Actions
Forum Thread Details
  • Replies 54 replies
  • Subscribers 534 subscribers
  • Views 4807 views
  • Users 0 members are here
Related

Do you have a right to privacy of your source code?

cstanton

As an individual, if you write a program and share the binary of that, should the expectancy be that you share its source code?

You might not want to share the source code, for example, you can very easily be judged based on that source code, both professionally and personally.

I've known people purposefully not post their code on Git Hub because they know employers will scrutinize and judge it, and in fact others observe how many 'regular commits' you do. Whether or not such judgment is fair is out of scope, but it's certainly something that's in the public eye at that point.

So perhaps you release a compiled binary because you want to help, but you don't want to invite conversations about the code, make it publicly displayed, or maybe there are other reasons.

However, someone comes along, decompiles the binary, reverse engineers it with ida pro, and releases the source code - citing that they have every right to do that, and now everyone can see the code, even though it's against your wishes.

Who was in the wrong? Or was no one in the wrong? Does it go to copyright since there was no license? Or was there an implied license?

There certainly appears to be a strong sense of justice among those online, that insists "it's just code" and "there's a right to transparency".

But there feels like there's something here that may not stand up to this scrutiny and this cavalier attitude of someone's work. Comparatively in the art world, someone creates a piece of art, and recently those components are being re-used in the case of AI (stable diffusion) and there's an uproar, but aren't they just laying the components bare? Maybe the analogy doesn't quite fit, but it certainly feels like for some reason code, by some, is treat differently to other mediums. Even though there are patents, copyrights, licenses, etc.

It could be difficult or even impossible for an individual to do something about this without financial backing, too. Especially compared to companies.

What do you think?

Edit: If you're picking up on spelling errors rather than the topic and context of the post, you're easily distracted. ;)

  • in reply to baldengineer

    Only about 6 countries have not signed the Berne Convention or the TRIPS Agreement.

  • in reply to baldengineer

    So you're saying silence or not stating it otherwise, is permission to de-compile it? That feels 'off'.

  • in reply to dougw

    I figured I'd ask a certain AI as a quick reference since I hadn't heard of the convention or agreement before:

    As of September 2021, the following countries had not signed the Berne Convention:

    1. Eritrea
    2. Iran
    3. Kiribati
    4. Marshall Islands
    5. Palau
    6. San Marino
    7. Sint Maarten
    8. Turkmenistan
    9. Tuvalu

    As of September 2021, the following countries had not become parties to the TRIPS Agreement:

    1. East Timor
    2. Kiribati
    3. Marshall Islands
    4. Micronesia
    5. Nauru
    6. Niue
    7. Palau
    8. Papua New Guinea
    9. Samoa
    10. Solomon Islands
    11. South Sudan
    12. Turkmenistan
    13. Tuvalu
    14. Vanuatu
  • in reply to cstanton

    So, most countries agree to the concept. I saw the same lists on Wikipedia. I didn't need to use AI.

    However, it may help create a wrong picture by asking: "How many (actually) enforce copyright laws?"

  • If someone reverse compiles your binary they are in the wrong, especially if they go and commercialize it or distribute it against your wishes.  I don't know what the law says but in terms of ethics the person disassembling and disseminating is more at fault than the one not releasing the source code.  That's what I believe anyway.

  • in reply to baldengineer
    baldengineer said:
    "How many (actually) enforce copyright laws?"

    Or perhaps more accurately, how many actually enforce it for the average person who can’t afford to pay a fortune to lawyers?

  • in reply to baldengineer

    Most copyright violations become civil litigations. Severe copyright violation can be a criminal case, and that's where enforcement comes in. 

  • This is a tricky one, but short of having a license agreement which forbids it, I can’t see reverse engineering being a problem.

    Imagine you go to a burger joint and order a burger to take away. Nobody’s going to stop you from photographing the burger, taking it apart and cooking one just like it at your own home. Furthermore, short of signing anything, nothing stops you from sending bits of it to a chemical lab for analysis. Learning from others is a way of innovating and improving – Hungry Jacks copied the Big Mac with their Big Jack and that was fine. In return, a McFeast was introduced which has very similar composition to the Hungry Jacks Whopper.

    Copyrights have been thrown around, but even moral copyright only protects the form of expression. So if you provided the binary blob, it just means I can’t go exploiting that binary blob like-for-like. But if I disassemble it, it could be argued as being a transformational process (i.e. conversion from binary to source) which is often something considered sufficient to avoid copyright claims.

    One way you can get around this to some extent is by technical countermeasure – obfuscating the source and making it difficult to analyse is something that games publishers have often done in the name of DRM and anti-cheat. That can frustrate the effort of reverse engineering sufficiently if the intent is to stifle those seeking to emulate your innovation. It comes at a cost, but it also affords legal protection in some jurisdictions (e.g. DMCA would consider encryption a countermeasure for example).

    Regardless, the flip-side of the coin must also be considered – not releasing the sources because one is secretive is something companies often do when they suspect the code could open them up to legal challenges from valid forms of protection, be it copyright or patents. How is a patent-holder to enforce their rights reasonably without the use of reverse-engineering? The legal process is long and expensive …

    In fact, reverse-engineering is explicitly protected and permitted by some jurisdictions – e.g. the DCMA expressly permits it for the case of enabling interoperability or compatibility.

    I think this link is a good start: https://www.eff.org/issues/coders/reverse-engineering-faq

    - Gough

  • in reply to dang74

    Some bits are a grey area for sure. So many scenarios, e.g. people deliberately sitting on firmware with no updates for users, going out of business, etc. Also reverse-engineering can be illegal anyway, depending on circumstances. The EU had a very nice rule (I'm calling it a rule, technically known as a "Directive", that member states must implement), that reverse-engineering was totally legal if it was necessary for interfacing to equipment, however manufacturers were worried people would accidentally or accidentally-on-purpose find out secret stuff during the exercise of that legal right, so they worked around it by supplying interfacing information in (say) paid manuals (which means it is no longer _necessary_ to reverse engineer, since you can buy the manuals, so now you've lost your right to that reverse-engineering). Anyway after a few years that rule was got rid of, I believe (but not sure) due to manufacturer pressure.

    I think it's unethical deliberately bypassing software protection to try to "unlock" software. That's not the same as trying to keep old firmware running when the manufacturer has gone bust for instance. So many people seem to think that the software is free and they try to kid themselves that no-one is losing out, whereas (from experience as a software engineer!) it certainly has huge costs to a business when people do that.

  • It seems that writing a question on a forum or writing a blog invokes the same response to writing code (see above :-))

    People read, and then will respond with critical comment. It's in our nature.

    Very seldom will a person be able to write a book and get it published without anyone reviewing what they have written and coming back with suggested edits etc. In fact, we all should know that it's nearly impossible to spot all our mistakes ourselves. Hence I see great value in publishing code for the purposes of getting the code improved upon.

    The only time I would be reluctant to share code is for commercial and/or contractual reasons.

    So, IMHO, we cannot create good applications on our own. It requires critique and this is where open source has great benefit.