The 'Lo' Crash: The Internet's First Bug Report

#TL;DR

On October 29, 1969, a UCLA grad student named Charley Kline typed three letters over the first working link of ARPANET — L, O, G — and the machine at the other end crashed. The cause wasn’t the network. It was a clever auto-complete feature on SRI’s side that tried to send back more bytes than its output buffer could hold. The fix took about an hour. The full LOGIN went through later that night. Nobody remembers the success. Everyone remembers “Lo.”

#The Setup

It was the evening of October 29, 1969. Two Interface Message Processors had been installed — one at UCLA in early September, one at SRI in Menlo Park in early October. The cross-country link between them had been up for about three weeks. Nobody had really used it yet.

At UCLA, Charley Kline was 21, a programmer in Leonard Kleinrock’s Network Measurement Center. He sat at a teletype connected to a SIGMA 7 mainframe. Three hundred fifty miles north, at SRI’s Augmentation Research Center, Bill Duvall sat at a SDS 940 running the Genie time-sharing system.

The goal was modest: log in remotely. Kline would type commands on UCLA’s terminal, the characters would travel across two IMPs to SRI, SRI would process them, and the responses would come back. A normal interactive session — except the keyboard and the computer were in different states.

The two programmers coordinated by phone.

#Three Keystrokes

SRI’s login prompt expected you to type LOGIN. Bill Duvall had written the host software, and he’d added a small quality-of-life feature: command completion. If you typed any unique prefix of a command, the system would fill in the rest for you. Typing LO was enough to identify LOGIN unambiguously, so SRI would echo back the remaining characters.

Kline typed L. SRI echoed L. Kline typed O. SRI echoed O. Kline typed G. SRI crashed.

On the phone, Duvall said the system had gone down. Kline looked at his terminal. The last character it had received was part of the auto-completion SRI had started to send — then nothing.

The first message ever delivered across ARPANET was the two-character fragment Lo.

#What Actually Broke

Command completion sounds harmless. The failure was in how SRI buffered its outgoing responses.

When Kline typed G, SRI recognized LOG as a prefix of LOGIN and queued the remaining characters — I, N, plus the prompt’s usual trailer — into a send buffer to echo back. The buffer was sized for a single character’s worth of response, because that was the normal case: echo one keystroke at a time. Suddenly asked to hold a multi-character completion string, it overran. On an SDS 940 running a research OS in 1969, an unchecked overrun in a system buffer was enough to take the machine down.

There was no memory protection in the modern sense. No separation between the echo routine’s buffer and the rest of the operating system’s workspace. The system didn’t crash because the network was unreliable — the bytes arrived exactly as sent. It crashed because a local feature had a local bug, exposed for the first time by traffic arriving from outside the machine.

UCLA SIGMA 7                   SRI SDS 940
    │                               │
    │────── L ────────────────────>│
    │<───── L ──────────────────────│  echo
    │                               │
    │────── O ────────────────────>│
    │<───── O ──────────────────────│  echo
    │                               │
    │────── G ────────────────────>│
    │                               │  → auto-complete triggered
    │                               │  → buffer queues "IN<CR><LF>..."
    │                               │  → overrun → system halt
    │              💥               │

Kline had sent two characters of payload and triggered what, by modern terminology, we’d call a remote denial-of-service from a buffer overflow in the echo path. It was entirely accidental.

#One Hour Later

Duvall rebuilt the system. The details of the patch are lost to casual history — likely he grew the buffer, or disabled completion for remote terminals, or both. By around 10:30pm, they tried again.

Kline typed L, O, G, I, N. All five characters echoed back. The SDS 940 prompted for a username. Kline typed one. The system logged him in.

The first fully successful remote login in history happened that night. It produced no screenshot, no news article, and no legend. What got written down — in Kleinrock’s lab log, in a single dry line — was the thing that broke an hour earlier.

22:30 Talked to SRI Host to Host

No mention of Lo. No mention of the crash. It took years before the story was reconstructed from memory and given its now-famous framing.

#Why This Became the Origin Story

Engineers love origin stories that are failures. A crash is shareable. A successful login is not. The “Lo” story contains, in miniature, everything the next fifty years of internet engineering would grind out the hard way:

Bugs are features under load. Auto-completion worked for every local user who had ever used it. It failed the first time it ran against a remote caller, because the assumptions about timing and payload size weren’t true across a network.
The network is the least reliable part, right up until it isn’t. The IMPs did their job perfectly. The crash was inside a host, in code that predated the network.
Every protocol fails first on the edge cases. A single extra byte crossed a buffer boundary. That pattern — Morris Worm’s fingerd, Heartbleed, every CVE with “improper bounds checking” in its title — is the same failure mode, separated by fifty years and nine zeros of deployed scale.
You can’t test a network until you use it. ARPANET had been “up” for weeks. Nobody knew it was broken until they ran real traffic.

The ARPANET post treats Lo as a charming anecdote. It’s also the first entry in a bug tracker that now has a few billion open tickets. The login worked an hour later. The pattern it revealed is still working today.