Would be cool to see the source code. Is that saved anywhere other than that floppy in the museum?
https://github.com/arialdomartini/morris-worm/tree/master
Has the decompiled version.
This week in 1988, Robert Morris unleashed his eponymous worm
191–200 of 200 posts
Re: This week in 1988, Robert Morris unleashed his eponymous worm
#192Earlier quoted context omitted.
> tried to frame. MIT really respects good hacks and good hackers. It was probably more effective than sending in some PDF of a paper.
>MIT really respects good hacks and good hackers. Oooof in light of Aaron Swartz. He plugged directly into a network switch that was in an unlocked and unlabelled room at MIT so he could download faster and faced "charges of breaking and entering with intent, grand larceny, and unauthorized access to a computer network". MIT really didn't lift a finger for this either. >Swartz's attorneys requested that all pretrial…
They didn't lift a finger and spent a lot of effort on whitewashing their own behavior afterwards in the guise of an independent review.
Re: This week in 1988, Robert Morris unleashed his eponymous worm
#193Funnily enough, just a few weeks before that, REM released their eponymous album. Perhaps Morris was inspired by that?
Re: This week in 1988, Robert Morris unleashed his eponymous worm
#194Earlier quoted context omitted.
The future isn't evenly distributed. I recently discovered an actively developed software project that had a ton of helper functions based on the design of `gets` with the same vulnerability. Surprisingly not all C/C++ developers have learned yet to recoil in horror at seeing a buffer pointer being passed around without a length. (C++'s std::span was very convenient for fixing the issue by letting the buffer pointer…
> Surprisingly not all C/C++ developers have learned yet to recoil in horror at seeing a buffer pointer being passed around without a length. As someone who wasn't taught better (partly due to not picking CS as a career stream), are there any languages which avoid such vulnerability issues? Does something like rust help with this?
Almost everything else, besides any language that is copy-paste compatible with C, including systems languages that predate C for a decade, like JOVIAL, ESPOL, NEWP, PL/I and other ALGOL inspired systems languages.
Xerox PARC started with BCPL for their systems, but eventually created Mesa exactly for safe systems programming.
https://en.wikipedia.org/wiki/Mesa_(programming_language)
http://toastytech.com/guis/star.html
"The Mesa Programming Environment" - very first IDE for a systems language
https://www.digibarn.com/friends/curbow/star/XDEPaper.pdf
While Pascal as originally designed wasn't suitable for systems programming, and various dialects sprung out of it, with Object Pascal from Apple/Borland being the most famous one, by 1978 the first standard for Modula-2 was released, which was inspired in Mesa, after Niklaus Wirth spent a sabaticall year at Xerox PARC. Years later, through a similar experience, the evolution of Mesa (Cedar) would influence him to come up with Oberon.
https://en.wikipedia.org/wiki/Modula-2
https://www.modula2.org/modula2-history.php
Then there was Ada, although too expensive to get compilers and high hardware requirements for 1980's computers.
Also all BASIC compilers in the 8 and 16 bit home computers had support for low level systems programming.
In recent programming languages, something like Zig would be the closest to what those languages were offering, in safety without having a GC of some form.
Naturally this takes cares of most C flaws, minus use-after-free, however due to their type systems, one tends to use heap allocations less than in C, although it remains an issue.
Re: This week in 1988, Robert Morris unleashed his eponymous worm
#195It's a little shocking to me that there haven't been more things like this. While we're much more conscientious and better at security than we were way back then, things are certainly not totally secure. The best answer I have is the same as what a bio professor told me once about designer plagues: it hasn't happened because nobody's done it. The capability is out there, and the vulnerability is out there. (Someone w…
>The best answer I have is the same as what a bio professor told me once about designer plagues: it hasn't happened because nobody's done it. The capability is out there, and the vulnerability is out there.
I could be wrong, but I've come to believe that despite the hype they have very little capability.
Re: This week in 1988, Robert Morris unleashed his eponymous worm
#196I followed his course 6.5840 on distributed systems ( https://pdos.csail.mit.edu/6.824/ , YouTube videos at https://youtube.com/playlist?list=PLrw6a1wE39_tb2fErI4-WkMbs... ) and completed the labs. One day, out of curiosity, I looked up his name. Then I realized what a legend he is. Great course by the way.
RTM was my TA at MIT for a CS/systems engineering course. It took the students until we did an assignment about the worm to realize who he was IIRC. The students thought it was very cool, but even then, as a TA covering the assignment, he didn't really talk about it.
He was also a TA at Harvard with Trevor Blackwell for CS 148 (computer networking, taught by H T Kung) at the time. I remember taking that with them in 1995.
Re: This week in 1988, Robert Morris unleashed his eponymous worm
#197Earlier quoted context omitted.
Yeah and a 'host' back then wasn't a cheap PC or something, they tended to be $30000 workstations or $300000 servers. At tech companies and Universities only, and mostly in the US. 60k sounds like a lot for those days. It grew massively from the early 90s. Even UUCP was still really fringe and those weren't actually connected hosts on tcp/ip. They had their own dialup mail exchange protocol similar to fidonet.
Those were the days. I still remember my fido number. And I still remember just how painful it was to get uucp working properly. Ugh. But my mother had an email address years before any of her contemporaries. Being a geek was fun then.
Yeah I even had multiple fido point numbers. Because there were some alternative networks. I kinda miss it.
I also used uucp for a few years though it soon got replaced with full internet. We were bit behind in Europe and we caught up fast. In the beginning I also had to use bang paths to avoid some misconfiguration upstream. Fido was actually better at this and the tool chain much more user-friendly. Though you still needed multiple. There was one to do the dial up and one to sort the retrieved mail, a "tosser" :)
Re: This week in 1988, Robert Morris unleashed his eponymous worm
#198Earlier quoted context omitted.
The future isn't evenly distributed. I recently discovered an actively developed software project that had a ton of helper functions based on the design of `gets` with the same vulnerability. Surprisingly not all C/C++ developers have learned yet to recoil in horror at seeing a buffer pointer being passed around without a length. (C++'s std::span was very convenient for fixing the issue by letting the buffer pointer…
> Surprisingly not all C/C++ developers have learned yet to recoil in horror at seeing a buffer pointer being passed around without a length. As someone who wasn't taught better (partly due to not picking CS as a career stream), are there any languages which avoid such vulnerability issues? Does something like rust help with this?
Yes, Rust protects against this and so does almost every language with garbage collection (Java, C#, Python, JS/TS, etc). C/C++ are pretty unique in being some of the only popular languages remaining that don't protect you from memory safety issues often causing exploitable vulnerabilities.
Re: This week in 1988, Robert Morris unleashed his eponymous worm
#199The worm was unleashed November 2, 1988. I was born exactly 7 days later. Coincidence? Yeah, probably.
Re: This week in 1988, Robert Morris unleashed his eponymous worm
#200I followed his course 6.5840 on distributed systems ( https://pdos.csail.mit.edu/6.824/ , YouTube videos at https://youtube.com/playlist?list=PLrw6a1wE39_tb2fErI4-WkMbs... ) and completed the labs. One day, out of curiosity, I looked up his name. Then I realized what a legend he is. Great course by the way.
I am also doing the course now in my freetime. Even I wasn't aware who he is. On a sidenote, what did you do after the course? It is an amazing course though!
Sadly, not much. My shitty job working on legacy systems doesn't really allow me to use it professionally. Still, I got a much better perspective on concurrency and systems in general, and when I occasionally see articles/videos about system design questions I could understand what they are talking about, which probably will be handy when the day arrives.
I have a colleague who suggested that I could look at open source projects on distributed systems and get my hands wet, although I haven't had a chance to do that due to time constraints. Maybe something you could consider.