Feeds

Bill Gates' letter to hobbyists (en Français, 2006)

Plus ça change

Mobile application security vulnerability report

The mere fact that a free software project has rejected source code might surprise some, but only until you see the strings attached. And they're more shackles than strings.

"The license proposal forbids you to run any binary that's based on the source code," Samba developer Volker Lendecke says.

As the Samba submission to the commission pointed out, code that was potentially encumbered with patents would have required the Samba team to set up a clean room.

"So having the ability to run source code, the complications rise tenfold. Really a bunch of new different problems," Lendecke says.

So there's the issue of practicality. In 50m lines of source code, it's hard enough tell what's going on, let alone what patents might be lurking. Back in 2001 the dissenting states suggested forcing Microsoft to disclose its Windows source code to rivals - and we can understand why that idea found no interest.

There's also another reason why a source code offer isn't all that it seems.

In his 1984 paper "Reflections On Trusting Trust", the co-author of Unix Ken Thompson described a theoretical Trojan which could be salted away inside the compiler. It's a work of subtle beauty that deals with the transmission of knowledge without the transmitter being aware of the payload. That's something we're all experts on, whether we think very much about it or not.

"No amount of source-level verification or scrutiny will protect you from using untrusted code," concludes Thompson. The relevance of "Reflections..." to this week's hearings is not to suggest that Microsoft has been so fiendishly clever that it may have rigged its compilers with an unknown payload - a feat which would require a level of foresight unknown at Redmond. But its to reinforce the general point that disclosure of the source code isn't the full story. Source code is not a holy grail of authenticity, but merely a set of instructions for other mechanisms to obey. The map is not the territory.

In fact, all the Samba team want, according to Andrew Tridgell's testimony this week, is a floppy disk's worth of Interface Definition Language descriptions.

Another comment of Cooke's met with astonishment during calls to parties with an interest in the outcome of the case on Thursday afternoon. Cooke expressed skepticism that Microsoft's buy out of AT&T's AS/U, its Windows services for Unix, represented a "disruption of supply". AT&T had licensed the code to 11 vendors, including HP and Sun, to permit them to build Windows interoperability into their server offerings. (We can't stress enough that the European anti-trust case specifies a server-to-server remedy beyond the client-server remedy the US settlement outlined).

The proof is surely in the consequences of this action. After Microsoft's cash settlement with AT&T, derivatives of AS/U such as Sun's PC NetLink withered on the vine. The only Windows interoperability project to gain any widespread industry momentum since its demise has been Samba, which is handicapped on several fronts. Did AS/U licensees - some of the biggest names in the industry - rationally decide that what their customers really wanted was worse Windows interoperability? Cooke seems to invite us to draw this conclusion. One must hope the other judges find this far-fetched.

Asked what Samba really wants, the team told us

"A fully specified protocol to the level of detail of an internet RFC, much like Sun's NFS v4 - that would be perfect."

There you have it. Not such an intellectual property giveaway after all, is it? ®

The Essential Guide to IT Transformation

More from The Register

next story
NO MORE ALL CAPS and other pleasures of Visual Studio 14
Unpicking a packed preview that breaks down ASP.NET
Cheer up, Nokia fans. It can start making mobes again in 18 months
The real winner of the Nokia sale is *drumroll* ... Nokia
Mozilla fixes CRITICAL security holes in Firefox, urges v31 upgrade
Misc memory hazards 'could be exploited' - and guess what, one's a Javascript vuln
Put down that Oracle database patch: It could cost $23,000 per CPU
On-by-default INMEMORY tech a boon for developers ... as long as they can afford it
Google shows off new Chrome OS look
Athena springs full-grown from Chromium project's head
Apple: We'll unleash OS X Yosemite beta on the MASSES on 24 July
Starting today, regular fanbois will be guinea pigs, it tells Reg
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.