Please create an account to participate in the Slashdot moderation system

 


Forgot your password?
Close
typodupeerror
×
America Online Microsoft Businesses Communications

David Auerbach Explains the Inside Baseball of MSN Messenger vs. AIM 86

Posted by timothy from the doesn't-seem-that-long-ago dept.
In N+1 magazine, David Auerbach explains what it was like in the "Chat Wars" of the late '90s, when he was the youngest person on the team developing Microsoft's brand-new messaging app, in the face of America Online's AIM, the 900-pound gorilla in the room. Auerbach explains how he used a network analyzer to fake out AOL's servers into letting Microsoft's client connect to AIM as well. "AOL could only block Messenger if they could figure out that the user was using Messenger and not AIM. As long as Messenger sent exactly the same protocol messages to the AOL servers, AOL wouldn’t be able to detect that Messenger was an impostor. So I took the AIM client and checked for differences in what it was sending, then changed our client to mimic it once again. They’d switch it up again; they knew their client, and they knew what it was coded to do and what obscure messages it would respond to in what ways. Every day it’d be something new. At one point they threw in a new protocol wrinkle but cleverly excepted users logging on from Microsoft headquarters, so that while all other Messenger users were getting an error message, we were sitting at Microsoft and not getting it. After an hour or two of scratching our heads, we figured it out." Eventually, though, AOL introduced x86 assembly code into the login protocol, and that not only stymied the MSM team, but led to some interesting warfare of its own. Auerbach's story sheds a lot of light on both good and bad aspects of corporate culture at the start of the 21st century, at Microsoft as well as other companies.
This discussion has been archived. No new comments can be posted.

David Auerbach Explains the Inside Baseball of MSN Messenger vs. AIM More

David Auerbach Explains the Inside Baseball of MSN Messenger vs. AIM

Comments Filter:

  • Imagine all this brainpower (Score:4, Interesting)

    by 50000BTU_barbecue ( 588132 ) on Tuesday April 22, 2014 @11:35AM (#46815499) Journal
    if it were applied to actually useful things? We'd have the green leisure society figured out for the entire planet.

    • Re: (Score:1)

      by Anonymous Coward
      Yeah; all that effort, on both their parts, and where did it get them?

      It got them XMPP and Facebook eating their lunch while they squabbled amongst themselves.

      You'd hope a company as big as Microsoft might have learnt something from that, but apparently the message got lost.

      • Pretty much.

        Thanks to the Browser Wars and the other various corporate battles of the 90's, and the ensuing minor triumphs of open-source (especially BSD-licensed) compatibility projects, compatibility is a growing expectation among consumers, whether they realize it or not.

        Websites are now peppered with "log in with Facebook" buttons and "Tweet this" links. Consumer devices tout how they integrate with everything people already use. Customers expect that interoperability will be a standard feature, rather

        • Re: (Score:2)

          by Rakarra ( 112805 )

          Thanks to the Browser Wars and the other various corporate battles of the 90's, and the ensuing minor triumphs of open-source (especially BSD-licensed) compatibility projects, compatibility is a growing expectation among consumers, whether they realize it or not.

          I really wish this was the case, but I've been seeing more and more lately attempts to lock down protocols and clients. Back when, anyone could connect to any IRC server with any IRC client. Pidgin could connect to AOL's AIM network (and still can). But recently, Steam Chat -- you can't do anything on it outside of the incredibly shitty Steam client. There's at least a third party plugin for pidgin to connect to skype, but it requires Skype to be to be running and all communications go through that.

          I just l

    • Re:Imagine all this brainpower (Score:5, Informative)

      by Richard_at_work ( 517087 ) on Tuesday April 22, 2014 @11:44AM (#46815557)

      This all sounds very very similar to the whole BitKeeper fiasco, where Andrew Tridgell watched the traffic between a real BitKeeper client and the server in order to determine the procotol used, with an eye to creating an open source client.

      BitKeeper found out and withdrew the free client licences, which was a problem since the Linux kernel project used BitKeeper at the time - due to Trudgells involvement, BitKeeper refused to supply gratis licenses to anyone working for OSDL, which included Linus Torvalds...

      The shitstorm that ensued resulted in Linus starting the Git project.

      • Re:Imagine all this brainpower (Score:4, Insightful)

        by Anonymous Coward on Tuesday April 22, 2014 @11:53AM (#46815649)

        And the world is better off for it.

      • This all sounds very very similar to the whole BitKeeper fiasco, where Andrew Tridgell watched the traffic between a real BitKeeper client and the server in order to determine the procotol used

        Not really, according to this article [lwn.net], Tridg connected to the Bitkeeper server using telnet, then typed "help" and got most of the information required.

      • Hell, sounds like the best way to get cool software is to piss of Linus.. :D

        I'm seeing subsurface show up in the weirdest, non-techy places now.. Apparently it's quite an improvement over other products.

      • Re: (Score:2)

        by kriston ( 7886 )

        And now I try to imagine all the brainpower wasted on getting a handle on how git sees things rather than using the best tool for the job at hand.

    • if it were applied to actually useful things? We'd have the green leisure society figured out for the entire planet.

      First you need to define the concept of "actually useful things" in a way that will evaluate the same for all people. Good luck with that.

      • Re: (Score:2)

        by jythie ( 914043 )
        Well, since we are a society that places a high value on monetary gain, since both of these products resulted in profits (ok, that is debatable) for both of their companies then by many standards they were quite useful.
      • Useful: Not MSN.

  • So if I did this ... (Score:5, Interesting)

    by gstoddart ( 321705 ) on Tuesday April 22, 2014 @11:44AM (#46815567) Homepage

    If I did this, I would likely be facing criminal charges ... how is it that corporations can do this kind of stuff with impunity?

    There seems to be a huge double standard in the way 'people' who are people are prosecuted under the law, versus how 'people' who are corporations are.

    And once again, I will take the opportunity to say the problem is the notion that you have 'people' who are corporations.

    • Re: (Score:2, Informative)

      by Anonymous Coward

      If implementing a protocol was illegal, Samba would be shut down because it implements the SMB file sharing protocol.

      This is about AOL failing to stop other from implementing their protocol. While you could argue (somehow) that the behavior was malicious, it was legal. Just as those multi-messenger programs with support for AIM, ICQ, and a couple other chat protocols were perfectly legal as well.

      • If implementing a protocol was illegal, Samba would be shut down because it implements the SMB file sharing protocol.

        Implementing a protocol may not be illegal, but if I

        used a network analyzer to fake out AOL's servers into letting Microsoft's client connect to AIM as well

        you can bet your ass I'd be facing criminal charges.

        This is about more than making something work with a protocol, it's about explicitly spoofing what you're doing to the servers in question.

        Something about unauthorized access to a server

      • It's not mimicking the protocol that seems (to me) like it should be illegal, but rather using AOL's chat servers when you explicitly do not have permission to do so. AOL pays to run and maintain those for the benefit of their customers, not for the benefit of Microsoft. To me is feels something like a crappy restaurant handing its customers a plate of food and a red suit jacket and then telling them, "our dining room kind of sucks. Go down the street, third door on your right is a restaurant with a better

      • Reverse engineering isn't illegal as long as it is done right. The start of the PC started when Compaq reverse engineered the BIOS on IBM PCs. Stealing information outright is illegal. Breaking encryption is illegal. There are many grey lines.

        For example the battle between Palm and Apple on iTunes syncing with Palm Pre devices. Now it wasn't illegal for Palm to have their Pre devices pretend to be iPods so that they could use iTunes to sync up media. But it did cross a line as Palm basically was piggy-ba

    • Re: (Score:2)

      by jythie ( 914043 )
      Keep in mind this was pre-DMCA, so it was much harder to go after someone for reverse engineering a protocol. Today on the other hand companies sue each other all the time over reverse engineering, and did in the past too using conventional copyright, patent, or trade secrets laws. So in general, corporations can not 'do this stuff with impunity', they can get their asses sued off.

    • If I did this, I would likely be facing criminal charges...

      In the US, yes....
      Just imagine if AIM had encrypted the communication with a key hardcoded into their client... Then accessing the server with a third party client could be unauthorized access of computer system in violation of the computer fraud act, or at least violation of DMCA, by breaking DRM.

      • They couldn't use the DMCA, Lexmark put an authentication chip on their toner cartridges and sued SCC for reverse engineering their chip for cheaper cartridges. The supreme court sided with SCC in 2004 and then sided with them in 2014 when SCC asked for damages from Lexmark for the false copyright claims. Essintally you can't claim copyright infringement because you are granting access with your protocol so accessing with a copy of your protocol is no different.

        • Re: (Score:2)

          by jopsen ( 885607 )

          They couldn't use the DMCA, Lexmark put an authentication chip on their toner cartridges and sued SCC for reverse engineering their chip for cheaper cartridges. The supreme court sided with SCC in 2004 and then sided with them in 2014 when SCC asked for damages from Lexmark for the false copyright claims. Essintally you can't claim copyright infringement because you are granting access with your protocol so accessing with a copy of your protocol is no different.

          Interesting... But in the case of a messenger service, AIM could probably modify their EULA and claim copyright on all messages exchanged over the network.
          In which case DMCA would apply.

          • If they were planning on actually copyrighting their customers messages they would have to pay $35 a message. There is also the issue of one of their customers sending copyrighted material which AOL would then claim as their own.

  • So the take away is... (Score:5, Insightful)

    by 140Mandak262Jamuna ( 970587 ) on Tuesday April 22, 2014 @11:44AM (#46815569) Journal
    The AOL coders did not try to incorporate a challenge and response system based on public/private keys. Or use some sort of digital signature in their clients to authenticate themselves as the "true build" from AOL. Not surprised. After all they wrote AOL.

    • Re:So the take away is... (Score:4, Insightful)

      by gstoddart ( 321705 ) on Tuesday April 22, 2014 @11:59AM (#46815711) Homepage

      Not surprised. After all they wrote AOL.

      Well, there was a time when someone believed AOL was worth enough to buy Time Warner with just stock.

      Good times ... an era with some of the most graphic examples of the stock market losing track of how money and value actually works.

      That more or less convinced me right then and there it was all a fairy tale, and the ABCP-caused meltdown of '08 has only reinforced that.

      Let's face it, the stock market is a big Ponzi scheme which is often completely detached from reality.

      Convince enough people that it makes sense for a company to be trading at a value equal to 100 years worth of income, or that junk debt is AAA rated ... and you can scoop up lots of money too.

      • Convince enough people that it makes sense for a company to be trading at a value equal to 100 years worth of income

        Buy a stock at 100x income, hold on to it for five years, then sell it for 100x income. Assuming "income" scales with inflation, the net result is that you gained 5 years' worth of dividends. If the company does well, the sale price may be significantly higher than its purchase price.

        Note that the actual numeric value of "income" is irrelevant to the net profit. Change matters and dividends matter, but the price of "one share" is largely immaterial. That's why people who actually understand the stock market

      • Re: (Score:2)

        by bigpat ( 158134 )

        Let's face it, the stock market is a big Ponzi scheme which is often completely detached from reality..

        That implies that the money comes from the bottom up and feeds into a pyramid. Actually it is in very large part the opposite with the Federal Reserve creating new money, feeding it into the banks and Federal Government and all that new money trickling down through Wall Street and Federal contractors then eventually a little bit eventually gets through to the real production oriented economy where food gets grown and transportation and energy get produced. At each level very unproductive people are spinni

      • Re: (Score:2)

        by cusco ( 717999 )

        And most companies require you to invest your money in the Ponzi scheme if you want them to help fund your retirement in any way at all. My statistics professor, whose day job was an actuary for the insurance industry, said, "Insurance is a big casino, and the companies have made sure everyone is required to play. And the house will always win." I'd have to say the same about the stock market.

    • In 1998? The ban on exporting >40bit encryption from the US was only relaxed in 1996, and it took until 2000 for the executive order to be fully implemented. The AOL legal department probably cautioned against it. Besides, it still wouldn't be entirely secure: One side of the key would have to be embedded in the client, where it could be extracted. Plus it would make intercepting messages in transit very difficult, something which would likely earn the ire of the government - the NSA was not so famous as

      • You don't have to encrypt the whole message. Just create a 4 byte digest of the message, salt it, encrypt it and append it to the message. The server can just verify the digest has been encrypted using a known signature. The encryption need not be strong. Much less than 40 bits would do. In fact even symmetric key encryption (where anyone dredging through the binary can find the keys) would be sufficient. The aim is not to make it uncrackable. The aim is to force Microsoft to "sign" as AOL. The moment AOL c

  • Hello, Security. Nice to meet you. (Score:5, Insightful)

    by Minwee ( 522556 ) <dcr@neverwhen.org> on Tuesday April 22, 2014 @11:58AM (#46815703) Homepage

    But AOL’s client had a security bug in it, called a buffer overflow. [...] AOL knew about this bug in their program and now they were exploiting it! That was what all those double zeros were for—they were just filling up space in the program’s buffer until they hit the end of the AOL client’s buffer and started overwriting executable code with the remainder of the protocol message. AOL was causing the client to look up a particular address in memory and send it back to the server.

    There's something that you could always count on AOL for -- Respect for the users. Most companies, when faced with a trivially exploitable buffer overflow that could cause their chat client to execute arbitrary code would classify it as a bug and feel compelled to fix it, but that's not the AOL way. Instead they changed it from a bug to a feature which enhanced security by verifying the client's identity.

    And if somewhere along the way someone else used it to own an army of AOL-zombie PCs, then that's just the price you pay. You can't make an omelette without breaking a few arms.

    • But AOL’s client had a security bug in it, called a buffer overflow. [...] AOL knew about this bug in their program and now they were exploiting it! That was what all those double zeros were for—they were just filling up space in the program’s buffer until they hit the end of the AOL client’s buffer and started overwriting executable code with the remainder of the protocol message. AOL was causing the client to look up a particular address in memory and send it back to the server.

      There's something that you could always count on AOL for -- Respect for the users. Most companies, when faced with a trivially exploitable buffer overflow that could cause their chat client to execute arbitrary code would classify it as a bug and feel compelled to fix it, but that's not the AOL way. Instead they changed it from a bug to a feature which enhanced security by verifying the client's identity.

      And if somewhere along the way someone else used it to own an army of AOL-zombie PCs, then that's just the price you pay. You can't make an omelette without breaking a few arms.

      'Round here we calls 'em armlettes.

  • Big Slow Giants squabbling over long rotten carcasses leave room for small flexible innovators with disruptive tech. Although, It's a shame them roped creative people into participating in their access control war...

  • People need to learn not to use non-standard software controlled by corporations for their communications. For me, no Skype, no Facebook, no stupid crap.

    • Re:Another reason not to use nonstandard software (Score:4, Interesting)

      by gstoddart ( 321705 ) on Tuesday April 22, 2014 @12:24PM (#46815903) Homepage

      Which leaves you working with technologies nobody you know has any idea about, and no interest in getting.

      Though, judging by your UID, you might still be using usenet. :-P

      • Re: (Score:2)

        by bigpat ( 158134 )
        I still use email after 30 years, but I'll be damned if I remember any of my AOL screen names. Facebook is a trend on the down slope in a long line of trendy online communities and not a distinct communications platform. AOL is a lesson for Facebook in that if a company tries too hard to keep control of a proprietary communications system then it will loose out to another company that will be less controlling.
    • Do you use a phone? Do you browse the Internet? Do you drive an automobile? Did you file your taxes?

      No matter what you do unless you live in the middle of the woods you will always be exposed to software that you have no control over. Even if you're using open sourced software to communicate with people the messages are still transmitted over corporate owned hardware which means they can easily copy your message even if its encrypted.

  • I really enjoyed reading about the little war between Microsoft and AOL during the chat heyday. However the author went into asides that were 3x longer than the actual story he was trying to tell, going through the entire history of Microsoft and Apple.

    • I dunno. I kinda liked the bit about going down to Morganville with an onion tied to his belt.

      • Re: (Score:3)

        by gmhowell ( 26755 )

        I dunno. I kinda liked the bit about going down to Morganville with an onion tied to his belt.

        Well, you're new around here, and probably a kid (judging by your UID), but I can assure you, that was the fashion at the time.

  • History repeats itself (Score:5, Insightful)

    by ptaff ( 165113 ) on Tuesday April 22, 2014 @12:53PM (#46816157) Homepage

    Yeah, those long forgotten chat-silo days when you needed an ICQ account, an AIM account, a MSN account, a Yahoo account to reach all your friends... fortunately XMPP/Jabber would solve all of this, and even Google would embrace the open standard with their new GTalk.

    Oh! wait... it was a bait and switch [slashdot.org].

    Don't be evil does not mean be good.

    • Re: (Score:2)

      by Animats ( 122034 )

      Yeah, those long forgotten chat-silo days when you needed an ICQ account, an AIM account, a MSN account,

      Now you need a Twitter app, a Google app, etc.

      Take a look at the mechanism Twitter uses to lock out non-Twitter clients they don't like. There's a cryptographic authentication system in Twitter using OAuth to do that. Twitter routinely yanks the credentials of developers who do things they don't like, such as filter out ads.

      • Yes, because gutting a service's revenue stream should always be seen as a sign of goodwill on the part of a developer right?

  • History of AIM. [mashable.com]

    can't wait, in ten years, everyone can talk about the fights and struggles to get Facebook, iOS, Android, et al. out the door.

    Gotta be some epic stories in there somewhere.

  • Well, when MS was presented with a closed, proprietary format, their solution was to reverse engineer it and admitting what a burden that was and how it hindered interoperability. Maybe they should re-evaluate their position on the Microsoft Office formats.

Slashdot Top Deals

Love may laugh at locksmiths, but he has a profound respect for money bags. -- Sidney Paternoster, "The Folly of the Wise"

Close