[HN Gopher] Morris worm
___________________________________________________________________
Morris worm
Author : cperciva
Score : 119 points
Date : 2023-11-02 19:30 UTC (3 hours ago)
(HTM) web link (en.wikipedia.org)
(TXT) w3m dump (en.wikipedia.org)
| blakesterz wrote:
| I love that they have an image of the floppy disc with the source
| code! I wonder if that's still readable?
| jcul wrote:
| My thoughts exactly. And if it's not then it's just a random
| floppy disk. Even if it did have the source code it's a little
| unremarkable without being able to read it.
|
| The plaque above the disk says it is just 99 lines of code, I
| wonder why they didn't just print it or engrave it onto the
| plaque.
|
| It seems the original source code is not available online,
| though there is a decompilation.
|
| https://github.com/arialdomartini/morris-worm
| shoggouth wrote:
| Robert Tappan Morris (the creator of this, the first internet
| 'worm') is the cofounder of ViaWeb and YCombinator with Paul
| Graham.
| cperciva wrote:
| Just to be clear, YC was also co-founded by tlb and jl.
| louthy wrote:
| > tlb and jl
|
| That's clear to whom? People who already know?
| cperciva wrote:
| Trevor Blackwell, Jessica Livingston.
| mindcrime wrote:
| He's even been known to post in HN, albeit very infrequently.
| At least, I'm assuming this is _the_ rtm.
|
| https://news.ycombinator.com/threads?id=rtm
| sillysaurusx wrote:
| Not only post to HN, but debug HN. Those xxxx comments were
| testing whether HN was up.
| eclectic29 wrote:
| Viaweb was acquired by Yahoo and rebranded as Yahoo Stores.
| Happened to read his code when I was at Yahoo Stores. Lisp at
| its best! He wrote the templating engine running behind the
| UIs. It was used until 2008 when I left. Not sure if Yahoo
| Stores is still around.
| cperciva wrote:
| Robert Morris is still active in security too -- FreeBSD has
| received quite a few good bug reports from him recently.
| lazystar wrote:
| Prof. Robert Morris' distributed systems course is amazing, wish
| I had some recordings.
|
| https://pdos.csail.mit.edu/6.824/
| great_wubwub wrote:
| It's on YouTube. https://youtu.be/cQP8WApzIQQ
|
| And yeah, it's excellent.
| ilrwbwrkhv wrote:
| +1. It's one of the best courses I have taken.
| alayne wrote:
| https://www.youtube.com/@6.824/videos
| pjmlp wrote:
| And 35 years later many developers keep ignoring the bounds
| checking that caused it.
| cperciva wrote:
| We don't ignore it! We turn it off deliberately to improve
| performance!
|
| (Seriously though, you'll love CHERI.)
| pjmlp wrote:
| And MTE, and PAC, and PM, and everything else into that
| direction. :)
|
| As for performance, C.A.R Hoare Turing speech in 1980 is
| quite clear regarding performance from Algol compilers.
| davepeck wrote:
| I like Neal.fun's "Internet Artifacts" page on the Morris worm --
| it presents the full code in an amusing form.
| https://neal.fun/internet-artifacts/morris-worm/
| NewsaHackO wrote:
| I find it funny that he attempted to frame MIT but ended up a
| full professor there.
| neilv wrote:
| It was part of MIT culture to believe in meritocracy.
| klyrs wrote:
| 35 years without an update... what a schlub.
| eichin wrote:
| MIT and Berkeley _did_ release patches at one point - not to
| fix any "real" problems - but since we were decompiling the
| VAX version, "missing an & in a bzero call" is really obvious
| from the machine code, since it just tries to pass the
| individual struct fields as arguments, and a call with 15+
| arguments stands out - and we thought it was a great way to
| troll the one person [at that point] who _did_ have the source
| code :-) The announcement was phrased something like "In our
| grand tradition of fixing other people's code..."
| Ajay-p wrote:
| I first read about 'RTM' in The Cuckoos Egg by Clifford Stoll,
| whom I think are both admirable men in the history of computing.
| I do not think he should have been prosecuted. There was no
| intent to cause damage and the law was too broad, from my
| admittedly non-attorney opinion. Even the unauthorized access
| charge is not appropriate.
| joaquincabezas wrote:
| Totally recommend that book!!
| thaumaturgy wrote:
| I enjoyed it as well, it was a fast read, suspenseful, and
| entertaining, and offered some glimpses into a part of
| computing that I only barely touched as I was getting
| started.
| gopher_space wrote:
| The main thing I got out of that book was an introduction to
| John Brunner. Shockwave Rider is amazing.
| canucker2016 wrote:
| The story I remember from the book was that Robert Morris Sr.
| didn't want his children to be exposed to the low brow content
| on the boob tube. So the kids weren't allowed to watch any TV.
|
| Then one day his son, Robert Morris Jr, comes home from school
| and mentioned how the other kids were talking about something
| called Sesame Street and Jr had no idea what they were talking
| about.
|
| Robert Sr. relented and allowed the kids to watch SOME TV so
| his kids weren't social outcasts.
| keepamovin wrote:
| Strange thing but this is one of the things that got me really
| interested in computer science. It was very clever.
|
| Not sure, but it might have been covered in the book Underground,
| by Suylette Dreyfus. Perhaps I'm thinking of another book tho
|
| I found this part of the article hilarious:
|
| _The Internet was partitioned for several days, as regional
| networks disconnected from the NSFNet backbone and from each
| other to prevent recontamination while cleaning their own
| networks._
|
| Internet was switched off for a bit for cleaning, said the hand
| written note. Come back later. Ha
|
| No doubt impossible today.
| ethbr1 wrote:
| > _No doubt impossible today._
|
| China? Russia just had a test earlier this year.
|
| The US probably only doesn't have a general plan because
| NIPRNet / SIPRNet / JWICS and precursors were isolated from the
| beginning.
| cylinder714 wrote:
| I was a new "sysmom" at SCO when this dropped. One of my senior
| colleagues (hey, K.!) patiently held my hand as I logged into
| each of our PCs running Xenix, tweaking each machines' setup
| before moving onto the next. Definitely more scary than the all-
| nighter we pulled at Netscape on New Year's Eve 2000. It felt
| like we were trying to prevent a contagion from spreading, which
| we were in fact.
| nullhole wrote:
| > all-nighter we pulled at Netscape on New Year's Eve 2000
|
| ?
|
| Is the story of this recorded somewhere? It sounds like it'd be
| a very good read!
| zippergz wrote:
| If there's an interesting Netscape story, I'd love to hear
| it. I can say that I was at another prominent tech company on
| that NYE and we basically pulled an all-nighter waiting for
| the Y2K sky to fall, but basically nothing went wrong. So, in
| the end, not a very exciting story.
| linsomniac wrote:
| I was running a Linux consultancy at the time and we had a
| party but were all on call in case the unexpected happened.
| Early in the day I got an e-mail from a friend in
| Australia: "Nothing fell apart, enjoy the party."
| StressedDev wrote:
| Here are some of the things we can learn from the Moris worm:
|
| 1) DO NOT CREATE PRODUCTS WITH DEFAULT PASSWORDS - I believe that
| the Moris worm spread because some versions of Unix had default
| passwords and users never changed the default password.
|
| 2) PROMPTLY INSTALL SECURITY PATCHES - I also believe the Moris
| worm spread by exploiting know security vulnerabilities.
|
| Here are some other lessons: - Use strong random passwords - For
| best results, use a password with 20-24 characters (i.e. about
| 128 bits of entropy).
|
| - Always change default passwords
| clwg wrote:
| It's really a sad state of affairs when those issues are still
| predominant on the internet. You're absolutely right that these
| are lessons we should take away from it; I just think the
| lessons needed to have been learned 35 years ago to have made
| any real difference.
| ethbr1 wrote:
| Up until ~2005, I believe ISPs were still shipping WAPs that
| all used the same hardcoded credentials, unless the user
| changed them.
|
| Wardriving was a lot easier then.
| ge96 wrote:
| Fantasy topic but imagine one got onto the star link satellites,
| hopping around hard to kill.
|
| Plot from Cowboy Bebop
| kevinsync wrote:
| Unlike Da Vinci (which toppled oil tankers), the Morris Worm
| deployed a particularly catchy YouTube video [0] on computer
| terminals worldwide. Countless minutes were lost attempting to
| replicate the synchronous moves.
|
| [0] https://www.youtube.com/watch?v=edfPMMrJKQQ
| neilv wrote:
| That looks reminiscent of natives under occupation, who train
| for combat secretly, by disguising it as folk dancing that's
| entertaining and permitted.
|
| Or who devise a system of melee weapon skills based on normal
| farming tools, which won't signal their intentions and be
| banned like swords.
|
| This Morris dancing seems innocuous to the invaders, until the
| uprising comes, and they, er, get bumped slowly with sticks.
| bewaretheirs wrote:
| I'd worry most about the ones dancing in ghillie suits.
| ww520 wrote:
| Wasn't his father head of NSA or in some position like that?
| Can't imagine how the call to him be like.
| canucker2016 wrote:
| His father, Robert Morris Senior, worked at the NSA, as a
| cryptographer, I believe - from the book, The Cuckoo's Egg by
| Clifford Stoll.
|
| His wikipedia page:
| https://en.wikipedia.org/wiki/Robert_Morris_(cryptographer)
| cperciva wrote:
| He worked at the NSA, yes. He was one of the authors of the
| original unix password hash, in fact.
___________________________________________________________________
(page generated 2023-11-02 23:01 UTC)