I have been hearing that Windows NT/2000 code as been leaked in whole to the public- and stories are popping up in the media this afternoon (chsck newscientist). Roughly half a gig of OS code, comprising mainly Windows Service Pack One.

Windows is written in C I believe, so this is an absolute compromise of the security of all NT/2000 systems... C /C++ is innately vulnerable to whole classes of attacks that take huge amounts of effort to close off. (*)

Assuming wide distribution of this code, I'm not sure how the barn door can be closed at this point. 'Patches' can be created to close the vulnerabilities microsoft finds in the released source- but Microsoft tends to depend on the 'security' of a closed source- a faulty belief that if the 'bad guys' can't see your code, they can't find the holes, so their code is likely to be VERY insucure. Given the sheer volume of vulnerabilities (3 or 4 in the last month?) that are exposed even given that Microsoft has a closed source, I expect that there are a vast number of vulnerabilitues in that half-gig of source code. Microsoft only has so many programmers and thats a half gig of source!

The bad news is that XP was built largely off 2000, so you can extrapolate from there. I can't believe that 'Service Pack' source code that was supposed to address core vulnerabilities won't be laden with hacker-gold. Have not seen it [the leaked source]- and don't want to see it without a million dollar legal team pre-paid in advance, but having spent a lot of time on C code and a little time on OS code, I just can't imagine how this could possibly not be a BIG deal.

I REALLY don't want to dump 2000 off this system, but what choice do I have? Trust Micro-sucks to patch every minute hole in 650meg of code before every hacker in creation is busily writing virus code? LOL! They have had half a decade to secure their ship but fail to at every turn.

Looks like thats TWO linux systems I'll be building in the next 3 months.

Davin L.

(*) Not dissing C! C is lovely and gives you access to the very core of the machine you run it on- but the price paid is the lack of security that comes with that power. Just a fact. (Buffer overflow!)