On the 5th May I went into my office and started to read the 400-odd mail messages that had arrived overnight. One of them was obviously spam, judging by the title:
193 04-05-2000 Lennart Blomstrom To 'E-mail' ( 204) ILOVEYOU
It was clear from the gratuitous quotes around the To: name that this message was send with a Microsoft MUA, but I was intrigued, so I took a look. What I got was:
[-- Attachment #1 --] [-- Type: text/plain, Encoding: 7bit, Size: 0.1K --] kindly check the attached LOVELETTER coming from me. [-- Attachment #2: LOVE-LETTER-FOR-YOU.TXT.vbs --] [-- Type: application/octet-stream, Encoding: quoted-printable, Size: 11K --] [-- application/octet-stream is unsupported (use 'v' to view this part) --]
This was a message in two parts: the first attachment was a single line of plain text just pointing to the second attachment, which was of unknown type: application/octet-stream is just a catchall for any kind of data which doesn't have its own name, so you have to know what you're getting. Even Microsoft has specific application subtypes, such as application/msword, which describe the format of the data in the attachment. Oh well, I took a look at the attachment. It certainly wasn't a letter:
rem barok -loveletter(vbe) <i hate go to school>
rem by: spyder / ispyder@mail.com / @GRAMMERSoft Group / Manila,Philippines
On Error Resume Next
dim
fso,dirsystem,dirwin,dirtemp,eq,ctr,file,vbscopy,dow
eq=""
ctr=0
Set fso =
CreateObject("Scripting.FileSystemObject")
set file = fso.OpenTextFile(WScript.ScriptFullname,1)
vbscopy=file.ReadAllm
ain()
sub main()
On Error Resume Next
dim wscr,rr
set
wscr=CreateObject("WScript.Shell")
rr=wscr.RegRead("HKEY_CURRENT_USER\Software\Microsoft\Windows Scripting
Host\Settings\Timeout")
if (rr>=1) then
wscr.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\Windows Scripting
(etc)
But what is this stuff? It's obviously some obscure kind of programming language. I suppose the name ending in .vbs might say something to Microsoft systems, but it shouldn't: that information should be in the Content-Type: header.
Of course, the idea of actually executing this unknown program is ridiculous. We went through all that over a decade ago, when Robert T. Morris, Jr. let loose the famous Internet Worm and took down a whole lot of BSD systems. We hadn't paid much attention to security up till then, but we certainly did in the aftermath. Now, ten years later, it appears that people still haven't learnt. We have three major problems:
This message caused damage comparable in magnitude to Bill Gates' personal fortune. Who's to blame? Not really the perpetrator. We know how to stop this damage. In the UNIX world, we stopped it a decade ago. Microsoft knows about the dangers, but has done nothing to stop it.
It's a pity that the press didn't see this. I haven't heard a single mention in the press that the vendor of the software might be to blame. Even so, though, it makes the man in the street more aware of security issues, and that can only be to the benefit of secure operating systems.
Any comparison has to be subjective, but I'm trying to be fair to everybody here. If you find something incorrect or disadvantageous to any side, including Linux, please let me know.
So what's the secret? Why isn't BSD better known? This white paper addresses these and other questions:
BSD stands for ``Berkeley Software Distribution''. It is the name of distributions of source code from the University of California, Berkeley, which were originally extensions to AT&T's Research UNIX operating system. Several open source operating system projects are based on a release of this source code known as 4.4BSD-Lite. In addition, they comprise a number of packages from other Open Source projects, including notably the GNU project. The overall operating system comprises:
Unlike the Linux kernel, there are several different BSD kernels with differing capabilities.
The BSD C library is based on code from Berkeley, not the GNU project.
Some of the utilities are derived from the GNU project, others are not.
The X Window system used in most versions of BSD is maintained by a separate project, the XFree86 project. This is the same code as Linux uses. BSD does not normally specify a ``graphical desktop'' such as GNOME or KDE, though these are available.
It's true that AT&T UNIX is not open source, and in a copyright sense BSD is very definitely not UNIX, but on the other hand, AT&T has imported sources from other projects, noticeably the Computer Sciences Research Group of the University of California in Berkeley, CA. Starting in 1976, the CSRG started releasing tapes of their software, calling them Berkeley Software Distribution or BSD.
Initial BSD releases consisted mainly of user programs, but that changed dramatically when the CSRG landed a contract with the Defense Advanced Projects Research Agency (DARPA) to upgrade the communications protocols on their network, ARPANET. The new protocols were known as the Internet Protocols, later TCP/IP after the most important protocols. The first widely distributed implementation was part of 4.2BSD, in 1982.
In the course of the 1980s, a number of new workstation companies sprang up. Many preferred to license UNIX rather than developing operating systems for themselves. In particular, Sun Microsystems licensed UNIX and implemented a version of 4.2BSD, which they called SunOS. When AT&T themselves were allowed to sell UNIX commercially, they started with a somewhat bare-bones implementation called System III, to be quickly followed by System V. The System V code base did not include networking, so all implementions included additional software from the BSD, including the TCP/IP software, but also utilities such as the csh shell and the vi editor. Collectively, these enhancements were known as the Berkeley Extensions.
The BSD tapes contained AT&T source code and thus required a UNIX source license. By 1990, the CSRG's funding was running out, and it faced closure. Some members of the group decided to release the BSD code, which was Open Source, without the AT&T proprietary code. This finally happened with the Networking Tape 2, usually known as Net/2. Net/2 was not a complete operating system: about 20% of the kernel code was missing. One of the CSRG members, William F. Jolitz, wrote the remaining code and released it in early 1992 as 386BSD. At the same time, another group of ex-CSRG members formed a commercial company called Berkeley Software Design Inc. and released a beta version of an operating system called BSD/386, which was based on the same sources. The name of the operating system has since changed to BSD/OS.
386BSD never became a stable operating system. Instead, two other projects
split off from it in 1993: NetBSD and FreeBSD. The two projects originally diverged
due to differences in patience waiting for improvements to 386BSD: the NetBSD
people started early in the year, and the first version of FreeBSD wasn't ready
until the end of the year. In the meantime, the code base had diverged
sufficiently to make it difficult to merge. In addition, the projects had
different aims, as we'll see below. In 1996, a further project, OpenBSD, split off from NetBSD.
One detail that the lawsuit did clarify is the naming: in the 1980s, BSD was
known as ``BSD UNIX''. With the elimination of the last vestige of AT&T
code from BSD, it also lost the right to the name UNIX. Thus you will see
references in book titles to ``the 4.3BSD UNIX operating system'' and ``the
4.4BSD operating system''
Why isn't BSD better known?
For a number of reasons, BSD is relatively unknown:
Comparing BSD and Linux
So what's really the difference between, say, Debian Linux and FreeBSD? For the
average user, the difference is surprisingly small: Both are UNIX-like operating
systems. Both are developed by non-commercial projects (this doesn't apply to
many other Linux distributions, of course). In the following section, we'll
look at BSD and compare it to Linux. The description applies most closely to
FreeBSD, which accounts for an estimated 80% of the BSD installations, but the
differences from NetBSD and OpenBSD are small. Specifically, we'll look at the
following questions:
Who owns BSD?
No one person or corporation owns BSD. It is created and distributed by a community of highly technical and committed contributors all over the world. Some of the components of BSD are Open Source projects managed by a different project maintainer.
How is BSD developed and updated?The BSD kernels are developed and updated following the Open Source development model. Each project maintains a publicly accessible source tree under the Concurrent Versions System (CVS), which contains all source files for the project, including documentation and other incidental files. CVS allows users to ``check out'' (in other words, to extract a copy of) any desired version of the system.
A large number of developers worldwide contribute to improvements to BSD. They are divided into three kinds:
It is at the individual committer's discretion whether he should obtain authority before committing changes to the source tree. In general, an experienced committer may make changes which are obviously correct without obtaining consensus. For example, a documentation project committer may correct typographical or grammatical errors without review. On the other hand, developers making far-reaching or complicated changes are expected to submit their changes for review before committing them. In extreme cases, a core team member with a function such as Principal Architect may order that changes be removed from the tree, a process known as backing out. All committers receive mail describing each individual commit, so it is not possible to commit secretly.
Each BSD project provides the system in three different ``releases''. As with Linux, releases are assigned a number such as 1.4.1 or 3.5. In addition, the version number has a suffix indicating its purpose:
What versions of BSD are available?
In contrast to the numerous Linux distributions, there are only three open source BSDs. Each BSD project maintains its own source tree and its own kernel. In practice, though, there appear to be fewer divergences between the userland code of the projects than there is in Linux.
It's difficult to categorize the goals of each project: the differences are very subjective. Basically,
There are also two additional BSD operating systems which are not open source, BSD/OS and Apple's Mac OS X:
How does the BSD license differ from the GNU Public license?
Linux is available under the GNU General Public License (GPL), which is designed to eliminate closed source software. In particular, any derivative work of a product released under the GPL must also be supplied with source code if requested. By contrast, the BSD license is less restrictive: binary-only distributions are allowed. This is particularly attractive for embedded applications.
Since fewer applications are available for BSD than Linux, the BSD developers created a Linux compatibility package, which allows Linux programs to run under BSD. The package includes both kernel modifications, in order to correctly perform Linux system calls, and Linux compatibility files such as the C library. There is no noticeable difference in execution speed between a Linux application running on a Linux machine and a Linux application running on a BSD machine of the same speed.
The ``all from one supplier'' nature of BSD means that upgrades are much easier to handle than is frequently the case with Linux. BSD handles library version upgrades by providing compatibility modules for earlier library versions, so it is possible to run binaries which are several years old with no problems.
Which should I use, BSD or Linux?
What does this all mean in practice? Who should use BSD, who should use Linux?
This is a very difficult question to answer. Here are some guidelines:
Who provides support, service, and training for BSD?
BSDI have always supported BSD/OS, and they have recently announced support contracts for FreeBSD.
In addition, each of the projects has a list of consultants for hire: FreeBSD, NetBSD and OpenBSD.