Re: Re: Digest Authentication

Hello, On 08/22/2002 09:18 PM, Chris Shiflett wrote:

I'm not aware of support in either Netscape 6/7 or Mozilla. Care to give a reference?

http://www.mozilla.org/status/2002-08-21.html

Thanks. I was not aware of this activity. As the only information referencing NTLM on this page is dated August 8, I think it is safe to assume that Netscape 6 does not support NTLM nor does any released version of Mozilla, correct? Your initial comments seemed to indicate

What I meant is that Mozilla which is indeed the same program just bundled differently from Netscape 6/7 have the support for this.

that they do. However, it does indicate that Mozilla support for this is coming (and exists in the CVS snapshots after August 8), so thanks for the link.

Actually the feature is older but was not as complete and tested as it is now that the developer released it as official. Look in the Bugzilla report history.

I'm not sure where you get the anti-Microsoft sentiment. Microsoft simply doesn't make a habit of using open standards or opening their own (NTLM, for example). Thus, one can logically conclude that support for Microsoft technologies traditionally lies largely in Microsoft products alone. Yes, there are exceptions (Samba), but no one suggested that NTLM was *only* supported by Microsoft products.

Read your own line:

NTLM authentication is a Microsoft thing and as such is supported by Microsoft products and pretty much no one else.

Yes, as I also just said, "support for Microsoft technologies traditionally lies largely in Microsoft products alone." There are certain words that remove the absoluteness of statements. For example: I always win. != I almost always win. I almost always win. == I pretty much always win. My first comment was very brief, as I assumed most people could infer the longer version quoted above.

The way you have put it, it sounded as if this authentication method is only useful if you use only Microsoft products alone, which is not true. Maybe you should have been clearer.

If you wish to refute this, please give us a reference to the NTLM specification.

http://www.innovation.ch/java/ntlm.html

The opening sentence of this document proves my point: "This is an attempt at documenting the undocumented NTLM authentication scheme." or this statement: "Since most of this info is reverse-engineered it is bound to contain errors." The point is, while this "attempt at documenting" NTLM might be perfectly accurate, there is no guarantee of that. NTML is a closed "standard," and there is no documented specification for it. To interoperate with many of Microsoft's closed protocols and standards, people are forced to reverse-engineer something. This is exactly what was necessary for Samba to be created. It follows suit that the more difficult it is to create compatible software with a specific protocol or standard, the less software will be created for that particular protocol or standard. Since Microsoft can build software with the benefit of the actual specification, their software is more likely to support it.

Personally I do not care for the rhetoric. What I care is that with this reverse engineered information it was possible to build Samba and HTTP NTLM authetication modules that make viable for non-Microsoft products be used in applications where PHP can be used as a viable solution, thus providing job opportunities for many people like us that have been working mostly with PHP. -- Regards, Manuel Lemos