Better late than never? Perhaps, but Microsoft has attached restrictions to the Web site where the details are published, essentially locking down the information. Anyone trying to download the file must first agree to a licensing agreement that labels the material "confidential information and a trade secret of Microsoft," and warns that "Microsoft does not grant you any right to implement this Specification."

Predictably, contributors to Slashdot.org, a Linux/Open Source news and community Web site, have already posted the information online, and Microsoft's legal department has sent Slashdot a demand that the information be removed from its servers.

Microsoft is insisting that while the information can be reviewed, no competitor can exploit the published details in order to write code that could make use of it.

"They don't want anyone competing against them," says Paul Hill, co-leader of the Kerberos team at the Massachusetts Institute of Technology , where the security standard was developed. "It's typical Microsoft behavior."

Microsoft critics have long deplored the company's cavalier attitude toward standards, famously summed up as "embrace, extend and extinguish," a phrase attributed to the current head of the software giant's Windows group, Paul Maritz, during the ongoing Microsoft antitrust trial. The implication is that Microsoft embraces standards that ensure basic interoperability on the Internet but adds proprietary extensions to those standards that make rival systems less interoperable - with the intent of extinguishing competition.

Microsoft's implementation of Kerberos seems a textbook example of this alleged modus operandi. Web specifications typically contain parts that are left undefined, onto which vendors may add their own extensions, allowing for variation in implementation. The version of Kerberos in each Windows 2000 PC formally complies with the standard specification. It also takes advantage of an undefined field in the spec to store authorization data for Microsoft's operating system.

In a paper filed in the antitrust trial on April 28, expert witness Rebecca Henderson, an MIT professor who supported the government's proposed remedy of splitting Microsoft in two, concluded that because Microsoft hadn't published those extensions, "no non-Microsoft server can utilize the security features of the PC operating system."

Microsoft begs to differ, pointing out that it published the extensions on April 27 - timing which it claims is a pure coincidence. The Redmond, Wash., software monolith also argues that its version of Kerberos is fully interoperable.

As proof of its interoperability, Shanen Boettcher, lead product manager for Windows 2000 Server, cites customers such as Morgan Stanley Dean Witter that installed Windows 2000 desktops in a network running an existing Kerberos implementation by a company called CyberSafe in Issaquah, Wash. According to Microsoft, the successful installation of its Kerberos implementation alongside CyberSafe's "validates the interoperability of Kerberos in the Windows 2000 operating system."

But this validity depends on the definition of "interoperable." In Microsoft's view, Kerberos interoperability covers only the authentication process , which is defined in the open part of the spec. That interoperability does not, however, extend to the authorization process , which is the part Microsoft addressed in that carefully guarded undefined field.

Microsoft is treating the authorization process as totally proprietary because authorization to use a Microsoft application requires a Windows 2000 Server. "If you want access rights to applications on Windows, it has to process its own authorization," says Boettcher.

Customers, like Morgan Stanley, that want to access basic functions such as file and print services from Windows 2000 desktops must purchase and run a Microsoft Windows 2000 Kerberos Server, even if they already have another Kerberos implementation in use.

For Hill, that amounts to Microsoft gratuitously tying the desktop to the server.

"Microsoft has created a system that forces Morgan Stanley and many other government and academic institutions to run Microsoft servers," he says. "These organizations now have to duplicate essentially the same data into two separate systems."

As Hill sees it, this way of implementing Kerberos shatters the notion of an interoperable "standard." And the licensing restrictions Microsoft has imposed on publishing the data-field information mean that it still isn't a standard at all.

"It's a clear demonstration that Microsoft has no intention of changing its business practices," says Hill. "It's using its monopoly on the desktop to force people to use its server."

Meanwhile, the Open Source geeks who published the material on Slashdot in violation of Microsoft's license are up against the same Digital Millenium Copyright Act that brought Napster to heel. Claiming copyright violation, Microsoft has asked Slashdot for "immediate action to remove the cited violations" from its servers.

Slashdot is crying censorship and is consulting its lawyers before commenting further, but Microsoft is dismissing any First Amendment arguments.

"It's not about free speech. We're not asking for people's comments to be pulled down," says Microsoft spokesperson Adam Sohn, "It's the manner in which the [copyrighted information] is being distributed that we're asking Slashdot to address."

The fracas, which has generated enough protest posts to slow down the Slashdot servers, does raise a puzzling question. Why does Microsoft believe that the thing to do with "confidential information and a trade secret" is to publish it on the Internet?

Perhaps the answer lies in the fact that, as early as 1998, Microsoft executives made a public commitment to publish the Kerberos details. Now Microsoft can claim that - in its own way - it has met that commitment.