Earlier quoted context omitted.
Might be helpful to the reactos and wine folks if unofficially.
Actually the opposite. They can't work in the project of they've seen the actual MS code even if they write their own code.
Ah well, if there's a rule...
32TB of Windows 10 internal builds, core source code leak online
71–80 of 94 posts
Re: 32TB of Windows 10 internal builds, core source code leak online
#72Earlier quoted context omitted.
How do you "ask them"? Do they have an email address for this? Or do you have to find the right guy on the team somehow?
Windows Shared Source initiative has existed for what, over 10 years now? https://www.microsoft.com/en-us/sharedsource/ I think this "leak" is greatly exhagerated.
I haven't worked directly with Microsoft for well over 15 years, but this sounds similar to what I remember. Back then I worked for a partner who was doing direct integration work against low-level SQL Server and Windows libraries. Often when we encountered obscure bugs, they'd just give us the SQL Server or Windows source code and basically say, "Fix it, and we will release a hot fix." All of the comments would be replaced with white space which made things more difficult.
Re: 32TB of Windows 10 internal builds, core source code leak online
#73Earlier quoted context omitted.
But the point is you need to already have a relationship, right? It seems you can't just say "I'm curious" (or even better, "I want to track down X bug") and expect to get source access, contrary to what was claimed earlier... Enterprise specifically says you need to "Maintain 10,000 Windows seats" which is not something a lone developer would do...
My only tie was having an MSDN subscription.
And you got it through the Enterprise license? Through your company or personally? Nothing related to 10,000 Windows seats? That's pretty weird if so since they say you must meet that requirement...
Re: 32TB of Windows 10 internal builds, core source code leak online
#74Earlier quoted context omitted.
> 1. How would Microsoft prove that they saw the code? Get the court to order discovery on all of your computers. They could probably also get subpoenas for the source code hosting sites to reveal relevant access logs. Or someone could admit to reading the source code someplace public, like a bug tracker. Or they could argue that the choice of variable names and minor details of algorithm details are too close to be…
> you'd have to think the FSF looks bad for suing people for violating the GPL I agree with your, but there are people who argue this.
And I'm one of them. We don't want to alienate the already small number of people who develop Free Software. I would rather see companies who violate the GPL comply rather than seek damages. Actually bringing a suit, in my mind, is basically the nuclear option.
Re: 32TB of Windows 10 internal builds, core source code leak online
#75Earlier quoted context omitted.
Exactly. A few years ago the ReactOS developers had to stop all development for several months to perform a source code audit. This was meant to deflect accusations that they had derived code from disassembled Windows binaries. If anything, this could make their legal situation more sticky.
> A few years ago the ReactOS developers had to stop all development for several months to perform a source code audit. What kind of an audit can you do without access to the original software's source code? How would you tell if it's actually different?
This is what they did https://www.reactos.org/wiki/Audit
Re: 32TB of Windows 10 internal builds, core source code leak online
#76Earlier quoted context omitted.
> A few years ago the ReactOS developers had to stop all development for several months to perform a source code audit. What kind of an audit can you do without access to the original software's source code? How would you tell if it's actually different?
This is what they did https://www.reactos.org/wiki/Audit
That's pretty cool, thanks!
Re: 32TB of Windows 10 internal builds, core source code leak online
#77Earlier quoted context omitted.
My only tie was having an MSDN subscription.
And you got it through the Enterprise license? Through your company or personally? Nothing related to 10,000 Windows seats? That's pretty weird if so since they say you must meet that requirement...
I didn't misrepresent myself, was logged in, and had no issues. They may have changed it, but that is what I selected. You'll probably have to sign an NDA. Give it a shot.
Re: 32TB of Windows 10 internal builds, core source code leak online
#78Throwaway account for obvious reasons. Does anyone have a link to the leaked data? At this point avoiding links is pointless as the source code will be essentially public knowledge in matter of days/weeks. Damage control is the only strategy left. The sooner security researchers outside Microsoft can start analyzing and reporting vulnerabilities, the better.
Not understanding why this comment needs a throwaway account?
Re: 32TB of Windows 10 internal builds, core source code leak online
#79Does this mean an individual could actually get their hands on the fabled Enterprise LTSB edition and thus actually have control over updates?
All I did was change a registry setting (or maybe it was a gpedit) to prevent automatic reboots. That was enough for me though, as I didn't appreciate my running apps being shutdown during the night.
Can you maybe recall exactly what u did to stop your computer to automatically shutdown(and up)?
I "resolved" the issue by dual booting. The second os(prev ubuntu, going to deb) changes something that takes away win ability to automagicly turn on my machine for updates.
Re: 32TB of Windows 10 internal builds, core source code leak online
#80Looks like there's some debate as to whether or not this has been exaggerated: https://www.betaarchive.com/forum/viewtopic.php?t=37282 So far I haven't seen any links to source code. Quote from one of the admins: > Yes I have no idea where they got the 32TB stuff. We had a big leak of Win10 builds yes, but these were all Windows Insider stuff that were collected over time available to all Windows Insider members at o…
Hiya - I wrote the article. What's happened is that the Beta Archive folks have now deleted (or in the process of deleting) the private material that was uploaded to the BA FTP. There most definitely was non-officially-released internal Microsoft files in the archive, regardless of BA's intentions, such as the Shared Source Kit, the ARM64 Windows Server build, the Mobile Adaption Kit, and various prerelease versions…
All the old builds of Windows 10 listed were presumably grabbed via public Unified Update Platform (UUP) infrastructure or the Ecosystem Engagement Access Program (EEAP), but I haven't confirmed yet. It's common knowledge in the Windows enthusiast community that builds (yes, even arm64 desktop Insider builds) can be pulled from Microsoft via these channels. It's not confidential, and not useful to share with anyone other than a build vault like Beta Archive.
Debugging symbols for most of those builds are available on symsrv.
The Windows Mobile Adaption kit (like the OEM Preinstallation Kits, OEM Adaptation Kits) is shared with a similarly sized audience, which used to include self-attested Microsoft Partners. Again, not confidential. Just gated stuff.
The Shared Source stuff is a slight unknown here because it's not clear what was in the ZIP. I presume this was a sampling of materials shared via the Shared Source Initiative (https://www.microsoft.com/en-us/sharedsource/), none of which includes high-value intellectual property, cryptographic code, third-party code, etc. It could still be damaging but Microsoft has clearly calculated the risk here; this stuff is shared with mere community MVPs.
So with all this knowledge, it's hard to digest the "omg more exploits coming" and "Microsoft lost 32TB of private IP" angles in The Register write up. I don't think there's a story here, frankly.