4 ms·

Whoever thought not fixing a remote code execution bug just so they could use it to do something as trivial as tell the difference between their client and othe

Whoever thought not fixing a remote code execution bug just so they could use it to do something as trivial as tell the difference between their client and others should have been fired.

lproven 5y ago
Dirty tricks were routine back then. Out of interest, Geoff Chappell is the same man who uncovered one of Microsoft's dirtiest tricks: https://en.wikipedia.org/wiki/AARD_code https://en.wikipedia.org/wiki/AARD_code
- mst 5y ago
  Yeah, 1999 was a different world. I like modifying future versions of the client to produce similarly useful behaviour deliberately though, seems like a reasonable "apply evil hack, turn into less evil hack as soon as possible" sort of approach to the situation.
- actually_a_dog 5y ago
  I always considered them letting Excel use undocumented APIs but making the documented APIs a PITA to use for Lotus 1-2-3 one of their dirtiest tricks.
  - bradknowles 5y ago
    “Windows ain’t done ‘til Lotus don’t run.” Famous line.
lanstin 5y ago
after the Microsoft attack started is when we started looking for any defense we could find. The fact that the enabling instruction was in the running man icon seemed to be a sign that it was ok. Since the client code we wrote only talked to the server code we also wrote, the security standards were a bit looser. Host code would never have a bug like this; the host side was constantly attacked by hostile clients and just routers that bit flipped in weird places; overflow bugs would have happened and would have triggered a crash, core dump, and bug fix right away. But the client team was a lot more product / feature driven and constantly rushing. If someone had stood up an alternative host endpoint then this would have been a bigger issue, but I think the attacks were only other clients logging into our hosts. Tho there is now a group trying to recreate the host complex I have heard. We did patch the bug and replace the buffer overflow with a new “send us the checksum or hash or this range of virtual memory” which was as good for stopping attacks. They could have shifted to a client that ran the real client invisibly and controlled it thru windows API but they didn’t
- actually_a_dog 5y ago
  Hey, thanks for your reply. :) From your comment history, and your use of the word "we," I'm wondering: are you the person I just said should have been fired? Lol
  - lanstin 5y ago
    No I was host side, the person that thought of the overflow was a client dev, the very person that wrote the sloppy code. I always use we when talking about this job because it was a good group of very smart developers that I learned a lot from, not because I personally merit the reflected glory.
- dboreham 5y ago
  Clarification: the "Microsoft attack" was: they made a legitimate client that was compatible with your server's protocol? The effect of which was users didn't have to download the AIM client and also didn't see AOL ads?
  - lanstin 5y ago
    Correct. A classic Microsoft embrace and extend attack. They took out many (potential) competitors during the 90s with similar free as in beer software. As far as legitimate goes, I think it was soon rendered against the TOS of the person logging in, tho I don’t find TOS to be a particularly useful concept or practice. Microsoft also gave away http clients and http servers and it cost humanity a lot (for a while) that those attacks succeeded. Now google is attacking by again giving away free software and using their monopoly money to attack competitors. And for the ads, development keep an arbitrary 64k limit on ad sizes so they couldn’t be giant multimedia monstrosities.

Whoever thought not fixing a remote code execution bug just so they could use it to do something as trivial as tell the difference between their client and others should have been fired.

lproven 5y ago

Dirty tricks were routine back then. Out of interest, Geoff Chappell is the same man who uncovered one of Microsoft's dirtiest tricks: https://en.wikipedia.org/wiki/AARD_code https://en.wikipedia.org/wiki/AARD_code

mst 5y ago
Yeah, 1999 was a different world. I like modifying future versions of the client to produce similarly useful behaviour deliberately though, seems like a reasonable "apply evil hack, turn into less evil hack as soon as possible" sort of approach to the situation.
actually_a_dog 5y ago
I always considered them letting Excel use undocumented APIs but making the documented APIs a PITA to use for Lotus 1-2-3 one of their dirtiest tricks.
- bradknowles 5y ago
  “Windows ain’t done ‘til Lotus don’t run.” Famous line.

lanstin 5y ago

after the Microsoft attack started is when we started looking for any defense we could find. The fact that the enabling instruction was in the running man icon seemed to be a sign that it was ok. Since the client code we wrote only talked to the server code we also wrote, the security standards were a bit looser. Host code would never have a bug like this; the host side was constantly attacked by hostile clients and just routers that bit flipped in weird places; overflow bugs would have happened and would have triggered a crash, core dump, and bug fix right away. But the client team was a lot more product / feature driven and constantly rushing. If someone had stood up an alternative host endpoint then this would have been a bigger issue, but I think the attacks were only other clients logging into our hosts. Tho there is now a group trying to recreate the host complex I have heard. We did patch the bug and replace the buffer overflow with a new “send us the checksum or hash or this range of virtual memory” which was as good for stopping attacks. They could have shifted to a client that ran the real client invisibly and controlled it thru windows API but they didn’t

actually_a_dog 5y ago
Hey, thanks for your reply. :) From your comment history, and your use of the word "we," I'm wondering: are you the person I just said should have been fired? Lol
- lanstin 5y ago
  No I was host side, the person that thought of the overflow was a client dev, the very person that wrote the sloppy code. I always use we when talking about this job because it was a good group of very smart developers that I learned a lot from, not because I personally merit the reflected glory.
dboreham 5y ago
Clarification: the "Microsoft attack" was: they made a legitimate client that was compatible with your server's protocol? The effect of which was users didn't have to download the AIM client and also didn't see AOL ads?
- lanstin 5y ago
  Correct. A classic Microsoft embrace and extend attack. They took out many (potential) competitors during the 90s with similar free as in beer software. As far as legitimate goes, I think it was soon rendered against the TOS of the person logging in, tho I don’t find TOS to be a particularly useful concept or practice. Microsoft also gave away http clients and http servers and it cost humanity a lot (for a while) that those attacks succeeded. Now google is attacking by again giving away free software and using their monopoly money to attack competitors. And for the ads, development keep an arbitrary 64k limit on ad sizes so they couldn’t be giant multimedia monstrosities.