5 ms·

My favorite part of this was: That kind of notation, called SCCS/RCS, is the equivalent of finding a rotary phone in a modern office. Nobody uses it in 2005 Wi

My favorite part of this was: That kind of notation, called SCCS/RCS, is the equivalent of finding a rotary phone in a modern office. Nobody uses it in 2005 Windows kernel code unless their programming background goes back decades, to government and military computing environments — The astrophysics lab I worked at in 2006 was still using svn and had a bunch of Fortran with references to systems from the 70s and 80s. The code ran perfectly well thanks to modern optimizing compilers and having moved from Vax to Linux in the 90s, it was a surprisingly seamless transition. It reminds me of a conference talk I’ve referenced before “do over or make due” basically implying rewriting large amounts of mostly functioning code was not worth the effort if it could be taped together with modern tools.

mzs 5mo ago
I miss the days of knowing who last touched every source file and precisely what version it was: $ what /usr/bin/file /usr/bin/file: PROGRAM:file PROJECT:file-106 $File: apprentice.c,v 1.309 2021/09/24 13:59:19 christos Exp $ $File: apptype.c,v 1.14 2018/09/09 20:33:28 christos Exp $ $File: ascmagic.c,v 1.109 2021/02/05 23:01:40 christos Exp $ $File: buffer.c,v 1.8 2020/02/16 15:52:49 christos Exp $ $File: cdf_time.c,v 1.19 2019/03/12 20:43:05 christos Exp $ $File: cdf.c,v 1.120 2021/09/24 13:59:19 christos Exp $ $File: compress.c,v 1.129 2020/12/08 21:26:00 christos Exp $ $File: der.c,v 1.21 2020/06/15 00:58:10 christos Exp $ $File: encoding.c,v 1.32 2021/04/27 19:37:14 christos Exp $ $File: fsmagic.c,v 1.81 2019/07/16 13:30:32 christos Exp $ $File: funcs.c,v 1.122 2021/06/30 10:08:48 christos Exp $ $File: is_csv.c,v 1.6 2020/08/09 16:43:36 christos Exp $ $File: is_json.c,v 1.15 2020/06/07 19:05:47 christos Exp $ $File: is_tar.c,v 1.44 2019/02/20 02:35:27 christos Exp $ $File: magic.c,v 1.115 2021/09/20 17:45:41 christos Exp $ $File: print.c,v 1.89 2021/06/30 10:08:48 christos Exp $ $File: readcdf.c,v 1.74 2019/09/11 15:46:30 christos Exp $ $File: readelf.c,v 1.178 2021/06/30 10:08:48 christos Exp $ $File: softmagic.c,v 1.315 2021/09/03 13:17:52 christos Exp $ $File: file.c,v 1.190 2021/09/24 14:14:26 christos Exp $ ... WHAT(1) General Commands Manual WHAT(1) NAME what - show what versions of object modules were used to construct a file SYNOPSIS what [-qs] [file ...] DESCRIPTION The what utility searches each specified file for sequences of the form "@(#)" as inserted by the SCCS source code control system. It prints the remainder of the string following this marker, up to a NUL character, newline, double quote, `>' character, or backslash. The following options are available: -q Only output the match text, rather than formatting it. -s Stop searching each file after the first match. EXIT STATUS Exit status is 0 if any matches were found, otherwise 1. SEE ALSO ident(1), strings(1) STANDARDS The what utility conforms to IEEE Std 1003.1-2001 ("POSIX.1"). The -q option is a non-standard FreeBSD extension which may not be available on other operating systems. HISTORY The what command appeared in 4.0BSD. BUGS This is a rewrite of the SCCS command of the same name, and behavior may not be identical. macOS 26.4 December 14, 2006 macOS 26.4
tptacek 5mo ago
Yeah, I used to be skeptical of the government provenance of things like Stuxnet (I am not any more, I'm fully sold, like everyone else), and notes like this were why. People used RCS well into the 2000s! RCS as a tool had virtues over SVN and CVS.
- gucci-on-fleek 5mo ago
  > People used RCS well into the 2000s! I still use RCS today. It's certainly not my preferred option, but my collaborator likes it, and it's not too annoying for me to use.
- codezero 5mo ago
  I do wonder if these breadcrumbs were also left intentionally. “Oh look, we are using old stuff, don’t be afraid!” Or for some other reason. It is a little surprising to pull off such a sophisticated attack and miss details you could find running ‘strings’ unless I’m missing something and this part was encrypted.
  - tptacek 5mo ago
    I think that in the time period we're talking about, RCS wasn't really even all that old. Like, RCS is old, sure, but it was also in common use especially by Unix systems people; it's what you might have reached for by default to version your dotfiles, for instance.
    - codezero 5mo ago
      Yes, but even back then I was aware of the sections in executables (wasn’t this where it was found?) and any neckbeard from the 70s and 80s might be even more so aware. That said, yeah, sure, it’s a very possible and understandable oversight, but I’m weary because of all the text in viruses and such as indicators. Seems like a pass over ‘strings’ would be obvious. Though. TIL, strings doesn’t necessarily scan the entire executable.
      - breppp 5mo ago
drysine 5mo ago
>in 2006 was still using svn Perhaps you meant cvs? Subversion was released in 2004 and git appeared in 2005.
- codezero 5mo ago
  We used cvs, but did switch to svn before/around 2006, but I could be mixing that up. We did not switch to git even by 2012 when I left. The reference to the 70s and 80s code didn’t imply it was version controlled before svn/cvs though if that’s what you meant, but by that time it was and still had old timestamps commented in the text files.
  - drysine 5mo ago
    I just wanted to say that "still using svn in 2006" sounds odd when talking about version control system that existed just for several years and what turned out to be its replacement was 1 year old. gcc, for example, transitioned to subversion in 2006 and switched to git only in 2019 [0] [0] https://gcc.gnu.org/wiki/GitConversion https://gcc.gnu.org/wiki/GitConversion
- mjg59 5mo ago
  Subversion 1.0 was released in 2004, but it was already widely used before then.
hnthrowaway0315 5mo ago
Does that mean that three-letter agencies were/are able to recruit from the fields for each type of malware? For example, fast16 might actually be written by someone who used to write scientific calculation software, while Stunex was written by someone who used to work for Siemens?
- eth0up 5mo ago
  Try to remember how hypothetical everything tended to be before Snowden. And 'twas a meager pittance that was revealed. They have toys that'd blow minds and people yee'd swear weren't people. It's all fun and games to poke fun, but holy shit those guys are NTBF'dW. Every academic institution, every school, all under the radar of recruitment and more. It's difficult to believe, but the network is real. There are certainly people here on HN who've been solicited, most who'll never mention it. It's fun to imagine, though, what tight groups of highly motivated, stupidly intelligent people can do when they collectively commit to doing so - and with a hefty budget to assist.
  - Schlagbohrer 5mo ago
    Fun to imagine that and painful to think of what we could have if such efforts and budgets were put toward education, healthcare, social welfare, public infrastructure + reliability, etc. But then I am getting too utopian
    - eth0up 5mo ago
      Exactly. But there's ideology, and there's reality. You know how pervasive and colossal the black budget is. We could be, as a society, almost unimaginably advanced of where we are, sans such things, sans the modern patent system, sans greed, sans corruption. But we are, precisely where we are Edit: I thought it prudent to leave a reminder, that the US military operates beyond patent regulations. If they want or need something, the silly games end there. And they do what they will.
- mike_d 5mo ago
  Don't think of it as a materials simulation engineer being recruited and trained on how to write complex malware. Rather this was developed by a team of 6-8 people. Maybe two or three of them working on the implant, another engineer handling the exploits and propagation, and yet another building the LP and communications channels. They are supported by a scientist with deep knowledge of the process they are messing around with (say developing nuclear weapons), and a mathematician that knows how to introduce subtle and undetectable errors.
beejiu 5mo ago
If you're using R in 2026, you're probably invoking code compiled from Fortran from the 70s/80s somewhere along the line. It's a foundation for a lot of numerical computing.
- jmalicki 5mo ago
  Same for SciPy (At least the last time I dove into it around 10 years ago). A lot of the C code you see for numerics is a straight up f2c run checked in.
kimixa 5mo ago
Ha, I worked for a company that until ~2012 still used RCS-backed SCM, absolute hack job on a shared file share that wrapped RCS with a "project file" to allow a tree of specific revisions for a "project". "MKS" it was called. And by the sound of it the "old" '90s version, not the java EE rewrite. That meant the files has the entire "$Revision: 1.3 $" nonsense and "file changelog" at the top too - though many newer files never bothered to include the tags to actually get RCS to replace them. Inconsistent as hell. And while the "family" of devices the software was for traces it's origin to the mid '90s, functionally none of the code was older than ~5 years at that time. Naturally even with only a few tens of engineers it regularly messed up, commits stepped on each other's toes and the entire tree got corrupted regularly. For fun I wrote a script that read it all and imported the entire history into git - you only had to go back a few years before the entire thing was absolute nonsense. I have no idea why that was still being used then, but I assume it had been in use from the very start of that entire hardware family. Perhaps as it was fundamentally a "hardware" company - which until surprisingly recently seemed to consider "source control" to be "shared folders on remote machines" - "software" source control wasn't considered a priority.
- anthk 5mo ago
  RCS->CVS and from that you can convert it to GIT or SVN.
  - kimixa 5mo ago
    The issue was the rcs files were simply corrupt - no matter what tool you used the older deltas were just bad. Just people didn't notice/care as they were "old" revisions. And I couldn't find any tool that supported the mks "project" files that linked multiple rcs revisions into a single "commit", so something a little custom was needed anyway. At least for the ancient mks version used. Quite a bit of effort was put into it during the "official" migration, but they eventually gave up too as even the oldest backup archives they could find had the same issues.
hackrmn 5mo ago
Re-factoring code is a _panacea_ -- it's more likely factors that contributed to the code needing re-factoring in the first place, are very much in place still to contribute to the same condition repeating eventually, and another round you go. The factors that produce the causes of re-factoring, usually border on psychological causes embedded deeply within the brains of the developer or developers that are owners of the code. Habits, beliefs, convictions, even "professional traumas". Related here is Conway's Law, where the team, for all individual capacity and capability, cannot but build software that mimics the structure of the developers' ultimate (larger) organisation, thus tying the success of the former to the success of the latter. Re-factoring will only largely repeat the outcome if the organisation hasn't changed. The exception being obviously a team approaching someone else's codebase -- including that of their predecessor, if they can factor in for Conway's Law -- to re-factor it. But the same person or persons announcing re-factoring? I always try to walk away from those discussions, knowing very well they're just going to build a better mouse trap. For themselves. Don't get me wrong, iteration of your own then-brain's product is all well and good, but it takes _more_ to escape the carousel. It takes sitting down and noting down primary factors driving poor architecture and taking a long hard look in the mirror. Not everything is subjective or equivalent, as much as many a developer would like to believe. It's very attractive to stick to "as long as we're careful and diligent, even sub-optimal design can be implemented well". No, it won't be -- this one is a poster-child exception to the rule if there ever was one -- your _design_ is the root and from it and it alone springs the tree that you'll need to accept or cut down, and trimming it only does so much.
- Schlagbohrer 5mo ago
  Did you mean to say placebo? A panacea is a cure-all. So if code refactoring is a panacea then we should refactor code often.
  - hackrmn 5mo ago
    I mean to write "not a panacea", my bad. That it's not the universal cure people think it is. And people _do_ think that re-factoring will magically solve problems, while it doesn't do all that much in practice, less so when you factor in the costs spent on re-factoring.

mzs 5mo ago

I miss the days of knowing who last touched every source file and precisely what version it was: $ what /usr/bin/file /usr/bin/file: PROGRAM:file PROJECT:file-106 $File: apprentice.c,v 1.309 2021/09/24 13:59:19 christos Exp $ $File: apptype.c,v 1.14 2018/09/09 20:33:28 christos Exp $ $File: ascmagic.c,v 1.109 2021/02/05 23:01:40 christos Exp $ $File: buffer.c,v 1.8 2020/02/16 15:52:49 christos Exp $ $File: cdf_time.c,v 1.19 2019/03/12 20:43:05 christos Exp $ $File: cdf.c,v 1.120 2021/09/24 13:59:19 christos Exp $ $File: compress.c,v 1.129 2020/12/08 21:26:00 christos Exp $ $File: der.c,v 1.21 2020/06/15 00:58:10 christos Exp $ $File: encoding.c,v 1.32 2021/04/27 19:37:14 christos Exp $ $File: fsmagic.c,v 1.81 2019/07/16 13:30:32 christos Exp $ $File: funcs.c,v 1.122 2021/06/30 10:08:48 christos Exp $ $File: is_csv.c,v 1.6 2020/08/09 16:43:36 christos Exp $ $File: is_json.c,v 1.15 2020/06/07 19:05:47 christos Exp $ $File: is_tar.c,v 1.44 2019/02/20 02:35:27 christos Exp $ $File: magic.c,v 1.115 2021/09/20 17:45:41 christos Exp $ $File: print.c,v 1.89 2021/06/30 10:08:48 christos Exp $ $File: readcdf.c,v 1.74 2019/09/11 15:46:30 christos Exp $ $File: readelf.c,v 1.178 2021/06/30 10:08:48 christos Exp $ $File: softmagic.c,v 1.315 2021/09/03 13:17:52 christos Exp $ $File: file.c,v 1.190 2021/09/24 14:14:26 christos Exp $ ... WHAT(1) General Commands Manual WHAT(1) NAME what - show what versions of object modules were used to construct a file SYNOPSIS what [-qs] [file ...] DESCRIPTION The what utility searches each specified file for sequences of the form "@(#)" as inserted by the SCCS source code control system. It prints the remainder of the string following this marker, up to a NUL character, newline, double quote, `>' character, or backslash. The following options are available: -q Only output the match text, rather than formatting it. -s Stop searching each file after the first match. EXIT STATUS Exit status is 0 if any matches were found, otherwise 1. SEE ALSO ident(1), strings(1) STANDARDS The what utility conforms to IEEE Std 1003.1-2001 ("POSIX.1"). The -q option is a non-standard FreeBSD extension which may not be available on other operating systems. HISTORY The what command appeared in 4.0BSD. BUGS This is a rewrite of the SCCS command of the same name, and behavior may not be identical. macOS 26.4 December 14, 2006 macOS 26.4

tptacek 5mo ago

Yeah, I used to be skeptical of the government provenance of things like Stuxnet (I am not any more, I'm fully sold, like everyone else), and notes like this were why. People used RCS well into the 2000s! RCS as a tool had virtues over SVN and CVS.

gucci-on-fleek 5mo ago
> People used RCS well into the 2000s! I still use RCS today. It's certainly not my preferred option, but my collaborator likes it, and it's not too annoying for me to use.
codezero 5mo ago
I do wonder if these breadcrumbs were also left intentionally. “Oh look, we are using old stuff, don’t be afraid!” Or for some other reason. It is a little surprising to pull off such a sophisticated attack and miss details you could find running ‘strings’ unless I’m missing something and this part was encrypted.
- tptacek 5mo ago
  I think that in the time period we're talking about, RCS wasn't really even all that old. Like, RCS is old, sure, but it was also in common use especially by Unix systems people; it's what you might have reached for by default to version your dotfiles, for instance.
  - codezero 5mo ago
    Yes, but even back then I was aware of the sections in executables (wasn’t this where it was found?) and any neckbeard from the 70s and 80s might be even more so aware. That said, yeah, sure, it’s a very possible and understandable oversight, but I’m weary because of all the text in viruses and such as indicators. Seems like a pass over ‘strings’ would be obvious. Though. TIL, strings doesn’t necessarily scan the entire executable.
    - breppp 5mo ago

drysine 5mo ago

>in 2006 was still using svn Perhaps you meant cvs? Subversion was released in 2004 and git appeared in 2005.

codezero 5mo ago
We used cvs, but did switch to svn before/around 2006, but I could be mixing that up. We did not switch to git even by 2012 when I left. The reference to the 70s and 80s code didn’t imply it was version controlled before svn/cvs though if that’s what you meant, but by that time it was and still had old timestamps commented in the text files.
- drysine 5mo ago
  I just wanted to say that "still using svn in 2006" sounds odd when talking about version control system that existed just for several years and what turned out to be its replacement was 1 year old. gcc, for example, transitioned to subversion in 2006 and switched to git only in 2019 [0] [0] https://gcc.gnu.org/wiki/GitConversion https://gcc.gnu.org/wiki/GitConversion
mjg59 5mo ago
Subversion 1.0 was released in 2004, but it was already widely used before then.

hnthrowaway0315 5mo ago

Does that mean that three-letter agencies were/are able to recruit from the fields for each type of malware? For example, fast16 might actually be written by someone who used to write scientific calculation software, while Stunex was written by someone who used to work for Siemens?

eth0up 5mo ago
Try to remember how hypothetical everything tended to be before Snowden. And 'twas a meager pittance that was revealed. They have toys that'd blow minds and people yee'd swear weren't people. It's all fun and games to poke fun, but holy shit those guys are NTBF'dW. Every academic institution, every school, all under the radar of recruitment and more. It's difficult to believe, but the network is real. There are certainly people here on HN who've been solicited, most who'll never mention it. It's fun to imagine, though, what tight groups of highly motivated, stupidly intelligent people can do when they collectively commit to doing so - and with a hefty budget to assist.
- Schlagbohrer 5mo ago
  Fun to imagine that and painful to think of what we could have if such efforts and budgets were put toward education, healthcare, social welfare, public infrastructure + reliability, etc. But then I am getting too utopian
  - eth0up 5mo ago
    Exactly. But there's ideology, and there's reality. You know how pervasive and colossal the black budget is. We could be, as a society, almost unimaginably advanced of where we are, sans such things, sans the modern patent system, sans greed, sans corruption. But we are, precisely where we are Edit: I thought it prudent to leave a reminder, that the US military operates beyond patent regulations. If they want or need something, the silly games end there. And they do what they will.
mike_d 5mo ago
Don't think of it as a materials simulation engineer being recruited and trained on how to write complex malware. Rather this was developed by a team of 6-8 people. Maybe two or three of them working on the implant, another engineer handling the exploits and propagation, and yet another building the LP and communications channels. They are supported by a scientist with deep knowledge of the process they are messing around with (say developing nuclear weapons), and a mathematician that knows how to introduce subtle and undetectable errors.

beejiu 5mo ago

If you're using R in 2026, you're probably invoking code compiled from Fortran from the 70s/80s somewhere along the line. It's a foundation for a lot of numerical computing.

jmalicki 5mo ago
Same for SciPy (At least the last time I dove into it around 10 years ago). A lot of the C code you see for numerics is a straight up f2c run checked in.

kimixa 5mo ago

Ha, I worked for a company that until ~2012 still used RCS-backed SCM, absolute hack job on a shared file share that wrapped RCS with a "project file" to allow a tree of specific revisions for a "project". "MKS" it was called. And by the sound of it the "old" '90s version, not the java EE rewrite. That meant the files has the entire "$Revision: 1.3 $" nonsense and "file changelog" at the top too - though many newer files never bothered to include the tags to actually get RCS to replace them. Inconsistent as hell. And while the "family" of devices the software was for traces it's origin to the mid '90s, functionally none of the code was older than ~5 years at that time. Naturally even with only a few tens of engineers it regularly messed up, commits stepped on each other's toes and the entire tree got corrupted regularly. For fun I wrote a script that read it all and imported the entire history into git - you only had to go back a few years before the entire thing was absolute nonsense. I have no idea why that was still being used then, but I assume it had been in use from the very start of that entire hardware family. Perhaps as it was fundamentally a "hardware" company - which until surprisingly recently seemed to consider "source control" to be "shared folders on remote machines" - "software" source control wasn't considered a priority.

anthk 5mo ago
RCS->CVS and from that you can convert it to GIT or SVN.
- kimixa 5mo ago
  The issue was the rcs files were simply corrupt - no matter what tool you used the older deltas were just bad. Just people didn't notice/care as they were "old" revisions. And I couldn't find any tool that supported the mks "project" files that linked multiple rcs revisions into a single "commit", so something a little custom was needed anyway. At least for the ancient mks version used. Quite a bit of effort was put into it during the "official" migration, but they eventually gave up too as even the oldest backup archives they could find had the same issues.

hackrmn 5mo ago

Re-factoring code is a _panacea_ -- it's more likely factors that contributed to the code needing re-factoring in the first place, are very much in place still to contribute to the same condition repeating eventually, and another round you go. The factors that produce the causes of re-factoring, usually border on psychological causes embedded deeply within the brains of the developer or developers that are owners of the code. Habits, beliefs, convictions, even "professional traumas". Related here is Conway's Law, where the team, for all individual capacity and capability, cannot but build software that mimics the structure of the developers' ultimate (larger) organisation, thus tying the success of the former to the success of the latter. Re-factoring will only largely repeat the outcome if the organisation hasn't changed. The exception being obviously a team approaching someone else's codebase -- including that of their predecessor, if they can factor in for Conway's Law -- to re-factor it. But the same person or persons announcing re-factoring? I always try to walk away from those discussions, knowing very well they're just going to build a better mouse trap. For themselves. Don't get me wrong, iteration of your own then-brain's product is all well and good, but it takes _more_ to escape the carousel. It takes sitting down and noting down primary factors driving poor architecture and taking a long hard look in the mirror. Not everything is subjective or equivalent, as much as many a developer would like to believe. It's very attractive to stick to "as long as we're careful and diligent, even sub-optimal design can be implemented well". No, it won't be -- this one is a poster-child exception to the rule if there ever was one -- your _design_ is the root and from it and it alone springs the tree that you'll need to accept or cut down, and trimming it only does so much.

Schlagbohrer 5mo ago
Did you mean to say placebo? A panacea is a cure-all. So if code refactoring is a panacea then we should refactor code often.
- hackrmn 5mo ago
  I mean to write "not a panacea", my bad. That it's not the universal cure people think it is. And people _do_ think that re-factoring will magically solve problems, while it doesn't do all that much in practice, less so when you factor in the costs spent on re-factoring.