4 ms·

Hiya - I wrote the article. What's happened is that the Beta Archive folks have now deleted (or in the process of deleting) the private material that was upload

Hiya - I wrote the article. What's happened is that the Beta Archive folks have now deleted (or in the process of deleting) the private material that was uploaded to the BA FTP. There most definitely was non-officially-released internal Microsoft files in the archive, regardless of BA's intentions, such as the Shared Source Kit, the ARM64 Windows Server build, the Mobile Adaption Kit, and various prerelease versions of Windows. We've updated the story to explain why things aren't what they seem. Essentially, the files at the heart of the matter were there (we screenshotted them and saved copies of the forum posts) at time of writing, and they were removed later on Friday. In terms of the 32TB: that's the full decompressed dump of Windows files uploaded to BA. From what I understand, Microsoft hasn't released 32TB of public Insider material, so obviously there's extra sauce in the mix. That includes, yes, copies of officially released Insider builds plus confidential private stuff that should never have left Microsoft, let alone turned up in BA. We make this clear in the story - I'm starting to feel the headline could have been better to make this clearer rather than grabbing the biggest figure. I am beginning to regret this. BA can twist and complain all it likes - but stuff that was confidential within Microsoft ended up in their FTP archive (and some is still in there, such as the ARM64 stuff). The next stage of this story will be to uncover how exactly did this material escape Redmond. C.

ryanlol 9y ago
Clarify the 32TB and 8TB figures please. People with access to the archive who successfully downloaded the confidential stuff did not get nearly that much. Do you consider windows installation images to be "compressed files" in this context?
- diodesign 9y ago
  Compressed, it is ~8TB. Fully expanded it is ~32TB. I think the bigger issue is not the final size, but that internal Microsoft material - particularly source code - has escaped into public FTP. That, to me, is the main thing, right? C.
  - kabdib 9y ago
    Windows sources have escaped before. I doubt that Windows is buildable outside of Microsoft (and the bits are definitely not signable, since you need access to a key vault for that). Useful for research, and finding security issues. Not much else.
    - KekDemaga 9y ago
      Might be helpful to the reactos and wine folks if unofficially.
      - supergreg 9y ago
        Actually the opposite. They can't work in the project of they've seen the actual MS code even if they write their own code.
        moonman272 9y ago
        Ah well, if there's a rule...
        Buge 9y ago
        Why is that? You can break patents without ever knowing the patent existed. So looking at this code wouldn't trigger a new patent problem. And simply looking at some code, closing it, then later writing code that does the same functionality is not breaking copyright. So looking at this code would not trigger copyright.
        ccrush 9y ago
        Clean room reverse engineering. The idea that, if you build something with a specified interface (Windows API in this case) without prior knowledge of the implementation details, and you haven't broken any patents in doing so, then you haven't broken copyright either and you are free to do business. This is a gross oversimplification. See Intel vs AMD case for more details.
- withinrafael 9y ago
  Looks like the 32TB size reported is the total size of all the various Windows installation images, prior to de-dupe. 8TB after de-dupe. Not a very useful figure, however. https://www.betaarchive.com/forum/viewtopic.php?p=420025#p420025 https://www.betaarchive.com/forum/viewtopic.php?p=420025#p42...
withinrafael 9y ago
All the old builds of Windows 10 listed were presumably grabbed via public Unified Update Platform (UUP) infrastructure or the Ecosystem Engagement Access Program (EEAP), but I haven't confirmed yet. It's common knowledge in the Windows enthusiast community that builds (yes, even arm64 desktop Insider builds) can be pulled from Microsoft via these channels. It's not confidential, and not useful to share with anyone other than a build vault like Beta Archive. Debugging symbols for most of those builds are available on symsrv. The Windows Mobile Adaption kit (like the OEM Preinstallation Kits, OEM Adaptation Kits) is shared with a similarly sized audience, which used to include self-attested Microsoft Partners. Again, not confidential. Just gated stuff. The Shared Source stuff is a slight unknown here because it's not clear what was in the ZIP. I presume this was a sampling of materials shared via the Shared Source Initiative (https://www.microsoft.com/en-us/sharedsource/ https://www.microsoft.com/en-us/sharedsource/), none of which includes high-value intellectual property, cryptographic code, third-party code, etc. It could still be damaging but Microsoft has clearly calculated the risk here; this stuff is shared with mere community MVPs. So with all this knowledge, it's hard to digest the "omg more exploits coming" and "Microsoft lost 32TB of private IP" angles in The Register write up. I don't think there's a story here, frankly.

ryanlol 9y ago

Clarify the 32TB and 8TB figures please. People with access to the archive who successfully downloaded the confidential stuff did not get nearly that much. Do you consider windows installation images to be "compressed files" in this context?

diodesign 9y ago
Compressed, it is ~8TB. Fully expanded it is ~32TB. I think the bigger issue is not the final size, but that internal Microsoft material - particularly source code - has escaped into public FTP. That, to me, is the main thing, right? C.
- kabdib 9y ago
  Windows sources have escaped before. I doubt that Windows is buildable outside of Microsoft (and the bits are definitely not signable, since you need access to a key vault for that). Useful for research, and finding security issues. Not much else.
  - KekDemaga 9y ago
    Might be helpful to the reactos and wine folks if unofficially.
    - supergreg 9y ago
      Actually the opposite. They can't work in the project of they've seen the actual MS code even if they write their own code.
      - moonman272 9y ago
        Ah well, if there's a rule...
      - Buge 9y ago
        Why is that? You can break patents without ever knowing the patent existed. So looking at this code wouldn't trigger a new patent problem. And simply looking at some code, closing it, then later writing code that does the same functionality is not breaking copyright. So looking at this code would not trigger copyright.
        ccrush 9y ago
        Clean room reverse engineering. The idea that, if you build something with a specified interface (Windows API in this case) without prior knowledge of the implementation details, and you haven't broken any patents in doing so, then you haven't broken copyright either and you are free to do business. This is a gross oversimplification. See Intel vs AMD case for more details.
withinrafael 9y ago
Looks like the 32TB size reported is the total size of all the various Windows installation images, prior to de-dupe. 8TB after de-dupe. Not a very useful figure, however. https://www.betaarchive.com/forum/viewtopic.php?p=420025#p420025 https://www.betaarchive.com/forum/viewtopic.php?p=420025#p42...

withinrafael 9y ago

All the old builds of Windows 10 listed were presumably grabbed via public Unified Update Platform (UUP) infrastructure or the Ecosystem Engagement Access Program (EEAP), but I haven't confirmed yet. It's common knowledge in the Windows enthusiast community that builds (yes, even arm64 desktop Insider builds) can be pulled from Microsoft via these channels. It's not confidential, and not useful to share with anyone other than a build vault like Beta Archive. Debugging symbols for most of those builds are available on symsrv. The Windows Mobile Adaption kit (like the OEM Preinstallation Kits, OEM Adaptation Kits) is shared with a similarly sized audience, which used to include self-attested Microsoft Partners. Again, not confidential. Just gated stuff. The Shared Source stuff is a slight unknown here because it's not clear what was in the ZIP. I presume this was a sampling of materials shared via the Shared Source Initiative (https://www.microsoft.com/en-us/sharedsource/ https://www.microsoft.com/en-us/sharedsource/), none of which includes high-value intellectual property, cryptographic code, third-party code, etc. It could still be damaging but Microsoft has clearly calculated the risk here; this stuff is shared with mere community MVPs. So with all this knowledge, it's hard to digest the "omg more exploits coming" and "Microsoft lost 32TB of private IP" angles in The Register write up. I don't think there's a story here, frankly.