Re: Re: Digest Authentication

Manuel Lemos wrote:

I'm not aware of support in either Netscape 6/7 or Mozilla. Care to give a reference?

http://www.mozilla.org/status/2002-08-21.html

Thanks. I was not aware of this activity. As the only information referencing NTLM on this page is dated August 8, I think it is safe to assume that Netscape 6 does not support NTLM nor does any released version of Mozilla, correct? Your initial comments seemed to indicate that they do. However, it does indicate that Mozilla support for this is coming (and exists in the CVS snapshots after August 8), so thanks for the link.

I'm not sure where you get the anti-Microsoft sentiment. Microsoft simply doesn't make a habit of using open standards or opening their own (NTLM, for example). Thus, one can logically conclude that support for Microsoft technologies traditionally lies largely in Microsoft products alone. Yes, there are exceptions (Samba), but no one suggested that NTLM was *only* supported by Microsoft products.

Read your own line:

NTLM authentication is a Microsoft thing and as such is supported by Microsoft products and pretty much no one else.

Yes, as I also just said, "support for Microsoft technologies traditionally lies largely in Microsoft products alone." There are certain words that remove the absoluteness of statements. For example: I always win. != I almost always win. I almost always win. == I pretty much always win. My first comment was very brief, as I assumed most people could infer the longer version quoted above.

If you wish to refute this, please give us a reference to the NTLM specification.

http://www.innovation.ch/java/ntlm.html

The opening sentence of this document proves my point: "This is an attempt at documenting the undocumented NTLM authentication scheme." or this statement: "Since most of this info is reverse-engineered it is bound to contain errors." The point is, while this "attempt at documenting" NTLM might be perfectly accurate, there is no guarantee of that. NTML is a closed "standard," and there is no documented specification for it. To interoperate with many of Microsoft's closed protocols and standards, people are forced to reverse-engineer something. This is exactly what was necessary for Samba to be created. It follows suit that the more difficult it is to create compatible software with a specific protocol or standard, the less software will be created for that particular protocol or standard. Since Microsoft can build software with the benefit of the actual specification, their software is more likely to support it. Happy hacking. Chris