UPDATE Slammed in a court brief for the proprietary way it implements the Kerberos Web security standard in Windows 2000, Microsoft (MSFT) (MSFT) moved to reassure customers and disarm critics by publishing the formerly secret details of its version of Kerberos - just one day before the brief was filed.
Better late than never? Perhaps, but Microsoft has attached restrictions to the Web site where the details are published, essentially locking down the information. Anyone trying to download the file must first agree to a licensing agreement that labels the material "confidential information and a trade secret of Microsoft," and warns that "Microsoft does not grant you any right to implement this Specification."
Predictably, contributors to Slashdot.org, a Linux/Open Source news and community Web site, have already posted the information online, and Microsoft's legal department has sent Slashdot a demand that the information be removed from its servers.
Microsoft is insisting that while the information can be reviewed, no competitor can exploit the published details in order to write code that could make use of it.
"They don't want anyone competing against them," says Paul Hill, co-leader of the Kerberos team at the Massachusetts Institute of Technology (dossier), where the security standard was developed. "It's typical Microsoft behavior."
Microsoft critics have long deplored the company's cavalier attitude toward standards, famously summed up as "embrace, extend and extinguish," a phrase attributed to the current head of the software giant's Windows group, Paul Maritz, during the ongoing Microsoft antitrust trial. The implication is that Microsoft embraces standards that ensure basic interoperability on the Internet but adds proprietary extensions to those standards that make rival systems less interoperable - with the intent of extinguishing competition.
Microsoft's implementation of Kerberos seems a textbook example of this alleged modus operandi. Web specifications typically contain parts that are left undefined, onto which vendors may add their own extensions, allowing for variation in implementation. The version of Kerberos in each Windows 2000 PC formally complies with the standard specification. It also takes advantage of an undefined field in the spec to store authorization data for Microsoft's operating system.
In a paper filed in the antitrust trial on April 28, expert witness Rebecca Henderson, an MIT professor who supported the government's proposed remedy of splitting Microsoft in two, concluded that because Microsoft hadn't published those extensions, "no non-Microsoft server can utilize the security features of the PC operating system."
Microsoft begs to differ, pointing out that it published the extensions on April 27 - timing which it claims is a pure coincidence. The Redmond, Wash., software monolith also argues that its version of Kerberos is fully interoperable.
As proof of its interoperability, Shanen Boettcher, lead product manager for Windows 2000 Server, cites customers such as Morgan Stanley Dean Witter that installed Windows 2000 desktops in a network running an existing Kerberos implementation by a company called CyberSafe (dossier) in Issaquah, Wash. According to Microsoft, the successful installation of its Kerberos implementation alongside CyberSafe's "validates the interoperability of Kerberos in the Windows 2000 operating system."
But this validity depends on the definition of "interoperable." In Microsoft's view, Kerberos interoperability covers only the authentication process (the password system that validates a user's identity), which is defined in the open part of the spec. That interoperability does not, however, extend to the authorization process (the system that decides if a particular user has access to resources on the network), which is the part Microsoft addressed in that carefully guarded undefined field.
Microsoft is treating the authorization process as totally proprietary because authorization to use a Microsoft application requires a Windows 2000 Server. "If you want access rights to applications on Windows, it has to process its own authorization," says Boettcher.
Customers, like Morgan Stanley, that want to access basic functions such as file and print services from Windows 2000 desktops
