Unix v4 (1973) – Live Terminal
109 points
4 hours ago
| 11 comments
| unixv4.dev
| HN
mmastrac
1 hour ago
[-]
If whoever wrote this wants to add an authentic (and somewhat period correct) terminal front-end, I wrote a VT420 hardware emulator that works in the browser and we can wire them together!

https://mmastrac.github.io/blaze/

(the API is undocumented but stupidly simple: an async js_read() function and a sync js_write() function)

reply
dboreham
14 minutes ago
[-]
You'll want VT-52 for this era.
reply
Deeg9rie9usi
3 hours ago
[-]
Reading the source unearths interesting things: https://sigma-star.at/blog/2025/12/unix-v4-buffer-overflow/
reply
mmooss
30 minutes ago
[-]
> the knowledge that a buffer overflow could be exploited for arbitrary code execution had not yet come of age.

Meaning, people hadn't figured that out, or it wasn't a commonplace technique? They must have seen buffer overflows crash running software; it doesn't take much imagination to think about the next steps.

reply
dboreham
7 minutes ago
[-]
Most computers did not exist in an adversarial environment at the time.

Perhaps the most "adversarial" context would be: undergraduate timeshare use. So the mainframes of the day, which would be the typical platform for undergrad programming (if timeshare was even offered to undergrads in 1973) might be expected to be somewhat hardened to attacks of various kinds since undergrads trying to hack their grade higher, get more CPU time, etc, was a known thing.

But Unix machines, and minicomputers in general, were not used for undergrad purposes. They were only available to be used by PhD candidates and other higher order beings. Those dudes had the root password anyway, so no need to harden the machine against their potential attacks. There was no networking to speak of, so no malicious traffic to worry about. The first worm didn't appear until the late 1980s.

So if you had talked to a Unix sysadmin in 1973 (all...1 of them) they probably would understand the general concept of someone running a program that crapped onto kernel memory with the result they could have root privileges, but there would have been no plausible adversary around with any reason to mount that attack. Plus every cycle and every byte counted, so there would have been many more fish to fry before worrying about buffer overflow problems.

reply
mananaysiempre
2 hours ago
[-]
I kept expecting an exploit :) Something to poke at on a slow evening, I guess, though with the buffer in static memory it might be difficult.
reply
Deeg9rie9usi
2 hours ago
[-]
Exploiting this is close to trivial because the adjacent buffer contains the pw entry. So, you can control what the input is compared with. That way the password check can be bypassed without injecting code.
reply
mananaysiempre
1 hour ago
[-]
Good point, thanks! The crypt() of the input, not the input itself, but guessing at the (PDP-11 assembly :/ ) code for crypt() a bit, it looks like it stops after 64 characters if it can’t find a null terminator before that, so

  0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef012345678901234567890123456789012345root:p3Y0ydAx:
should work as an exploit, and indeed it does. (Arbitrary 64-character password, then 36 bytes to pad to the end of the 100-byte buffer, then the part of root’s /etc/passwd entry for said password until at least the second colon.)
reply
Aperocky
2 hours ago
[-]
I wonder how hard is it to do the entire thing in browser/js. It seems hugged to death right now due to backend connections.
reply
PunchyHamster
56 minutes ago
[-]
people ran linux and win 95 in browser, would be fine
reply
publicdebates
4 hours ago
[-]

    Session Error
    Rate limit exceeded: 10 per 1 minute
reply
hnthrowaway0315
3 hours ago
[-]
I managed to get in after a few tries. But then I got a timeout. I think I'm going to wait until the HN deathhug is over :D
reply
dim13
2 hours ago
[-]
Glad to have played with it a bit before it got Slashdotted. ;)
reply
ramon156
3 hours ago
[-]
Rate limited! a new record!
reply
yunnpp
2 hours ago
[-]
I'm going to guess we're on the same VPN.
reply
enricotr
3 hours ago
[-]
Almost slashdotted.
reply
TZubiri
2 hours ago
[-]
Getting a rate limit error, but I haven't used the program.
reply
timzaman
50 minutes ago
[-]
death by hn..
reply
colesantiago
4 hours ago
[-]
Just a heads up:

> By using this service, you acknowledge that terminal sessions may be logged for educational and debugging purposes. No personal data is collected beyond your IP address.

Is this all open source and is the code available? So that we know where the data is truly going?

Hard to trust it if it isn't fully OSS.

This is a cool demo though.

reply
mmooss
39 minutes ago
[-]
It would be an excellent phishing attack if your target is senior IT. You filter out every non-geek, of course, and certainly your responses would lean heavily toward an older crowd. They's all see 'Unix v4', be too excited to consider the risks, and being a 1973 OS assume it is innocent and safe (not thinking about the platform delivering it).

Maybe you'd get too many retirees ...

Now you just need

reply
altairprime
3 hours ago
[-]
> Hard to trust it

Clarification requested: How is ‘trust’ applicable to this site?

reply
voidfunc
4 hours ago
[-]
Even if it was open source how do you know its not a fork?
reply
lo_zamoyski
3 hours ago
[-]
And even more to the point: this is a website. What is he afraid of this website doing that all the other websites don't already do? Why single this one out?
reply
qarl
3 hours ago
[-]
WARNING: YOU ARE ABOUT TO OPEN A WEBPAGE.
reply
derrida
2 hours ago
[-]
Exception: -1 Page already opened. Time can only flow forward.
reply
StableAlkyne
3 hours ago
[-]
> Hard to trust it if it isn't fully OSS

It's an emulated PDP-11, could you elaborate on the threat model here?

I get that companies are being gross about logging everything online, but come on. It's okay to have fun.

Who in their right mind is using this for anything other than curiosity's sake?

reply
utopiah
3 hours ago
[-]
Little bit of banking on an emulator on a random website, why not?
reply
cocodill
3 hours ago
[-]
bitcoin will not be mined on its own.
reply
znpy
2 hours ago
[-]
Yeah it’s unlikely that this site will collect any meaningful data and it’s unlikely that you lose any meaningful data by playing with a virtual unix from the 70ies.

You aren’t getting downvoted enough.

reply
charcircuit
4 hours ago
[-]
Did they get a license from Novell for this or is this as illegal as many of the other emulator sites with copyrighted software on them? Considering the page doesn't mention it, I'm leaning towards it being copyright infringement.
reply
LukeShu
3 hours ago
[-]
In 2002, Caldera licensed Research Unix <= 7th edition and 32-bit 32V Unix under a BSD-style license.

Gotta stick the "This product includes software developed or owned by Caldera International, Inc." notice on it though.

reply
charcircuit
3 hours ago
[-]
This copy of Unix v4 came from AT&T and not one of the freely licensed ones Caldera released. Caldera may own the rights now for this unearthed copy, but I am not aware that they have provided licenses for this new release.
reply
spijdar
2 hours ago
[-]
If your argument is that Caldera might not actually have the rights to UNIX in the first place to grant the license, that's fair.

But the license they provided (http://www.lemis.com/grog/UNIX/ancient-source-all.pdf) explicitly names versions 1, 2, 3, 4, 5, 6, and 7 of UNIX for the 16-bit PDP-11. Yes, these versions originated at AT&T (Bell Labs) but are distinct legally from SysIII and SysV UNIX, also from AT&T, which are explicitly not covered by the Caldera license.

reply
charcircuit
2 hours ago
[-]
Thank you for finding this.

>Redistributions of source code and documentation must retain the above copyright notice

The archived tape doesn't have this, which contradicts the license. This makes me think the license may only be referring to a set of source code that they released with this license text already applied as opposed to what was recently archived.

>Redistributions in binary form must reproduce the above copyright notice

I don't see the copyright notice on that page. So at the very least that may need to be added.

reply
dekhn
5 minutes ago
[-]
Why do you care about this so much?
reply
charcircuit
11 seconds ago
[-]
Because I think the history of rights ownership and licensing is interesting.
reply
publicdebates
2 hours ago
[-]
What do you think about GOG?
reply
charcircuit
2 hours ago
[-]
It's good to have competition against Steam.
reply
yunnpp
2 hours ago
[-]
GOG is perfectly legal.
reply
fortyseven
3 hours ago
[-]
Personal financial stake in this, or do you regularly police the use of ancient software?
reply
charcircuit
3 hours ago
[-]
>Personal financial stake in this

In the sense that the company I work for would be financially harmed if copyright infringement of software was freely allowed. I benefit from the ability of people being able to sell rights to use software.

It's one thing to digitize and archive ancient software, it's another thing to allow people to freely use it without acquiring the proper license for it.

reply
kube-system
26 minutes ago
[-]
I’m normally one defending copyright on this forum. But dude, this software is half a century old. Nobody is buying or selling this software. Nobody’s business or livelihood is threatened by this.
reply
II2II
1 hour ago
[-]
The people who preserve vintage software typically respect boundaries in order to avoid cases where the copyright holder would be financially harmed. It is not a perfect guarantee, but it is a reasonable one.

Hardline stances usually cause more harm than good anyhow. I remember collecting Apple II gear in the late 1990's and early 2000's. The people saying that any form of copyright infringement was bad were either ignored or flamed since a lot of people just looked at their collection of software from the late 1970's and early 1980's and said, "we're at risk of losing this if we don't make it available, and the copyright holders won't lose anything if we do make it available." Which wasn't strictly true since there were some software developers who created software in the early 1990's who were still selling it. Unfortunately their absolutist attitude did not earn them many allies, so it became a lost cause.

reply
LastTrain
2 hours ago
[-]
I mean if you are assigning points I’d actually say the former is worse than the latter.
reply