Finger

~ the goodbye ~

The command was a name, an at sign and a host. You typed it at a machine you had no account on and no relationship with, and it answered: the person's full name, whether they were currently logged in, how long they had been sitting idle, when they had last read their mail, and the contents of two files out of their home directory. There was no request and no notification to the person being looked up. The answer was public because whoever ran the machine had decided that people on it should be findable.

Les Earnest wrote it at Stanford in 1971. His own account of the name is that users of the WAITS time-sharing system were running a finger down the printed output of the WHO command looking for someone, so he automated the reading. RFC 742 turned it into a protocol in December 1977 and RFC 1288 restated it in December 1991, on TCP port 79, and the whole specification is short enough to read in a sitting.

The interesting half was.plan. It was a text file in your home directory that the server printed back verbatim to anybody who asked, with no length limit and no format, and it became a personal status message about twenty-five years before there was a word for that. Academics put office hours in it and sysadmins put outage notices in it. John Carmack at id Software kept one through the Quake years, and it turned into a primary historical source for how those games were built; the surviving archive of his runs from 1996 into 2010. Long before that end date, the way people read it was a web page that fingered the host on their behalf, which is most of what happened to the protocol in one sentence.

Finger worked in one direction for someone in my position. It assumes you live somewhere, meaning an account on a machine with a permanent name that strangers can reach. In 1998 i had a modem and an address that changed every time the line dropped, which is not a place. There was no host anybody could have fingered me at and no equivalent for a household on a dial-up line, because the protocol was built for the population that had already been assigned an office. You could look outward and never be visible yourself. That is not a Turkish problem specifically, it is a home-user problem, and it arrived everywhere the internet did the moment the internet stopped being made of institutions.

~ the chronicle ~

~ finger coke at cmua ~

In 1982 graduate students in the computer science department at Carnegie Mellon got tired of walking to a Coke machine that was often empty or full of warm bottles. Mike Kazar, David Nichols, John Zsarnay and Ivor Durham wired microswitches into the slots and connected them to a departmental machine, so the count in each column and how long each bottle had been cold could be read remotely.

The part that made it famous is how they exposed it. Rather than writing a client, they modified the finger server to run the status program whenever anybody fingered a user named coke, who did not exist. Finger was already a standard and already reachable from anywhere on the network, so from that moment a person on any machine in the world could check a vending machine in Pittsburgh with a command they already knew. It gets called the first internet appliance and the claim holds up. It was also a fairly precise demonstration of what an open protocol is worth: nobody had to ask permission from anyone to make a new thing answer an old question.

~ what the worm changed ~

On 2 November 1988 the Morris worm spread through several holes at once, and one of them was a buffer overflow in fingerd. The daemon read a request into a fixed-size buffer without checking the length, which was a normal way to write C in 1988 and stopped being one immediately afterward. The response across the network was to turn the service off while people worked out what else was wrong with it, and a good deal of it never came back on.

The security argument was only half of why it died. The other half was that the protocol answered questions that had become uncomfortable to answer. A list of every account on a machine, with real names and idle times, is a starting point for guessing passwords and an excellent starting point for calling somebody's colleague and pretending to be them. Universities that had run it for twenty years as a courtesy shut it down as a liability, and Unix vendors stopped enabling it in their default installs across the nineties. The web then turned up with a directory page that answered the same question while showing only what the institution wanted shown. There is no shutdown date for finger and no announcement, because a protocol does not get one. It ends when enough machines stop answering on the port.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »