Thursday, August 12, 2004

Let the hairsplitting begin!

Here's a post from Fyodor, commenting on Microsoft's SP2 intentionally breaks programs which use raw sockets, such as NMap, stating that only people writing attack tools use raw sockets.

Fyodor seems puzzled that Microsoft considers NMap an attack tool. Fyodor! Think marketing vice programming! NMap, Nessus, TCPDump, Snort and Apache are probably all considered evil even though only some of them use raw sockets.

Given the interdependency of the libraries, I'm willing to bet the the interface hasn't totally disappeared. Rather it may have been moved, somehow obfuscated, or has obtained a wrapper or somesuch.