My immediate thought is whether researchers or investigative journalists will find cold hard US government backdoors. This is potentially big.
Also, it's not just (allegedly) all of XP source that's been leaked:
https://www.bleepingcomputer.com/news/microsoft/the-windows-...
It's also Windows Server 2003, MS DOS 3.30, MS DOS 6.0, Windows 2000, Windows CE 3, Windows CE 4, Windows CE 5, Windows Embedded 7, Windows Embedded CE, Windows NT 3.5, and Windows NT 4!
That's a huge amount of stuff to analyse.
As a recall, making notepad is like a homework assignment for a visual basic class. You just drag the text editor window and add the menus, there isn't a whole lot there!
Paint would probably be a bit more work, but there are a few clones out there already
What GP meant, is whether the source for those controls is available.
[1]: https://docs.microsoft.com/en-us/windows/win32/controls/indi...
The same goes for Mac. Mac has "textEdit" and "Notes" apps but it handles formatting, is slower to launch and is more of a Wordpad clone. For Paint, their Preview tool is terrible. I just want to take a screenshot, paste it in a file, maybe add a red circle or square and save it as png. Quick and fast.
But if you cannot guarantee the correspondence between source and binary releases, such a review only helps a little. Reproducible build is crucial for auditability.
I hate it. It was so easy in DOS era - same source, same binary file, easy peasy.
It could be chalked to some lack of care; however, up until 2000 or so, non reproducible builds were considered a bug in at least two places I worked in. The fact that it has become so hard to make builds reproducible could be Increased “entropy” (because no one cares To fix it) - but it could also be orchestrated by someone with a vested interest.
E.g. - suppose you are a three letter agency, and want to implement a “reflections on trusting trust” attack. Non reproducible builds become a pre-requisite.
I can confirm that back in the Windows 2000 days, MS let a major global bank have access to the Windows 2000 source code to aid them in coding some low level bespoke software.
Back then, if you were a gold customer, you could pretty much get anything out of MS under an NDA.
Examples of this are comparatively well known but it seems to me it's really not relevant here. In those instances it's extremely unlikely that said institutions would have access to even the majority of the source code let alone all of it.
All they need are API hooks and or various security code that's relevant for their purposes, etc. If I were the Microsoft person responsible for interfacing with these banks, I'd do what I've done with unrelated stuff, which is to tell them just sufficient to do the job (that's to say only on a need-to-know basis).
That sounds a lot like a conspiracy theory. Any references on this?
They have been pretty negligent about the first (or even malicious about it - e.g. the dual drbg case), letting the second take over - but officially they still have the first mandate.
In fact, DES was considerably strengthened in its day by the NSA review - at that time for reasons not understood by industry or academia. It was later discovered that the change required by the NSA made DES much more resistant to differential cryptanalysis, a technique that was (re)discovered by academic cryptographers much later.
Every “conspiracy” I’ve heard about the NSA and friends turned out to be true, most with definite proof from the Snowden releases.
And therefore every next thing anyone on the Internet concocted has to be true as well?
I get what you're saying though, and I'm well aware of the dual mandate. But you haven't given me anymore reason to believe this particular one, and I find it strange because I've never heard of any company in any country having to give their software to an intelligence agency before being allowed to release only the modified version. Implanting backdoors is not unheard of, but after they had great success with the clipper chip it's usually done without the company in question knowing about it.
You say the excuse was to validate some implementation, but in that case Microsoft wouldn't need to publish any modified versions, the nsa would just point out "this contains too strong crypto, can't export this" or "you made a mistake in algo X allowing attack Y". Not "please substitute this dll with our version and better not tell your customers!".
Cududa mentioned Microsoft let the NSA review it - that it was procedure, not that it was law. Furthermore, no one claimed that NSA recommendations or replacement DLLs had to be used by law - though that makes little difference. I mentioned that this would be in line with well known history of DES development. That’s basically all we said about it.
I have no idea what you are referring to with the Clipper chip. But RSA, NIST and others were definitely aware they were peddling NSA recommendations With the dual-drbg fiasco.
There's a possibility the leaked files are tampered from the original code anyway, i.e. backdoors were removed before being initially leaked. Rationale being that Microsoft / government wanted to control the situation long-term by letting something tampered be what leaks out underground instead of the 100% full thing.
Torrent poster also discusses that possibility: https://www.reddit.com/r/windowsxp/comments/iz46du/the_windo...
Nonetheless, it's interesting if anything plausible is found.
Remember, almost everything in the Snowden disclosures was known before snowden - but generally dismissed as “conspiracy theories”.
None if it was proved, until it was.
Russia and China aren’t buying any of this, and are fabricating their own chips. 5-Eyes are likely in on the thing so no reason for them to set up their own fab facilities.
But setting up your own software ecosystem is much easier (especially given Linux / BSD), even though it’s still expensive - so intelligence agencies would rather not give countries incentive to do so just because there’s a back door.
Besides, probably the quality was still low enough that you didn't need this, there were plenty of bugs that would grant a big organisation access.