Re: [Dazuko-devel] Dazuko XP

[John Richard Moser]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



John Ogness wrote:
> John Richard Moser wrote:
> 
>> Is Dazuko going to hit windows XP soon?
> 
> 
> Hi,
> 
> I know that there are some commercial organizations working on getting
> Dazuko ported to WindowsXP. But I have no idea when that will be
> finished (or if it will be available at no cost). With WindowsXP Dazuko
> would be implemented as a mini-filter. This involves using
> Microsoft-Proprietary interfaces. To use these interfaces requires a
> license and signing a non-disclosure-agreement. This means that Dazuko
> for WindowsXP could never be open source.
> 

Hold on.  If I scanned (`string`) MS DLL files and found these
interfaces, and wrote code into Dazuko to use them which I'd
subsiquently use to write my software, then suddenly I'd be arrested and
sued and tons of shit because (OMFG) I wrote a program that makes the
user's experience better by going through hooks in the OS and deflecting
viruses without a virus definition file?

Can they even do that?  Besides you know, it being MORONIC because they
just damaged their business model.  Are they trying to keep McAffee and
Norton in business or something?  (I'd quickly floor McAffee, who's
generally known for nothing but AV; Norton at least has firewalls and
system tools that are actually popular).

The only way I can see this being legal is if they copyright their
interface, which isn't possible because (Apple Computer, Inc. v.
Microsoft Corp. 1994) interface was determined non-copyrightable.  I
believe that this has been used to justify duplicating programming
interface as well (i.e. the Harmony Toolkit; ReactOS).  If I find the
interface on my own (no NDA) and publish it, the only thing they should
be able to try to do is sue me for publishing the copyrighted names of
the functions in the API-- which would be interface.

I am not a lawyer, of course.  I'm a programmer.  Right now I want to
program a clone of DigSig for Windows with a robust enough client (it'd
be a system service with a client UI that would take the safest action
if no client UI was connected, and would require authentication for each
batch of action) that any normal user can reasonably use it to prevent
viruses from spreading entirely.  The impact would be that viruses would
suddenly cease to be effective.

The client UI would be asking the user if he wants to allow things he
didn't just do, which would actually work.  Users trying to i.e. run a
program aren't going to give a shit about "This file may contain a
virus, you should scan it first"; but they might react to "mscctl.dll
was just modified.  If you are not installing a program, you may want to
roll back this action in case a virus was just inserted into mscctl.dll"
or "notepad.exe signature mismatch.  This program appears corrupt, it
could contain a virus.  Would you still like to run it?"

I'm looking at a preemptive-reactive solution of course.  When a program
or library would be modified, it will be copied; further access to it
would access the copy.  Then the user is warned about the modification
or replacement.  If he wishes to allow it, a signature is generated, and
future access goes to the original; copy is deleted.  If he wishes to
roll back the change (maybe libclamav detects a virus and we tell him he
SHOULD roll back the change; maybe nothing but we tell him this might be
a concern anyway and he decides to just to be safe) then the old copy is
put back.

So I guess not.  Oh well, I only spent about 2 minutes thinking about
this.  Lose for Microsoft.

> HOWEVER, many companies have purchased such a license and signed the
> required documents. This means that one of these companies could port
> Dazuko and release it as a binary DLL at no cost. This would be the
> ideal solution (considering the options). We will have to see what
> happens. Right now there are no proposed release dates for a WindowsXP
> version.
> 
> On a side note, a friend of mine is working on a 16-bit MS-DOS port of
> Dazuko. :)
> 
> John Ogness
> 

- --
All content of all messages exchanged herein are left in the
Public Domain, unless otherwise explicitly stated.

    Creative brains are a valuable, limited resource. They shouldn't be
    wasted on re-inventing the wheel when there are so many fascinating
    new problems waiting out there.
                                                 -- Eric Steven Raymond
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.5 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFCW7i8hDd4aOud5P8RAmoyAJ0aeDHHViFxN9o7NpsuVHPgwnJo1wCeO/aV
rdLmzsaPVH0+iNaeZJ1U+7g=
=5LAi
-----END PGP SIGNATURE-----