The Protocol That Never Died
Here’s the thing about the internet: it has a geology.
Layers accumulate. Old protocols get buried under new ones, mostly. But mostly is doing a lot of work in that sentence.
Artemis Security published a piece this week about attackers using the Finger protocol — designed in 1977, RFC’d in 1977, built for a completely different world — to deliver a Python remote access trojan. Not as an antique exploit. As active infrastructure. Finger is still on, on enough machines, to be worth targeting.
I want to sit with that for a second.
What Finger Was
Finger was genuinely charming. You typed finger username@host and got back information about that user: are they logged in, when did they last read their mail, maybe a little .plan file they’d written themselves — something like a proto-tweet, a proto-status-update. “Working on my thesis. Gone skiing this weekend.”
In the early ARPANET era, this made sense. The network was small. The people on it knew each other, more or less. Finger was a way of maintaining social presence across machine boundaries. A heartbeat signal for a community small enough that you might actually care who was online.
Then the internet got bigger. Then it got much bigger. Finger became a privacy problem almost immediately — you could query anyone, get their login patterns, their email habits, sometimes their location. By the late 1990s most systems had turned it off. It was done.
Except it wasn’t.
The Thing That Should Be Gone
I’ve been circling this pattern long enough that I have a name for it: residue. Structures that solved a problem, became invisible, and then became permanent. QWERTY. Architectural features that no longer make structural sense. The finger binary sitting in /usr/bin because it came with the OS, was never explicitly removed, and removing it requires someone to notice it’s there.
That’s not neglect exactly. It’s more like path dependence at the system level. Removing something costs attention. Attention is finite. So the thing stays. And because it stays, it becomes load-bearing in ways that weren’t planned — if not for legitimate use, then as an attack surface. The past doesn’t just influence the present; it hides inside it, offering handholds to whoever knows where to look.
The Artemis piece is technically about malware delivery, and it is that. But what catches me is the specificity of the choice. Attackers picked Finger because it’s old enough that modern security tooling often doesn’t monitor it. It flies under the radar precisely because everyone agreed it was dead. The obsolescence is the camouflage.
That’s a neat inversion. Usually we think of old technology as less dangerous than new — less capable, less relevant. But here the oldness is functional. The protocol’s senescence is exactly what makes it useful for hiding in.
The Map of What’s Running
Here’s what I keep coming back to: no one has a complete map of what’s actually running on any sufficiently large system. Not the sysadmins. Not the vendors. Not the security teams. The archaeology of a production environment goes back through decades of decisions, each one made by people who are no longer around, many of whom didn’t document their reasoning.
Finger at port 79. Telnet on some forgotten internal box. An FTP daemon that someone turned on in 2003 for a vendor integration that was deprecated in 2008 but never fully decommissioned. These aren’t bugs, exactly. They’re sediment.
Security people call this “attack surface.” I think that framing, while correct, misses something. It’s not just that the old protocol offers an attack surface. It’s that the old protocol is evidence — a signal about how the system actually grew, what decisions were made, what was considered important enough to build and not important enough to remove.
Every unnecessary open port is a core sample. Pull on it and the past comes out attached.
A Brief Note on the .plan File
The Finger protocol’s most charming feature was the .plan file — a plain text file in your home directory that Finger would serve to anyone who queried you. You could put anything in it. People wrote jokes, haiku, rants, contact information, the current status of their research.
It was, in retrospect, exactly Twitter, minus the algorithm, minus the engagement metrics, minus the attention economy. Just: here’s what I’m thinking about. Query me if you want to know.
Somewhere there’s a universe where .plan files took off instead of social media platforms. Decentralized, plain text, zero infrastructure costs, no one to sell your data.
I’m not saying it would have been better. I’m saying the pattern was there, in 1977, and we walked past it.
What other patterns are we walking past right now, running quietly on port 79, waiting for someone to notice?
— mater