By [ad_1]
More than 30 years before the xz backdoor became the near disaster of the week, an intern tried to sneak some unexpected code into MS-DOS. Not a backdoor, but potentially a bit silly.
At the end of a video in which former Microsoft engineer Dave Plummer attempts to explain the workings of the xz backdoor and how it came to be, a nugget was dropped about an Easter egg that almost made it into MS-DOS. It is not a backdoor but a cautionary tale regarding checked-in code and the benefits of code reviews.
Plummer’s story goes back to 1993, the final days of MS-DOS. He was an intern at the time, tasked with working on the disk compression technology in version 6.2 of the operating system. He shared an office with another intern who clearly had too much time on his hands.
“He was working on the copy command,” explained Plummer, “and he took the opportunity to check in – not a backdoor per se – but a special command line switch.”
A command line switch is something familiar to many a console jockey and is used to modify or set a parameter for a given command. For example, adding /s to the end of an xcopy command will copy all folders and subfolders, except empty ones.
In this case, Dave’s fellow intern decided to do something special. “With copy he added it so that /♥ … would just print ‘I love sex’ over and over and over.”
Plummer had no idea about the change until he received a terse call from his manager at home. The switch had been caught (presumably in a code review) and management was not amused.
He was asked: “What did you know about this?”
The honest answer was that he knew nothing.
“Naturally,” said Plummer, “they did not invite the guy back.”
“It did not look good for him. I don’t know what the repercussions were; I don’t know what they did. All I know is that they took me at my word that I wasn’t involved.”
Plummer wound up working for Microsoft for years afterward but admitted: “I don’t know if I would have hired me after that little incident in my office … Did I really not know about it? No. I didn’t.”
Plummer told The Register: “It would be more precise to say that he TRIED to sneak it into the copy command, but it was caught. I’m not privy to the HOW part, though.
“I know for sure it never made it into a release build.” ®
[ad_2]
Source link
