If the statute of limitations was long passed and I had fuck you money, why not?

35 years a later, a clout demon like pg would absolutely be patting himself on the back on x.

Can you elaborate, or suggest a specific paper?

Please expand?

He was and is very smart. This is not disputed. He was 23 at the time. Not exactly a child.

The worm was surprisingly elaborate containing three separate remote exploits.

It probably took a few weeks to build and test.

So sabotaging thousands of at the time very expensive network connected computers was a very deliberate action.

I posit that he likely did it to become famous and perhaps even successful, feeling safe with his dad’s position. And it worked. He did not end up in prison. He ended up cofounding Viaweb and YCombinator.

Unironically a great role model for YC. :/

I talked to the son at one of the early (~2008) YC dinners. Actually found him more approachable than PG or most YC founders; RTM is a nerd in the "cares a whole lot about esoteric mathematics" way, which I found a refreshing change from the "take over the world" vibe that I got from a lot of the rest of YC.

Interesting random factoid: RTM's research in the early 2000s was on Chord [1], one of the earliest distributed hash tables. Chord inspired Kademlia [2], which later went on to power Limewire, Ethereum, and IPFS. So his research at MIT actually has had a bigger impact in terms of collected market cap than most YC startups have.

[1] https://en.wikipedia.org/wiki/Chord_(peer-to-peer)

[2] https://en.wikipedia.org/wiki/Kademlia

RTM Jr is a very nice person, obviously very smart, but also has a good sense of humor and is friendly and approachable. We overlapped as C.S. grad students at Harvard for several years.

I did not. That actually makes everything make much more sense. I was even wordering how he got out of jail time for something like this and just thought he had amazing lawyers.

>MIT really respects good hacks and good hackers.

Oooof in light of Aaron Swartz. He plugged directly into a network switch that was in an unlocked and unlabelled room at MIT so he could download faster and faced "charges of breaking and entering with intent, grand larceny, and unauthorized access to a computer network".

MIT really didn't lift a finger for this either.

>Swartz's attorneys requested that all pretrial discovery documents be made public, a move which MIT opposed

https://en.wikipedia.org/wiki/Aaron_Swartz

Its the other way around, they throw hackers under the bus. Aaron Swartz, Star Simpson arrested for stupid LED brooch, the list is quite long https://news.ycombinator.com/item?id=7411868

MIT faulted over its support for students https://www.bostonglobe.com/metro/2014/02/14/mit/9VBBq9pBQ1z... https://news.ycombinator.com/item?id=7411312

> Would be cool if he adds a session on how to hack distributed system in 1988..

username: field

password: technician

In 1988? Just stick random semicolons in things.

I don't think that's proven out, like, at all; measure it against the returns on hardening mainstream platforms. The "monoculture" security thing has always been overblown, not least because you're never going to get an ecology where you have enough diversity to matter. Having 3 mainstream desktop or phone options is only marginally better than having just 1, and you're never going to have 20.

Slower and unstable. I spent a lot of my freshman year in college on Bitnet chat and iirc about every 30 minutes there would be a "netsplit" and a bunch of folks in the chat would disappear. Maybe it was our universities connection, which I think was direct to UIUC. I've posted here before that back then I thought Bitnet chat was magical. Things like being in a chat room with students in Berlin while the wall was falling felt so futuristic to me.

Much slower. Most campuses in the US were connected with 56K dedicated lines. The NSF backbone had just upgraded to T1.

ftp.wustl.edu would manage about 1 KBps and I was sitting one hop away from it at UIUC.

Insomnia paid off a lot back then.

There's contemporaneous reporting. It's in Katie Hafner and John Markoff's book! A friend of Morris', named Paul, has a role in the aftermath of the worm.

I'm not dunking on Paul Graham here. If you know anything about me, if anything, this is a point in his favor. :)

A quick search shows:

- a github repo containing "the original, de-compiled source code for the Morris Worm" - see https://github.com/agiacalone/morris-worm-malware

- a high level report about the worm - see https://www.ee.torontomu.ca/~elf/hack/internet-worm.html

Interestingly, it took another 7 years for stack overflows to be taken seriously, despite a fairly complete proof of concept widely written about. For years, pretty much everybody slept on buffer overflows of all sorts; if you found an IFS expansion bug in an SUID, you'd only talk about it on hushed private mailing lists with vendor security contacts, but nobody gave a shit about overflows.

It was Thomas Lopatic and 8lgm that really lit a fire under this (though likely they were inspired by Morris' work). Lopatic wrote the first public modern stack overflow exploit, for HPUX NCSA httpd, in 1995. Later that year, 8lgm teased (but didn't publish --- which was a big departure for them) a remote stack overflow in Sendmail 8.6.12 (it's important to understand what a big deal Sendmail vectors were at the time).

That 8lgm tease was what set Dave Goldsmith, Elias Levy, San Mehat, and Pieter Zatko (and presumably a bunch of other people I just don't know) off POC'ing the first wave of public stack overflow vulnerabilities. In the 9-18 months surrounding that work, you could look at basically any piece of privileged code, be it a remote service or an SUID binary or a kernel driver, and instantly spot overflows. It was the popularization with model exploits and articles like "Smashing The Stack" that really raised the alarm people took seriously.

That 7 year gap is really wild when you think about it, because during that time period, during which people jealously guarded fairly dumb bugs, like an errant pipe filter input to the calendar manager service that run by default on SunOS shelling out to commands, you could have owned up literally any system on the Internet, so prevalent were the bugs. And people blew them off!

I wrote a thread about this on Twitter back in the day, and Neil Woods from 8lgm responded... with the 8.6.12 exploit!

https://x.com/tqbf/status/1328433106563588097

I imagine the - heterogeneity of modern computing environments - number of 'layers' in any system - sheer size of the modern Internet all also make it harder to scale

Also worth remember that especially with Internet-connected computers almost everything was multiuser. You did work on the Internet from a shell on a shared Unix server, not from a laptop.