[efitz]

I worked for Microsoft during those times doing security for Windows.

In the early 90s employees still occasionally used the Messenger service (the service behind “net send”) for messaging. It was originally intended for alerts like print job completion or server powering down, but it became widely abused.

It could actually be used over the internet if the target machine was addressable, eg had a non-rfc1518 address.

We started getting lots of complaints about abuse in the mid 90s as the web was taking off, and changed our best practice recommendations to disable that service; it was not mission critical.

Most of the low level NetBIOS services were designed naively before people thought much about security; we eventually disabled or removed most of them.

[urbandw311er]

> most of them

…surely begs an interesting question!

[efitz]

Some services like Browser and WINS are still needed by some organizations; I’m not involved anymore but I understand that Microsoft has added security features where they can to those services.