Neowin is reporting that the source code for Windows 2000 and Windows NT4 has been leaked to the Internet. I haven’t looked at the code, and I won’t, so I can’t tell you whether the report is accurate. But based on the fragmentary information available, it appears more likely than not that the leak is real. If there was a leak, what are the consequences?
First, whoever leaked the code is obviously in big trouble. And Microsoft might respond by reducing the number of people who get to see the code, a number that had been increasing lately. In fact, a leak is not too surprising given how widely Microsoft distributed the source code.
Second, the leak will do some damage to the security of Windows machines, but it’s not clear how much. There’s a longstanding debate about the security implications of open source development. Source code access makes it easier to find security bugs. With open source, you make it easier for honest outsiders to find bugs, which is good, but you also make it easier for malicious outsiders to find bugs, which is bad. This kind of leak give us the worst of both worlds: honest outsiders will avoid looking at the stolen code, while malicious outsiders use the code; so you get the security drawbacks of open source without the security benefits. This will only matter, though, if the bad guys would otherwise have trouble finding bugs, which may not be the case.
UPDATE (February 13): The Associated Press is reporting that the source code leak did occur.
Leave a Reply