Re: injecting packets locally

On Mon, Oct 28, 2002 at 08:54:11AM -0800, mike schiffman wrote:
>
> nmap, under the hood, is an absolute mess. A disaster even.

You seem to state this at every possible opportunity. For example, you offer even harsher criticism of Nmap source at [1]. Why do you spend so much time reading Nmap source code when you have never contributed a line to it? It seems that you use this "absolute mess" under the covers in your own programs. For example, this summer you released LibSF at http://www.packetfactory.net/projects/libsf/ . The web page doesn't mention Nmap at all. Yet inside the tarball is 2198 lines of your source code, plus 13,094 lines from my OS fingerprint database! And what your code part does is implement 7 active OS detection methods. All of these techniques come straight from Nmap -- down to details as trivial as using 1,061,109,567 as the timestamp option value in the TCP header.

The GPL license is clearly stated at the top of nmap-os-fingerprints and including it inside a BSD-licensed library is a violation. I am not trying to be a jerk. It is just that I have spent several years of very tedious work building this database and would like my copyright respected. I sent you a nice private mail to this effect more than 3 months ago, but you dismissed me with a one-line reply. You claimed that you will respect my copyright "in future releases", but none have been forthcoming.

Please consider this a formal request to remove my Nmap fingerprint database from LibSF. After all, Nmap "is an absolute mess. A disaster even." And the code "is awful", "the fallout of poor planning", and "it's pretty much obscene that [nmap] doesn't use libnet". So why would you even want to include this Nmap crap in your libraries?

Thanks,
Fyodor

[1] http://lists.insecure.org/lists/bugtraq/2002/Apr/0430.html