Do you have a right to privacy of your source code?

beacon_dave said:

Quite the opposite - I thought you may had found a new tool that I was unaware of

It's fine, the comment was more for the peanut gallery to make sure we were on track for a conversation. Thank you.

beacon_dave said:

Have you had a play with Ghidra yet ?

It's such a great tool! I played with it for a DEF CON badge with its firmware when trying to solve its "puzzle". Thanks for mentioning it. I'm certainly not adept at using it.

beacon_dave said:

Comparatively in the engineering world, I guess you could buy an engine, strip it down, see how it works, modify it to improve its performance/reliability and then re-sell it for a large profit as a 'tuned engine'.

I always find physical comparisons interesting because there are definitely more exacting restrictions on them compared to digital ones. For example, you can modify one engine and sell it, and possibly no one would bat an eyelid, but start up a business doing it en masse and there may be a greater issue, but that's not one I necessarily have examples of.

Part of the problems with digital works as deemed by courts can often be that it's so readily and easily distributable and available so as to more readily cause damage and alleged loss of revenue, etc. These are of course very specific scenarios and examples, but it's certainly why circumventing Digital Rights Management on software is illegal, even though there are laws claiming you can "backup for personal use", circumventing that protection still legally prevents you from doing so except in certain exemptions which are usually for the case of museums or those with disability.

beacon_dave said:

Back in the art world, if you took a photograph of a sculpture of an engine and tried to sell it, you could be found to be in breach of copyright.

Yeah, that's definitely a close comparator, and I've seen arguments of "because there's no loss of quality in the copy it behaves the same or similar to the original" and that's what tends to apply to digital 'copies'.

Gough Lui said:

This is a tricky one, but short of having a license agreement which forbids it, I can’t see reverse engineering being a problem.

There definitely appears to be a line drawn here and in your example, between reverse engineering something, and then iterating upon a new version of that and making it anew. Which is somewhat protected in various ways, and reverse engineering something, or decompiling it and then simply sharing that source code without permission or rights to do so.

My takeaway is that there are still nuances in the sweeping statements of "all code should be shared regardless" where perhaps it shouldn't be, but looking at it is fine.

cstanton said:

Edit: If you're picking up on spelling errors rather than the topic and context of the post, you're easily distracted. ;)

Quite the opposite - I thought you may had found a new tool that I was unaware of

Have you had a play with Ghidra yet ?

cstanton said:

Comparatively in the art world

Comparatively in the engineering world, I guess you could buy an engine, strip it down, see how it works, modify it to improve its performance/reliability and then re-sell it for a large profit as a 'tuned engine'.

Back in the art world, if you took a photograph of a sculpture of an engine and tried to sell it, you could be found to be in breach of copyright.

BigG said:

Hence I see great value in publishing code for the purposes of getting the code improved upon.

Ah there in lies somewhat of a caveat for 'constructive and co-operative' feedback. Publicly sharing doesn't always equate to that, there's a bit of a human interaction element to it.

It seems that writing a question on a forum or writing a blog invokes the same response to writing code (see above :-))

People read, and then will respond with critical comment. It's in our nature.

Very seldom will a person be able to write a book and get it published without anyone reviewing what they have written and coming back with suggested edits etc. In fact, we all should know that it's nearly impossible to spot all our mistakes ourselves. Hence I see great value in publishing code for the purposes of getting the code improved upon.

The only time I would be reluctant to share code is for commercial and/or contractual reasons.

So, IMHO, we cannot create good applications on our own. It requires critique and this is where open source has great benefit.

Some bits are a grey area for sure. So many scenarios, e.g. people deliberately sitting on firmware with no updates for users, going out of business, etc. Also reverse-engineering can be illegal anyway, depending on circumstances. The EU had a very nice rule (I'm calling it a rule, technically known as a "Directive", that member states must implement), that reverse-engineering was totally legal if it was necessary for interfacing to equipment, however manufacturers were worried people would accidentally or accidentally-on-purpose find out secret stuff during the exercise of that legal right, so they worked around it by supplying interfacing information in (say) paid manuals (which means it is no longer _necessary_ to reverse engineer, since you can buy the manuals, so now you've lost your right to that reverse-engineering). Anyway after a few years that rule was got rid of, I believe (but not sure) due to manufacturer pressure.

I think it's unethical deliberately bypassing software protection to try to "unlock" software. That's not the same as trying to keep old firmware running when the manufacturer has gone bust for instance. So many people seem to think that the software is free and they try to kid themselves that no-one is losing out, whereas (from experience as a software engineer!) it certainly has huge costs to a business when people do that.

This is a tricky one, but short of having a license agreement which forbids it, I can’t see reverse engineering being a problem.

Imagine you go to a burger joint and order a burger to take away. Nobody’s going to stop you from photographing the burger, taking it apart and cooking one just like it at your own home. Furthermore, short of signing anything, nothing stops you from sending bits of it to a chemical lab for analysis. Learning from others is a way of innovating and improving – Hungry Jacks copied the Big Mac with their Big Jack and that was fine. In return, a McFeast was introduced which has very similar composition to the Hungry Jacks Whopper.

Copyrights have been thrown around, but even moral copyright only protects the form of expression. So if you provided the binary blob, it just means I can’t go exploiting that binary blob like-for-like. But if I disassemble it, it could be argued as being a transformational process (i.e. conversion from binary to source) which is often something considered sufficient to avoid copyright claims.

One way you can get around this to some extent is by technical countermeasure – obfuscating the source and making it difficult to analyse is something that games publishers have often done in the name of DRM and anti-cheat. That can frustrate the effort of reverse engineering sufficiently if the intent is to stifle those seeking to emulate your innovation. It comes at a cost, but it also affords legal protection in some jurisdictions (e.g. DMCA would consider encryption a countermeasure for example).

Regardless, the flip-side of the coin must also be considered – not releasing the sources because one is secretive is something companies often do when they suspect the code could open them up to legal challenges from valid forms of protection, be it copyright or patents. How is a patent-holder to enforce their rights reasonably without the use of reverse-engineering? The legal process is long and expensive …

In fact, reverse-engineering is explicitly protected and permitted by some jurisdictions – e.g. the DCMA expressly permits it for the case of enabling interoperability or compatibility.

I think this link is a good start: https://www.eff.org/issues/coders/reverse-engineering-faq

- Gough

Most copyright violations become civil litigations. Severe copyright violation can be a criminal case, and that's where enforcement comes in. 

baldengineer said:

"How many (actually) enforce copyright laws?"

Or perhaps more accurately, how many actually enforce it for the average person who can’t afford to pay a fortune to lawyers?

If someone reverse compiles your binary they are in the wrong, especially if they go and commercialize it or distribute it against your wishes.  I don't know what the law says but in terms of ethics the person disassembling and disseminating is more at fault than the one not releasing the source code.  That's what I believe anyway.