Hacker News Reader

Comment by debacle | Hacker News Reader

This is like finding out the zombies have made it into the compound.

I wonder how big this hole is to fix. I also wonder, as many have, if this was written by an Intelligence agency and, if so, if they had access to Windows' source code.

View on HN

My Windows already fixed it. http://support.microsoft.com/kb/2718704

The awesome part is how they force you to download an additional signed WGA validator exe before the site coughs up the patch, which itself is signed. If I was the attacker, I'd definitely be MITM'ing this page.

Zombies in the compound indeed.

How can you tell whether the fix was genuine? What if you were already infected by the Flame virus or similar that intercepts your Windows update traffic?

I hope Microsoft can deliver the revoked certificates in a trustworthy manner.

The idea of Microsoft willingly giving windows source code access to government does not make alot of sense.

What could have however happened is that the said "Intelligence agency" first created a malware to infect MSFT engineers' computers and get access info of the code repository and then spoofing themselves as MSFT employees to download the source code. This is alot more plausible considering what stuxnet and flame can already do. (Assuming they were made by same "Intelligence agency")

MSFT should really check the systems of their employees first.

Nah, anyone can get hold of Windows sources http://www.microsoft.com/en-us/sharedsource/default.aspx

Microsoft licenses product source code to qualified customers, enterprises, governments, and partners for debugging and reference purposes

Drop 'em an email if you're curious.

It would be cool if the Wine project could use it for reference. Currently they are working by reverse engineering, AFAIK. I wonder if they are "qualified".

Probably not. Microsoft is 'sharing' their source code with select partners because it's in their best interest to be accommodating to organizations that are building complex systems on top of their product. Wine is closer to a competitor than a partner.

I think in cases like what Wine is trying to do (reimplement/reverse engineer) you want "clean" engineers, not "tainted" ones. So I think that having their devs look at the windows source code might be the last thing they want.

http://en.wikipedia.org/wiki/Clean_room_design

Also see http://oldcomputers.net/compaqi.html

Compaq couldn't just copy IBM's BIOS to make their new machine guaranteed IBM compatible, this would be illegal, and easily proven by IBM.

Solution: Reverse-engineer IBM's BIOS. Compaq used two sets of programmers - one group analyzed the original code and made notes of exactly how it responded.

The second group took these notes, and wrote their own BIOS that performed exactly the same.

It makes sense to someone.

Microsoft shared source initiative

http://www.microsoft.com/en-us/sharedsource/default.aspx

In 2003 MS gave China access to their source

http://www.microsoft.com/en-us/news/press/2003/feb03/02-28gs...

Reply on news.ycombinator.com