6 ms·

In 2006 ReactOS halted all developments because of accusations like this. After a year long effort there was found to be no use of Microsoft source code in Reac

In 2006 ReactOS halted all developments because of accusations like this. After a year long effort there was found to be no use of Microsoft source code in ReactOS. (https://www.reactos.org/reset-reboot-restart-legal-issues-and-long-road-03 https://www.reactos.org/reset-reboot-restart-legal-issues-an...) From what I understand a lot of the kernel work was done by clean-room reverse engineering. One person decompiles and documents the system and another re-implements given the documentation. I can easily see how this would result in identical structures and naming.

deleted 7y ago
[deleted]
opportune 7y ago
Reverse engineering is usually considered a violation of proprietary software IP right (not sure the exact legal term)? I know at every company I've ever worked at I've been told to never under any circumstances attempt to decompile or reverse engineer another company's proprietary software product. Maybe that's just legal CYA but decompiling+documenting then re-implementing sure sounds like stealing to me...
- SllX 7y ago
  In the United States, clean room reverse engineering is legal for interoperability purposes. In general reverse engineering is legal unless there is a contract involved prohibiting it. Unless you’re reusing the original source code, there’s no copyright violation per se, simply functionality reimplemented in a compatible manner. The lengths that ReactOS goes to might actually be overkill, but no one can credibly claim the project has actually stolen anyone’s code.
  - opportune 7y ago
    Does a software license in this case count as a contract? Moreover, interoperability is not the same as distribution no? Honestly ReactOS's lengths do not seem like overkill to me, quite the contrary. Even re-implementing an API is legally suspect these days (see: Oracle vs. Google re: Android). Copying the internals of a piece of software by having one person explain verbally exactly how it works to another person who translates that to code feels a lot more like stealing than that.
    - SllX 7y ago
      A EULA might but I’m not positive that is the case. That said, I would expect a business of any size to cover their ass and not bother without a compelling reason. That said, look at the steps involved. Person A had the original software in binary form, runs it through a decompiler. The decompiler is not going to reproduce the code precisely, but it will be enough for documentation purposes. They document the functionality in a separate document describing what is happening when the software is run. Person B receives this document and writes their own code according to what it says. They need not have ever even used the original software or signed a EULA, and then Person A or C or whoever can go on to test compatibility. It is a lot of effort, but the end result is code where no one involved violates any laws. It’s interoperable, and because the code is original, Person B or the Project he works for can claim copyright and license it out on their own terms, in the case of ReactOS, it is an open source license. Re: Oracle vs Google, this case does make the whole project potentially suspect these days, but if APIs are not copyrightable, then ReactOS should be firmly on the right side of the law. If APIs are copyrightable, then we can expect the Wine project to be taken down alongside ReactOS. More reason to hope Google prevails entirely, regardless of our own personal opinions of them.
    - d1zzy 7y ago
      Yes, EULA is a contract and has been successfully tested in court against reverse engineering: https://www.eff.org/cases/blizzard-v-bnetd https://www.eff.org/cases/blizzard-v-bnetd
      - codewiz 7y ago
        For the contract portion of the EULA to be enforceable, you have to get the user to explicitly and willingly agree to it. Tricking the user with a shrink-wrap license ("by opening this package you have agreed...") would not hold in court. Asking users to click "I Agree" in installers also has dubious value due to the widespread practice of clicking these buttons to proceed without really reading the contract; their true intention was proceeding to the next question rather than entering any agreement. In other words: if most reasonable persons wouldn't expect to be actually bound to the conditions listed in the contract, then Microsoft cannot effectively enforce them in a court.
  - ABCLAW 7y ago
    >Unless you’re reusing the original source code, there’s no copyright violation per se Dunno about that one, chief. Copying non-literal elements of code can still be infringing.
- fulafel 7y ago
  Reverse engineering is generally allowed. Trade secrets don't have a lot of protections. The reverse engineering + reimplementing route has precedent in the US, the Compaq vs IBM BIOS case. Companies mostly have these rules to guard against copyright and patent lawsuits because there is no presumption of innocence beyond reasonable doubt in these in the US.
- michaelmrose 7y ago
  You seem to have internalized ethics designed to maximize profit not happiness or utility. Deliberate incompatibility is a lever that allows a degree of control that allows one to extract money both from end users and from companies that serve end users. Having the ability to reverse engineer a compatible solution is a check on the maximum amount of rent seeking one is able to do before a competitor provides a more open or at least cheaper alternative that doesn't force one to entirely rip out existing components. This is only like stealing if you believe a company has an inherent right to make a maximum profit without interference from competitors which is an interesting moral stance to take.
geofft 7y ago
Is that really clean-room, though? (Note that "clean-room" is not a term in US copyright law, it's just a technique that certain people hope results in a work that is not a derivative of whatever they're reimplementing.) If I learn a pop song, and sing it and accompany myself on the piano, and someone else transcribes it, then two things are true: first, of course it will result in identical melodies and chord progressions, and second, of course (it seems to me) this is a derivative work and there's no way you can say its copyright is independent. On the other hand, if I learn a pop song, and then teach the fundamentals of songwriting to someone, and they write a song with a I-V-vi-IV progression with angsty lyrics about an estranged lover, no matter how much it resembles existing pop songs in intent, there's a much stronger argument for independent invention. A "clean-room" approach to determine a specification where none exists is sound - e.g., if you're developing a driver for a piece of hardware which only has a proprietary driver, you can run the driver under instrumentation and see what it does, and then write your own driver that twiddles hardware in the same way but takes its own approach to implementation. A "clean-room" approach to determine internals feels less sound to me: if you're disassembling the code to determine structure layout and naming, aren't you really just transforming the code into an overly-detailed natural language representation, then back into code? (To be clear, I don't know if this is what ReactOS does/did, I just think that this "clean-room" defense doesn't hold super strongly, or in other words, that if this is what ReactOS does/did, it can be true both that ReactOS believes they did a clean-room reimplementation and that it's an infringement of NT's copyrights, despite a lot of hard work by the ReactOS devs.)
- throwaway2048 7y ago
  Clean room re-implementations have stood up to many court challenges through the years, and are interoperability is explicitly permitted under things like the DMCA.
  - protomyth 7y ago
    Considering IBM couldn't stop Compaq after taking some pretty good steps, it has been legal for a while. Without clean room re-implementations we would have no PC clone industry.

deleted 7y ago

[deleted]

opportune 7y ago

Reverse engineering is usually considered a violation of proprietary software IP right (not sure the exact legal term)? I know at every company I've ever worked at I've been told to never under any circumstances attempt to decompile or reverse engineer another company's proprietary software product. Maybe that's just legal CYA but decompiling+documenting then re-implementing sure sounds like stealing to me...

SllX 7y ago
In the United States, clean room reverse engineering is legal for interoperability purposes. In general reverse engineering is legal unless there is a contract involved prohibiting it. Unless you’re reusing the original source code, there’s no copyright violation per se, simply functionality reimplemented in a compatible manner. The lengths that ReactOS goes to might actually be overkill, but no one can credibly claim the project has actually stolen anyone’s code.
- opportune 7y ago
  Does a software license in this case count as a contract? Moreover, interoperability is not the same as distribution no? Honestly ReactOS's lengths do not seem like overkill to me, quite the contrary. Even re-implementing an API is legally suspect these days (see: Oracle vs. Google re: Android). Copying the internals of a piece of software by having one person explain verbally exactly how it works to another person who translates that to code feels a lot more like stealing than that.
  - SllX 7y ago
    A EULA might but I’m not positive that is the case. That said, I would expect a business of any size to cover their ass and not bother without a compelling reason. That said, look at the steps involved. Person A had the original software in binary form, runs it through a decompiler. The decompiler is not going to reproduce the code precisely, but it will be enough for documentation purposes. They document the functionality in a separate document describing what is happening when the software is run. Person B receives this document and writes their own code according to what it says. They need not have ever even used the original software or signed a EULA, and then Person A or C or whoever can go on to test compatibility. It is a lot of effort, but the end result is code where no one involved violates any laws. It’s interoperable, and because the code is original, Person B or the Project he works for can claim copyright and license it out on their own terms, in the case of ReactOS, it is an open source license. Re: Oracle vs Google, this case does make the whole project potentially suspect these days, but if APIs are not copyrightable, then ReactOS should be firmly on the right side of the law. If APIs are copyrightable, then we can expect the Wine project to be taken down alongside ReactOS. More reason to hope Google prevails entirely, regardless of our own personal opinions of them.
  - d1zzy 7y ago
    Yes, EULA is a contract and has been successfully tested in court against reverse engineering: https://www.eff.org/cases/blizzard-v-bnetd https://www.eff.org/cases/blizzard-v-bnetd
    - codewiz 7y ago
      For the contract portion of the EULA to be enforceable, you have to get the user to explicitly and willingly agree to it. Tricking the user with a shrink-wrap license ("by opening this package you have agreed...") would not hold in court. Asking users to click "I Agree" in installers also has dubious value due to the widespread practice of clicking these buttons to proceed without really reading the contract; their true intention was proceeding to the next question rather than entering any agreement. In other words: if most reasonable persons wouldn't expect to be actually bound to the conditions listed in the contract, then Microsoft cannot effectively enforce them in a court.
- ABCLAW 7y ago
  >Unless you’re reusing the original source code, there’s no copyright violation per se Dunno about that one, chief. Copying non-literal elements of code can still be infringing.
fulafel 7y ago
Reverse engineering is generally allowed. Trade secrets don't have a lot of protections. The reverse engineering + reimplementing route has precedent in the US, the Compaq vs IBM BIOS case. Companies mostly have these rules to guard against copyright and patent lawsuits because there is no presumption of innocence beyond reasonable doubt in these in the US.
michaelmrose 7y ago
You seem to have internalized ethics designed to maximize profit not happiness or utility. Deliberate incompatibility is a lever that allows a degree of control that allows one to extract money both from end users and from companies that serve end users. Having the ability to reverse engineer a compatible solution is a check on the maximum amount of rent seeking one is able to do before a competitor provides a more open or at least cheaper alternative that doesn't force one to entirely rip out existing components. This is only like stealing if you believe a company has an inherent right to make a maximum profit without interference from competitors which is an interesting moral stance to take.

geofft 7y ago

Is that really clean-room, though? (Note that "clean-room" is not a term in US copyright law, it's just a technique that certain people hope results in a work that is not a derivative of whatever they're reimplementing.) If I learn a pop song, and sing it and accompany myself on the piano, and someone else transcribes it, then two things are true: first, of course it will result in identical melodies and chord progressions, and second, of course (it seems to me) this is a derivative work and there's no way you can say its copyright is independent. On the other hand, if I learn a pop song, and then teach the fundamentals of songwriting to someone, and they write a song with a I-V-vi-IV progression with angsty lyrics about an estranged lover, no matter how much it resembles existing pop songs in intent, there's a much stronger argument for independent invention. A "clean-room" approach to determine a specification where none exists is sound - e.g., if you're developing a driver for a piece of hardware which only has a proprietary driver, you can run the driver under instrumentation and see what it does, and then write your own driver that twiddles hardware in the same way but takes its own approach to implementation. A "clean-room" approach to determine internals feels less sound to me: if you're disassembling the code to determine structure layout and naming, aren't you really just transforming the code into an overly-detailed natural language representation, then back into code? (To be clear, I don't know if this is what ReactOS does/did, I just think that this "clean-room" defense doesn't hold super strongly, or in other words, that if this is what ReactOS does/did, it can be true both that ReactOS believes they did a clean-room reimplementation and that it's an infringement of NT's copyrights, despite a lot of hard work by the ReactOS devs.)

throwaway2048 7y ago
Clean room re-implementations have stood up to many court challenges through the years, and are interoperability is explicitly permitted under things like the DMCA.
- protomyth 7y ago
  Considering IBM couldn't stop Compaq after taking some pretty good steps, it has been legal for a while. Without clean room re-implementations we would have no PC clone industry.