Actions
Forum Thread Details
  • Replies 54 replies
  • Subscribers 534 subscribers
  • Views 4769 views
  • Users 0 members are here
Related

Do you have a right to privacy of your source code?

cstanton

As an individual, if you write a program and share the binary of that, should the expectancy be that you share its source code?

You might not want to share the source code, for example, you can very easily be judged based on that source code, both professionally and personally.

I've known people purposefully not post their code on Git Hub because they know employers will scrutinize and judge it, and in fact others observe how many 'regular commits' you do. Whether or not such judgment is fair is out of scope, but it's certainly something that's in the public eye at that point.

So perhaps you release a compiled binary because you want to help, but you don't want to invite conversations about the code, make it publicly displayed, or maybe there are other reasons.

However, someone comes along, decompiles the binary, reverse engineers it with ida pro, and releases the source code - citing that they have every right to do that, and now everyone can see the code, even though it's against your wishes.

Who was in the wrong? Or was no one in the wrong? Does it go to copyright since there was no license? Or was there an implied license?

There certainly appears to be a strong sense of justice among those online, that insists "it's just code" and "there's a right to transparency".

But there feels like there's something here that may not stand up to this scrutiny and this cavalier attitude of someone's work. Comparatively in the art world, someone creates a piece of art, and recently those components are being re-used in the case of AI (stable diffusion) and there's an uproar, but aren't they just laying the components bare? Maybe the analogy doesn't quite fit, but it certainly feels like for some reason code, by some, is treat differently to other mediums. Even though there are patents, copyrights, licenses, etc.

It could be difficult or even impossible for an individual to do something about this without financial backing, too. Especially compared to companies.

What do you think?

Edit: If you're picking up on spelling errors rather than the topic and context of the post, you're easily distracted. ;)

Parents
  • shabaz said:
    So many scenarios, e.g. people deliberately sitting on firmware with no updates for users, going out of business, etc.

    One area that I'm currently faced with is with engine management systems in classic cars. The manufacturer no longer supports their product or releases updated tools and documentation to allow owners to maintain it. The EEPROMs in the meantime are starting to lose their data and will soon prevent the vehicle from running. Owners however need to get the current config data out of the ECU and reflash it in order to keep their investment on the road. Those with ECU diagnostics kits have another problem in that the software no longer runs on modern laptops. The binaries need to be modified in order to adjust the timing for the data comms.

Reply
  • shabaz said:
    So many scenarios, e.g. people deliberately sitting on firmware with no updates for users, going out of business, etc.

    One area that I'm currently faced with is with engine management systems in classic cars. The manufacturer no longer supports their product or releases updated tools and documentation to allow owners to maintain it. The EEPROMs in the meantime are starting to lose their data and will soon prevent the vehicle from running. Owners however need to get the current config data out of the ECU and reflash it in order to keep their investment on the road. Those with ECU diagnostics kits have another problem in that the software no longer runs on modern laptops. The binaries need to be modified in order to adjust the timing for the data comms.

Children
  • in reply to beacon_dave

    Reminds me that I was banned from a Community for calling out a soundcard company for indirectly planned obsolescence by not releasing updated drivers for their soundcards, they've since moved onto external hardware that requires the software to change functions of the soundcard (eg. from analogue to SP/DIF output) and if you don't have the right software 'codes' to send those instructions, your hardware's stuck in one mode. It also limits the hardware to one operating system (because of course they don't support all operating systems).

    Even with Linux software (wine, proton, bottles, etc) there can still be restrictive limits to how far you can overcome these purposeful limitations (laser cutters have also seen requirements of people to produce new laser controller boards as a similar example).

    beacon_dave said:
    The EEPROMs in the meantime are starting to lose their data

    This's simply awful Disappointed

  • in reply to cstanton

    I have experienced similar with expensive AV equipment which doesn't provide a full documented API to all you to configure it once the manufacturer no longer supports the original software.

    It's going to get a lot worse as more and more equipment is headless being controlled wirelessly via a custom app on a tablet device rather than having any of the the UI built into the device itself. As soon as support for the app is discontinued and it gets removed from the app store, your expensive hardware is now useless.

    EEPROMs have a floating gate which has a charge applied when programming. Over time this charge leaks away and then the contents eventually become corrupted. Some devices lose their charge quicker than and classic cars fitted with early ECUs are now having this problem. Not all owners are aware of this issue either so by the time the problem comes to light, the engine data can no longer be recovered from the ECU.

    Some people are 'milking it' of course. I've seen companies charging around £4k for a serial interface box which is basically a MAX232 RS-232 driver potted in an aluminium box. Or $80k to hire an 1980's  diagnostic kit for a day to reprogram the EEPROM.   

    The problem will only likely get worse as more modern cars are fitted with the likes of HMI touch panels to control functions.

    Unfortunately the legal system doesn't appear to do much to protect the consumer from this.

  • in reply to beacon_dave
    beacon_dave said:
    The problem will only likely get worse as more modern cars are fitted with the likes of HMI touch panels to control functions.

    We're seeing this with cars with software as a service, aren't we? Kinda. It makes me glad that DEF CON villages exist.

  • in reply to cstanton

    There is a substantial shift to leasing of cars as opposed to owning them outright. I guess this will be more of the case when moving to autonomous vehicles if the company is legally responsible for accidents and wants to ensure they are only maintained by approved dealers. Either that or it will become more of an autonomous taxi based type service.

    However bang goes your classic car, or custom car scene in that case. But it may kick-start a personal transporter / kit car type scene.

  • in reply to beacon_dave

    Someone I know has the same problem, I was able to give him an ancient EPROM programmer, I don't know how long it will last it's so old, but he gets good use out of it. He has a repair business but also does some enthusiast car sports work on the side, and needed them for the older cars, because he would want to tune them up for better performance etc.

  • in reply to beacon_dave

    Some dump repositories to fight bit rot do exist if one searches hard enough. 

  • in reply to cstanton
    cstanton said:
    soundcard company for indirectly planned obsolescence by not releasing updated drivers for their soundcards

    That sounds like my soundcard ... with its frequent BSODs under the most recent W10 update. No driver updates for a decade or so ... and it was a high-end product when I bought it.

    Too bad I don't have the time nor skills to sort that out ...

    - Gough