, i just search for fuck, shit, ass etc and get most of it out

@Latch
ha, good stuff

i normally do some similar stuff

irseg · 02-15-2004, 10:47 PM

My code would definitely be R-rated. Sometimes I have to be careful to filter out error handlers that say "WHAT THE FUCK?!?!?!??!???" and such.

SaltPork · 02-16-2004, 10:38 AM

Ever since a client saw some questionable comments, there has been a mandate that we not put anything in the code that we wouldn't want our grandmothers to read. Unfortunately none of us have an ex-trucker, longshoreman or marine as grandmothers so this limits what we can use.

Redlemon · 02-16-2004, 10:53 AM

From kuro5hin.org, there's a listing of many of the comments in the source code: follow this link.

dnd · 02-17-2004, 03:28 PM

heh...who really minds about the profanities? i always use swear words and other rude words as comments and variables, my lecturers haven't complained to much yet, one even joked with me about it... maybe with commercial systems its different, but it makes programming more fun!

insidious_machinae · 02-17-2004, 04:30 PM

This message has been deleted.

feelgood · 02-19-2004, 10:48 PM

The question is why in the fuckin world would you want to put profanity in your coding?

Christ, when you're a system programmer, did you think that you were going to be a programmer forever? No. I will fuking guarentee to you that whatever program you make and release to a company for rights or to the internet, there will be another programmer who will break into your program and find those profanity. When that happens and other companies knows that you put profanity in your coding, are they gonna want to hire you? Nope.

I keep my code clean.

02-14-2004, 06:16 PM	#6 (permalink)
platypus Essen meine kurze Hosen Location: NY Burbs	I have been programming for about 20 years and have always been quite, uhhh, spirited with my code comments. The problem arises when one extends their colorful prose to include variable names and printed text. As often happens late in a project (or late at night) when frustration sets in, I will begin naming variables in a way that quite reflects my mood. for (cnt = 0; cnt < fcked; cnt++) { ... if (myass > 10) { ... while (thiscouldntsuckmore) { ... About 10 years ago I was pulling an all-nighter on a project that was due the next day. Early in the morning, the program was giving fits and I, being exhausted, frustrated and a little punchy, started really dressing up my code as I tried to chase down one last error. I wrote some code to display in a message box the value of a less-than-professionally name variable. After I fixed the problem, I promptly forgot about the message box code. At the client's office later that morning, I proceeded to show off the new features. Suddenly up pops a message box... "Mangey Testicle = 1000" I explained that it was a technical term. Move along. Nothing to see here. My partners and I have since instituted the "Prime Directive". No code, comments, or variables of a questionable nature. We, of course, break the Prime Directive constantly. So all code must still be searched against a list of possible infractions before going out the door. __________________ Out the 10Base-T, through the router, down the T1, over the leased line, off the bridge, past the firewall...nothing but Net.

02-16-2004, 10:38 AM	#10 (permalink)
SaltPork Everything's better with bacon Location: In your local grocer's freezer.	Ever since a client saw some questionable comments, there has been a mandate that we not put anything in the code that we wouldn't want our grandmothers to read. Unfortunately none of us have an ex-trucker, longshoreman or marine as grandmothers so this limits what we can use. __________________ It was like that when I got here....I swear.

02-16-2004, 10:53 AM	#11 (permalink)
Redlemon Devoted Donor Location: New England	From kuro5hin.org, there's a listing of many of the comments in the source code: follow this link. __________________ I can't read your signature. Sorry.

02-17-2004, 03:28 PM	#12 (permalink)
dnd Psycho Location: London...no longer a student	heh...who really minds about the profanities? i always use swear words and other rude words as comments and variables, my lecturers haven't complained to much yet, one even joked with me about it... maybe with commercial systems its different, but it makes programming more fun! __________________ "Never underestimate a dumb question"-- Brandon Boyd

02-17-2004, 04:30 PM	#13 (permalink)
insidious_machinae Psycho	This message has been deleted. Last edited by insidious_machinae; 03-20-2010 at 11:05 AM..

02-13-2004, 08:17 AM	#2 (permalink)
Fallon Junkie Location: RI	In all my coding, I've never really used profanity. If there was something that I needed to find later, I'd either mark the line with a wierd ~!~! thing, or just remember the line. Prollay why half my projects haven't been finished...

02-13-2004, 08:25 AM	#3 (permalink)
yakimushi Addict	I'd REALLY like to see some examples from the source, I'll bet some of it is pretty damn funny.

02-13-2004, 11:12 AM	#4 (permalink)
Fallon Junkie Location: RI	Ya, but I bet seeing the source or at least openly stating you've seen it or posting pieces of it would be a bad move.

02-14-2004, 08:41 PM	#7 (permalink)
Latch In Your Dreams Location: City of Lights	Examples: (I got this from fark.com, where a Farker had posted saying they got this from /., where someone had grepped the source code and posted this in the comments section... sooooo.. I've never seen the code myself (oh.. also.. I changed stuff from the fark filter to the way it was originally) webapp.cpp: // HighContrast mode is turned on. This totally fucks our style sheet as most of it will copy.c:// want to fuck with. util.cpp:// the fucking alpha cpp compiler seems to fuck up the goddam type "LPITEMIDLIST", so to work util.cpp:// around the fucking peice of shit compiler we pass the last param as an void instead of a LPITEMIDLIST util.h:// the fucking alpha cpp compiler seems to fuck up the goddam type "LPITEMIDLIST", so to work util.h:// around the fucking peice of shit compiler we pass the last param as an LPVOID instead of a LPITEMIDLIST windbgrm .c: // The user fucked up verinfo.h: !DOING SO FUCKS THE BUILD PROCESS! map.c: // !!!this is fucked if a map goes to multiple physical devices conman.cxx:// BUGBUG - DON'T DO THIS SHIT. mnddlg.cpp: // this shit's read only ctl3d.c: // Some ugly shit goin' on here! capdib.c: // Holy shit, couldn't change formats, time to punt! capdib.c: // Holy shit, couldn't change formats, time to punt! capdib.c: // Holy shit, couldn't change formats, time to punt! rle.c: // lets do some majic shit so the compiler generates "good" code. Fark Link: http://forums.fark.com/cgi/fark/comm...?IDLink=832715

02-15-2004, 09:45 PM	#8 (permalink)
Sleepyjack Fast'n'Bulbous Location: Australia, Perth	I don't use profanity for any variable, class etc names, however in commenting and output statements, quite often, i'll swear if i am getting frustrated Most of it has been for school/uni stuff, so before handing in the source code for any assignments i do, i just search for fuck, shit, ass etc and get most of it out @Latch ha, good stuff i normally do some similar stuff

02-15-2004, 10:47 PM	#9 (permalink)
irseg Junkie Location: Florida	My code would definitely be R-rated. Sometimes I have to be careful to filter out error handlers that say "WHAT THE FUCK?!?!?!??!???" and such.

02-19-2004, 10:48 PM	#14 (permalink)
feelgood Free Mars! Location: I dunno, there's white people around me saying "eh" all the time	The question is why in the fuckin world would you want to put profanity in your coding? Christ, when you're a system programmer, did you think that you were going to be a programmer forever? No. I will fuking guarentee to you that whatever program you make and release to a company for rights or to the internet, there will be another programmer who will break into your program and find those profanity. When that happens and other companies knows that you put profanity in your coding, are they gonna want to hire you? Nope. I keep my code clean. __________________ Looking out the window, that's an act of war. Staring at my shoes, that's an act of war. Committing an act of war? Oh you better believe that's an act of war