Actions
Forum Thread Details
  • Replies 54 replies
  • Subscribers 532 subscribers
  • Views 4829 views
  • Users 0 members are here
Related

Do you have a right to privacy of your source code?

cstanton

As an individual, if you write a program and share the binary of that, should the expectancy be that you share its source code?

You might not want to share the source code, for example, you can very easily be judged based on that source code, both professionally and personally.

I've known people purposefully not post their code on Git Hub because they know employers will scrutinize and judge it, and in fact others observe how many 'regular commits' you do. Whether or not such judgment is fair is out of scope, but it's certainly something that's in the public eye at that point.

So perhaps you release a compiled binary because you want to help, but you don't want to invite conversations about the code, make it publicly displayed, or maybe there are other reasons.

However, someone comes along, decompiles the binary, reverse engineers it with ida pro, and releases the source code - citing that they have every right to do that, and now everyone can see the code, even though it's against your wishes.

Who was in the wrong? Or was no one in the wrong? Does it go to copyright since there was no license? Or was there an implied license?

There certainly appears to be a strong sense of justice among those online, that insists "it's just code" and "there's a right to transparency".

But there feels like there's something here that may not stand up to this scrutiny and this cavalier attitude of someone's work. Comparatively in the art world, someone creates a piece of art, and recently those components are being re-used in the case of AI (stable diffusion) and there's an uproar, but aren't they just laying the components bare? Maybe the analogy doesn't quite fit, but it certainly feels like for some reason code, by some, is treat differently to other mediums. Even though there are patents, copyrights, licenses, etc.

It could be difficult or even impossible for an individual to do something about this without financial backing, too. Especially compared to companies.

What do you think?

Edit: If you're picking up on spelling errors rather than the topic and context of the post, you're easily distracted. ;)

  • in reply to beacon_dave
    beacon_dave said:
    Presumably it was compiled with debug information included ?

    Not explicitly.

  • So there is no copyright for binary code. Or binary representations, because any particular binary string can have an infinite number of possible interpretations (i.e., your compiled version of a+b=c on machine 1, could mean d*e<7 on machine 2), or your ASCII version of tic-tac-toe might be blackjack in EBCDIC (or some other encoding in the 2**[char bits] space).

    If we want to get to constitutional issues of IP, the purpose of IP is "To promote the progress of science and useful arts, by securing for limited times to authors and inventors the exclusive right to their respective writings and discoveries." But we only promote progress by dissemination, and we don't do that unless we publish source code (in the case of algorithms, etc.) So I would say that someone who reverse engineers is actually performing a public service, and DCMA is unconstitutional on it's face; go after someone for copying your source, or for violating your patent, but not for determining how you did something (which in fact may be done in order to determine if you have, in fact, violated a patent!).

  • in reply to Dudley

    Yes, under the Berne convention if you create an original expression in a tangible medium then you automatically have copyright. You don not have to mark your intent to copyright it. Although as Doug mentioned, it can make life easier in court if you do.

    The photograph of a sculpture was a case that cropped up in a Berne convention course I did about fifteen years ago. Someone had photographed a sculpture in public and then tried to sell it and was taken to court for potential breach of copyright. Although the photographer had copyright on the photograph they had taken, the sculptor had copyright on the subject material being photographed and the court decided that by selling the photograph the sculptor potentially lost out financially on their work and so the photographer was in breach of the copyright of the sculptor as they had not sought appropriate permission to use their copyrighted work. The fact that the sculptor had no intention of profiting by selling their own photographs, was seen as irrelevant.

    About the only useful thing I took away from the course was that you are automatically granted copyright without declaring intent, that breach of copyright can only be determined in a court of law, and that lawyers tend to profit from this either way.

    I'm surprised that the virtual Library of Babel by Jonathan Basile has not kicked up a storm as that potentially shows that a bidirectional algorithm can generate the same content even before it has been created. The text of this post I have just written here, already existed in the virtual library before I even wrote it.

  • in reply to beacon_dave

    Someone I know has the same problem, I was able to give him an ancient EPROM programmer, I don't know how long it will last it's so old, but he gets good use out of it. He has a repair business but also does some enthusiast car sports work on the side, and needed them for the older cars, because he would want to tune them up for better performance etc.

  • in reply to beacon_dave

    Some dump repositories to fight bit rot do exist if one searches hard enough. 

  • in reply to bradfordmiller
    bradfordmiller said:
    So there is no copyright for binary code.

    The resulting compiled form of software source code can be considered a copyrightable work. Aspects of copyright have to be assessed in context.

    If we're purely talking about 'arrangements' of zeroes and ones. That gets fun. Let's compare it to music:

  • cstanton said:
    I've known people purposefully not post their code on Git Hub because they know employers will scrutinize and judge it,

    This is one of the reasons why I do post my code on github. 

  • in reply to cstanton

    If the symbol table was removed at compile time then I would expect you to lose your variable and function names, so you would end up with substitute names in the decompiled source.

  • in reply to cstanton
    cstanton said:
    Aspects of copyright have to be assessed in context

    Can perhaps get messy, as you can have the same copyrighted data being interpreted both as music (through audio medium) and animated graphics (through video medium) simultaneously Slight smile

    Jerobeam Fenderson: Oscilloscope Music Kickstarter (June 2015)

  • in reply to cstanton
    cstanton said:
    Which is somewhat protected in various ways, and reverse engineering something, or decompiling it and then simply sharing that source code without permission or rights to do so.

    But the process of reverse engineering itself could be argued to be transformative as machine code is being converted into sources (and this is not always a 1:1 process). Furthermore, if the output is annotated - variables named rather than automated output, it does add value ...

    And even if it wasn't and if the issue was copyright, some countries also have exceptions for research, documentation and critique under a fair dealing or fair use clause. A case could be made that this is a "study" of the program and its modes of operation.

    I feel like if your intention is to hide the code, you really shouldn't be letting the code out of the door in any form - this is where a lot of companies have gone to the SaaS route and instead provide API access to their algorithms. This way, the only thing that could be done is a "black box" style test, and even that may be forbidden/rate-limited etc. If you can execute it, the code obviously will exist for analysis - the same can be said for any webpage (and the issue around rewriting the code of a page for ad-blocking, adding features, etc). Obfuscation and technical countermeasures mostly frustrate, but sometimes they are used for legal protection measures - e.g. YouTube invoking DMCA over youtube-dl over the breaking of their (mostly trivial) rolling cipher.

    There are nuances - but there's also a lot of money for lawyers to make ... I kinda feel like the two may not be entirely unrelated.

    - Gough