22 ms·

EU court rules no EULA can forbid decompilation, if you want to fix a bug

938 points by aleclm 5y ago

chris_wot 5y ago
And suddenly it became legal to decompile code to find exploits. Awesome!
- brezelgoring 5y ago
  Nothing stopped you from doing it before, only difference is, now you can do it openly. Hopefully for good purposes.
  - chris_wot 5y ago
    Indeed, I quite agree.
- cute_boi 5y ago
  why is this a bad thing? If someone company like google/microsoft ships backdoors due to government then decompiling and finding bugs will help humanity right?
  - chris_wot 5y ago
    I didn't say it was. I am genuinely happy that it is now legal.
- adrian_b 5y ago
  Do you really believe that anyone who has the intention to find exploits cares about whether decompilation is legal or not?
  - chris_wot 5y ago
    No, not really. I like that it is legal to do so now.
- crest 5y ago
  </sarcasm> ?
  - chris_wot 5y ago
    No, I was actually happy about this.
- orra 5y ago
  Reverse engineering for interoperability has been legal in the EU since at least the 1991 Software Directive. Yes, there's a requirement for interoperability, but "interoperability" is construed broadly. Interoperability in law relates to "interfaces", including APIs, and compatible file formats. Conceivably the term could also be used to describe an antivirus program which protects the program in question. That's good this is allowed. Besides, bad faith actors will reverse engineer for malicious purposes, regardless of the law.
- maxpro 5y ago
  As this would stop someone writing exploits from decompiling
- dahart 5y ago
  It did not become legal to decompile code to find exploits. This EU ruling affirms the legality only in the EU to decompile code only for the purpose of fixing bugs.
- TeMPOraL 5y ago
  One man's exploit is another man's accessibility feature. Exploits by themselves aren't good or bad - their use for malicious purposes is. See also: adversarial interoperability.
  - chris_wot 5y ago
    Indeed, we are not disagreeing. I'm very happy that it is now legal. That's what I wrote, I think people have read into my comment that I'm being sarcastic, where I'm not.
- _kbh_ 5y ago
  this has always been legal in a lot of countries.
brezelgoring 5y ago
This sounds incredible, does it allow for redistribution of the fixed product? Or is it just for the purposes of notifying the creator of the problem and its solution in one go?
- mrtksn 5y ago
  You probably can buy, fix and re-sell software. I recall about some EU court ruling that made it clear that you can definitely sell the software you bought.
  - gambiting 5y ago
    It's been ruled this way over and over and over again - you can definitely resell OEM software no matter what the licence says, it's your right as a consumer in the EU. My company bought a 50-user MSSQL 2019 licence for cheap(like €1000) because a company was going into bankruptcy and software was being sold off separately to all hardware.
- moreira 5y ago
  I can't tell, but it'd never be allowed. Grab an AAA game, fix a bug in it, and now you're free to redistribute the game without consequences. That'd be insane.
  - roflc0ptic 5y ago
    Yeah a patch should be fine though
  - brezelgoring 5y ago
    My idea wasn't to redistribute the whole thing, but to distribute a patch that other owners of the game can use by themselves? Now that's a win. I also love the idea of adding newer OS compatibility to old software, seeing old video games running on Windows 10 would be thrilling. Perhaps do the same for drivers of old hardware? Also a win, IMO. Another big question, in these patches, can I do only the fixes I can justify? Or can I go wild and remove the parts I don't like? I'd love to remove telemetry from my TV and all those weird apps it comes with that are in Chinese and are unusable outside China.
orra 5y ago
IMHO this is a sensible decision, one that reflects the clear underlying intention of the statute. Article 5(1) of the Directive says: > [certain acts] shall not require authorization by the rightholder where they are necessary for the use of the computer program by the lawful acquirer in accordance with its intended purpose, including for error correction. Essentially, they have ruled that other Articles in the Directive do not supersede this Article, and that reverse engineering to correct an error can be necessary. This court, the CJEU, has good form on sensible decisions regarding computing. For example, SAS vs World Programming (C‑406/10) allowed reverse engineering for interoperability. That case, also, was the court upholding the clear intention of the statute. Moreover there was UsedSoft vs Oracle (C-128/11), allowing the resale of software licences, including the right to download the software where necessary, upon purchasing a second hand licence.
- agilob 5y ago
  This is sensible because it's the same as taking laptop apart to replace failing RAM or disk.
  - orra 5y ago
    Absolutely agreed, morally it's the right decision. I was just focusing on the law because copyright expansionists have a lot of institutional capture, or at least the ear of legislators. So even though the intention of the Directive was clear, I wouldn't have been entirely shocked if the court had decided against decompilation being allowed for fixing bugs.
- phkahler 5y ago
  So patching it to work without company servers after they've been shut down might be ok too!
  - orra 5y ago
    You'd hope so. There's also the CJEU case of Ninetendo v PC Box & 9 Net (C-355/12), which sets out circumstances where it's lawful to sell a device which circumvents DRM. Alas in that case, the bar is set too high: it's not enough for there to be legitimate reasons to break the DRM; that has to be weighed against the 'rights' of copyright holders.
detaro 5y ago
Nice to see the court confirm the law is as broad as it was taken to be, and that it can't be worked around with EULA bullshit.
- balozi 5y ago
  The EULA is still an agreement. Potential end users have an opportunity to not accept the agreement and walk away. I think this ruling is populist pandering that ends with reduced incentive for commercial software. Undermining property rights has never resulted in freer societies.
  - matheusmoreira 5y ago
    > The EULA is still an agreement. Agreements can't violate the law. They most certainly cannot deny people their rights. > Potential end users have an opportunity to not accept the agreement and walk away. No, they can and should be able to use the software regardless of any abusive clauses included in the contract. Companies should be punished for even thinking they could get away with confusing laymen with their illegal conditions. People have the right to reverse engineer. Companies are just gonna have to deal with it. It doesn't matter if they lose money. > Undermining property rights has never resulted in freer societies. Real property rights, yeah. Intellectual property is not real property. It barely makes sense in the 21st century.
  - yariik 5y ago
    > The EULA is still an agreement. I can't agree to anything that is impossible for me to understand or even to read.
  - no_time 5y ago
    This is the exact opposite of undermining property rights. You sold a thing to me. Your control over that thing ends when I hand over the money. I may be forbidden from patching in a new logo and reselling it, but you that's about all you can expect me NOT to do with it.
oytis 5y ago
Can someone share cases/anecdotes of decompiling software to fix a bug? Never done it myself nor heard someone doing that. Unless you consider not being able to run a program without license a bug :)
- to11mtm 5y ago
  I can't do one for Decompiling, but I reverse engineered a Pole-line drafting application in order to write utilities to fix the data corruption it sometimes caused.
- niea_11 5y ago
  GTA Online fix to reduce loading times [1]. Rockstar awarded the guy 10k$ [2] 1: https://nee.lv/2021/02/28/How-I-cut-GTA-Online-loading-times-by-70/ https://nee.lv/2021/02/28/How-I-cut-GTA-Online-loading-times... 2: https://www.pcgamer.com/rockstar-thanks-gta-online-player-who-fixed-poor-load-times-official-update-coming/ https://www.pcgamer.com/rockstar-thanks-gta-online-player-wh...
  - xojoc 5y ago
    And there was some talk about that previously: On HN: https://news.ycombinator.com/item?id=26296339 https://news.ycombinator.com/item?id=26296339 (703 comments) On Lobsters: https://lobste.rs/s/jzj4q9 https://lobste.rs/s/jzj4q9 (25 comments) And Reddit: https://www.reddit.com/r/programming/comments/luq9oz https://www.reddit.com/r/programming/comments/luq9oz (1022 comments) P.S. these threads where found with a site I'm building: https://discussions.xojoc.pw/?url=https%3A%2F%2Fnee.lv%2F2021%2F02%2F28%2FHow-I-cut-GTA-Online-loading-times-by-70%2F https://discussions.xojoc.pw/?url=https%3A%2F%2Fnee.lv%2F202...
- deleted 5y ago
  [deleted]
- yarcob 5y ago
  I have decompiled AppKit on macOS occasionally to debug issues in my app. For example, in one case I discovered that double clicking a cell sometimes only selected part of the contents. With Hopper I was able to verify that the bug is that AppKit just selected the range from 0 to 32000, assuming that would be enough. I was able to work around the issue by manually selecting a bigger range. (I also reported the bug to Apple, they told me they won't fix it because it's a deprecated API. Doesn't matter that 100s of apps, including Apple's own, were still using it...) In another case, I found out that an obscure feature (text attachments with custom cells) was crashing because AppKit called -release too often, so it was impossible to use the feature. Apple had apparently broken it when implementing the force touch functionality for dictionary lookups. Another time Cornerstone, the SVN client, was broken on a prerelease version of macOS. I don't recall the details, I think they called -registerDefaults: too early. I was able to fix it by writing a dynamic library that changed the -registerDefaults: implementation so that it ignored the first call (today with hardened runtime this fix wouldn't be possible anymore without disabling system integrity protection).
einpoklum 5y ago
I dislike this ruling, because: 1. It affirms the legal right of people or abstract entities to prevent you from copying information - that is, to have the state punish you for copying information from one page to another or from one file to another. This is immoral, anti-social. 2. It affirms the legal right to prevent you from creating modified, adapted, combined or partial versions of a piece of software or text, when you have a copy of the entire original. 3. It only allows decompilation by someone who has paid for the right to hold a copy of a program, and then only for the purpose of getting the program to work properly. Now, you could say "but that's EU law" - and while that's true, but it doesn't make it any better. People should face no negative consequences for making copies of things, whether exact or modified.
- dane-pgp 5y ago
  So you admit that the problem is the law, but you dislike the fact that the judges correctly interpreted it. If you want judges to be able to rewrite laws to your liking, you should be aware that other people with worse views on copyright might also want judges doing that.
- seoaeu 5y ago
  You were hoping that the court would find the very concept of copyright to be invalid?
all_these_years 5y ago
I am not a legal expert at all, but I guess this blurs a bit more the separation between open source and closed source... It looks like the only remaining issue is the licensing model, which would need to consider the legislation on where the software is acquired or executed. EULAs will probably be rewritten, lawyers will profit.
b20000 5y ago
will this allow decompilation of EU politicians so we can fix them?
sigmar 5y ago
>the act of correction of its errors, may not be prohibited by contract what is considered an "error" here? If I think Spotify made an "error" by calling up ads on their free tier, am I still following their ToS if I decompile and patch the app to remove ad code?
- ginko 5y ago
  Hopefully
- elygre 5y ago
  In a court case, you should probably be prepared to argue how that is an error, based on the legal mechanism that allows you to use Spotify in the first place. Then the court would answer your question. (No, I think you would not get away by that)
- sigzero 5y ago
  No, that would not work.
toolslive 5y ago
IANAL but what's the point/use of having a rule (like an EULA that forbids decompilation) that cannot be enforced?
- nolok 5y ago
  Because when you threaten users with it, most of them will comply to avoid legal actions, even if they are clearly in the right. Then add cases where "are clearly in the right" is a lot murkier to decide, and they will comply even more. Hell, the company itself might have had their lawyers figure out the user is in the right but the cost of proving it would be so high they won't succeed. Then add cases gravitating around massive sanctions if you're wrong, like copyright infringement. No every day individual is risking insane sanctions if they're wrong, even if they're 99. 9% sure they're right, and the eula allows the company to manipulate them without even committing to a legal action.
  - alerighi 5y ago
    What sanctions? I've never seen one even fined for pirating software or any other kind of media, let alone someone fined for decompiling or altering software in general. Is something that everyone does. The only thing that can get you into trouble is if you that kind of things for a profit, and that is right, but if you do that for personal use or to share it on the internet without profiting for it, nobody will ever do you anything...
    - __MatrixMan__ 5y ago
      Does Aaron Schwartz count as a counterexample? I realize he was never formally convicted but they were in the process of throwing the book at him when he died.
    - kwhitefoot 5y ago
      > never seen one even fined for pirating software or any other kind of media, It has happened in the US. Se https://www.theguardian.com/technology/2012/sep/11/minnesota-woman-songs-illegally-downloaded https://www.theguardian.com/technology/2012/sep/11/minnesota...
jhgb 5y ago
Already enshrined in my country's copyright act: decompilation for purposes of interoperability, bug-fixing, or education is exempted from copyright protection, and I don't see how a legal provision could be overridden by a contract.
- kolinko 5y ago
  Ditto in Poland. Also, it’s legal to use decompilation or even cracks to make and use backup copies of the software you purchased legally.
  - kgeist 5y ago
    Here in Russia there's federal law (since 1992): "A person who lawfully owns a copy of a computer program or database has the right <...> to carry out any actions related to the operation of a computer program or database in accordance with its purpose, including <...> correcting obvious errors."
- detaro 5y ago
  if an EU country, obviously, since this court ruling is just confirming the 1991 EU copyright directive for a specific case.
  - jhgb 5y ago
    Yes, an EU country, but as far as I can tell, we've already had these provisions since before our accession to the EU in the 2000s.
    - krzyk 5y ago
      EU law supersedes local law. So if your country one would prohibit such actions, EU law would take precedence and allow it.
      - jhgb 5y ago
        I may be wrong but I was under the impression that local law would have to be harmonized to comply with it in this case anyway. So at that point you have no contradiction of the two. That the local law would diverge instead sounds highly hypothetical.
thriftwy 5y ago
Next step: extremely large fines for putting such provision on EULA.
- balozi 5y ago
  Why not just simply decline the EULA?
zamalek 5y ago
This becomes incredibly interesting in terms of e.g. Denuvo. This anti-piracy middleware has been shown to make games unplayable, and this EU law seems to support removing it.
- uncoder0 5y ago
  I can't believe studios let their publishers force this kind of tech into their run loops.
  - bigbillheck 5y ago
    Publishers are the ones with the money.
  - InvaderFizz 5y ago
    It's understandable from a publishers perspective. Even if it only lasts a month before being cracked, it allows the publisher to capture that first month of sales without competition from TPB. That first month is typically the most important time in a game sales lifecycle. Counter to that, it should be a policy to remove Denuvo 90days post launch, as it does, in fact, cause performance issues and such.
    - sillysaurusx 5y ago
      Out of curiosity, is there any data to support this mindset? It's probably true, but Curiosity(TM).
      - pnt12 5y ago
        I don't have sources, but I believe that half the sales happen around the first few weeks.
      - zamalek 5y ago
        A closely related topic is "the tail of game sales." You will probably find game developers talking about it if you search for that. Honestly, though, the (frankly ridiculous) propensity for pre-order success radically upsets this argument.
__MatrixMan__ 5y ago
I hope somebody in the EU uses this to sell kits that rid Deere & co. equipment of its notorious maintainability bugs.
- wiz21c 5y ago
  Or cars... Or washing machines... Everything has some form of computer in it nowadays...
  - __MatrixMan__ 5y ago
    Oh yeah, absolutely. But I have a special place in my heart for someone who would use the law to ensure that less food is available.
deleted 5y ago
[deleted]
systemvoltage 5y ago
What about Fonts? Can someone find a "bug" in the font and fix it according to their taste?
- SSLy 5y ago
  Only one way to find out: get sued by a foundry and wait for the court's opinion.
- ClumsyPilot 5y ago
  An obvious bug would be fonts unsuitable fir visually impaired, low contrast, etc
deepsun 5y ago
Meta: .jsf? I thought Java Server Faces died a decade ago.
everyone 5y ago
I thought EULA's are not really worth anything anyway, cus if a case actually comes to court any EULA is usually ignored, cus all users ignore them + they often have loads of illegal stuff in them.
hyperman1 5y ago
How does this interact with yesterday's facebook story. Facebook has a buggy UI that makes it hard to unfollow everything. Some dev created a plugin to fix this. Facebook banned him and lawyered up. Is the plugin legal in europe or not? Is fixing a dark pattern a bugfix? https://news.ycombinator.com/item?id=28801908 https://news.ycombinator.com/item?id=28801908
- np_tedious 5y ago
  Sounds like two distinctions. Not sure if either is legally relevant 1) browser extension (which I guess is kind of a client side JS modification?) vs decompilation 2) bug vs feature addition My uninformed take is that Facebook's claim is weak to begin with, but that this judgment doesn't really influence anything
  - deleted 5y ago
    [deleted]
- rafale 5y ago
  It reminds me of the issue of whether game cheats are legal or not. Activision is losing a lot of money because cheats are ruining the game for everyone. Here, the only "victim" is Facebook itself. And it's not cheating as much as automating a manual process. My opinion is that Facebook overstepped here. A net negative move with all the bad PR they got, of which they already have plenty. And the attentionthe plug-in got.
- Decker87 5y ago
  Why wouldn't it be legal?
- indemnity 5y ago
  When did you acquire or purchase the Facebook app?
  - speedgoose 5y ago
    All the time with my personal data. You don't even need to install anything. Many applications and websites will do share your data to Facebook. Friends too. It's great.
cyborgx7 5y ago
If the legal system was anything but a farce all EULAs and TOSs would be declared invalid, as all parties are aware that they aren't being read before being agreed to.
- user5994461 5y ago
  Fact is, they are invalid in many countries. One major rationale is that the EULA/ToS is only visible after purchasing the product, which makes it void automatically. How could the customer agree to something they are not aware of and cannot read?
chuckee 5y ago
While I welcome this decision, it is absurd that the law places any limits whatsoever on the act of examining how an artifact you legally own functions. What they like to call "reverse engineering", because describing in plain language what is being forbidden would reveal what a severe limit on personal rights this is. Especially as we are being surrounded by devices where "reverse engineering" is the only way to determine what they do. Such laws are no less than restrictions on what we are allowed to discover about our environment.
- burrows 5y ago
  > it is absurd that the law places any limits whatsoever on the act of examining how an artifact you legally own functions. You’re just smuggling in your own implicit definition of “legally own”. As you’ve pointed out, “ownership” is a legal construct. One that can feature any number of limitations or clauses through the execution of a contract.
  - chuckee 5y ago
    > You’re just smuggling in your own implicit definition of “legally own”. I suppose before trade secret laws were effectively expanded to items in our own homes, the commonly accepted definition of "own a thing" was "you are allowed use of the thing, but not to examine how the thing works"? It's not I who is doing the smuggling, and there's a reason the law uses obfuscatory language.
    - zootboy 5y ago
      I don't think "you can't examine how a thing works" has ever been a condition of ownership. And even current trade secret laws carve out exceptions for information that can be obtained via other means. The Uniform Trade Secrets Act (with 1985 amendments) explicitly mentions reverse engineering being OK and includes references to relevant case law.
herio 5y ago
It would be interesting to know how they would classify modern "rented" software like the Adobe CS Suite or Office 365. They are installed on your machine but works like SaaS. It's kind of a gray area for me at least, does it mean you own a copy or not? I'm sure it doesn't but I also know that legal system do not generally deal in shades, they are binary, either a or b. If it legally means that you own a copy, this would in theory allow you to patch the online checking out of it to keep it running.
- brezelgoring 5y ago
  You can still decompile the binaries for Office products today, they are desktop products after all. Same for the Adobe CS suite, AFAIK. What you can't do is decompile the server-side stuff. In case that stopped working somehow, you could find a way to remove the dependency on online stuffs from your desktop product, it's been done before, often in cracks. If they fully move to web based SaaS and abandon desktop implementations completely, then yes, you'd be right, you'd no longer be able to modify it in any way.
- qwertox 5y ago
  Same question goes for an unwanted FinFisher installation on your machine. After all, you're somewhat of a licensed user if a licensed user installed it lawfully on your machine. And since it has bugs in it, it should meet the criteria.
- analog31 5y ago
  I'm thinking of an analogy: Renting a house. If the house needs repair, I'd probably give the landlord a fair chance to fix it, but would also feel entitled to fix it myself if the problem interfered with the functioning of the house.
swayvil 5y ago
This will definitely encourage the production of bug-free commercial software.
alkonaut 5y ago
Wait is decompolation ever forbidden anywhere? Why? I’m not reproducing anything until I use anything I learned producing something similar, at which point I might be in trouble (at least if I publish the reproduction). But forbidding decompilation? That’s like forbidding someone to buy a car to take it apart and learn exactly how it was put together - which is what every manufacturer does with competitors’ cars.
- Jensson 5y ago
  Decomplication isn't forbidden, however a lot of acts related to decomplication are forbidden. Similarly you cannot reverse engineer a car and use that knowledge to build a replica to sell or to mass produce copies for your company to use. The special case here is that the information gained from decomplication can legally be used to fix bugs. So basically the law is there to protect small shops from having their product stolen or their licence agreement circumvented by big companies. Otherwise a big company could just buy a single licence of your software, reverse engineer it, change it so that they get features for free they otherwise would have to pay for etc.
  - alkonaut 5y ago
    But either something is patented or otherwise protected, or it isn’t. You can’t sell a car whose secret sauce to high margin sales is a fender production method that will be obvious to anyone taking it apart and then cry foul when someone does take it apart. > buy a single licence of your software, reverse engineer it, change it so that they get features for free they otherwise would have to pay for etc. That seems like standard licensing? The forbidden part about unlicensed use of software is using it.
  - userbinator 5y ago
    Similarly you cannot reverse engineer a car and use that knowledge to build a replica to sell or to mass produce copies for your company to use. Yes, actually you can... that's why the whole aftermarket exists. AFAIK it is trademark law that prevents you from selling a true replica, but otherwise how do you think all those compatible parts --- in fact many of them better than OEM --- were created? You can build an entire small-block Chevy and not use any parts manufactured by GM, for example. The same goes for the rest of the vehicle. Even replacement body panels are available. The main difference is that software has zero cost to copy, whereas trying to create an entire car from 100% aftermarket parts would cost many times more than the real thing.
ajsnigrutin 5y ago
I'm really not sure why software is treated differently from eg. hardware. Am I allowed to modify my washing machine, if i want to eg. use it for sous-vide? Sure. I might lose my warranty, I might not be able to resell it as a washing machine without disclosing the not-up-to-electrical-code work, but I'm pretty sure the manufacturer can not sue me for modifying it and/or posting an instructional video of how to do it. Buying software and treating it as a "borrowing" is something that has to be stopped.
- Jensson 5y ago
  Problem is that when you buy software you often get more code than you paid for, and that code is hidden by a feature flag. Reverse engineering the code and fixing that feature flag is therefore illegal, because otherwise that business model wouldn't work. In practice nobody will sue you as an individual for doing that, but lets say that Microsoft does it to avoid millions in licensing fees, then you have a reasonable legal case against them. If what you say would be completely legal then many big companies would absolutely start doing that. Do you think that would be a good thing?
  - gpm 5y ago
    It's easy to compile (or transpile in interpreted languages) the code needed to implement a feature flag entirely out of the binary you distribute to customers who haven't paid for it. I don't see that this is a problem.
  - ajsnigrutin 5y ago
    So what? If they sold a feature, it's yours. If I buy a car containing eg. heated seats, but the feature is disabled, because I didnt select the proper addon package, who is going to sue me, if I add a switch, and connect the heating elements to 12V supply myself? Or buy an addon controller? Or even buy addon seat heaters?
    - Qwertious 5y ago
      In practice, if you buy the car hypothetically containing heating seats but the feature is disabled, then the hypothetical company (that is probably Tesla) will void your warranty and refuse repairs. Which is a great argument for Right to Repair, but makes everything a hassle on the consumer side - any future interaction with the company around the vehicle is a landmmine waiting to be triggered.
solarkraft 5y ago
Well, cool. It’s nice that it’s allowed now. Now please make it feasible or, better yet, unnecessary.
wly_cdgr 5y ago
People are definitely gonna use this ruling to justify reverse engineering games to modify the game design, claiming that the balancing/mechanics are "buggy". Some of that will be in earnest, some of it will be cover for pirates. The stuff that will be in earnest will make for some interesting arguments about who really owns a game design once it's out in the world, and what constitutes a bug vs a design choice/flaw
patrakov 5y ago
I don't see how the ruling helps. 1. The copyright holder can include a dummy clause in the contract that prohibits decompilation, except if there is a written permission from the copyright holder, or in cases where existing local laws permit it. This is sufficient to turn down the part of the law that applies only where there is no such clause. 2. The copyright holder can always claim that decompilation is never necessary for the user to have the errors in the program corrected, or to achieve interoperability. "Indeed, all the user had to do is to pay $1000000000 for UltraPremium support". P.S. I am not a lawyer.
- EEBio 5y ago
  You can correct any errors regardless of any contractual provisions. In the absence of contractual provisions, you can perform additional changes to the software. So if there is a bug, you can fix it yourself, whether or not the provisioning company has a(n) (un)paid plan for you that fixes it. This makes sense - otherwise you could once in a while let a bug "slip" to production intentionally and then ransom your users for more payment. The relevant part of the law: > Whereas this means that the acts of loading and running necessary for the use of a copy of a program which has been lawfully acquired, and the act of correction of its errors, may not be prohibited by contract; whereas, in the absence of specific contractual provisions, including when a copy of the program has been sold, any other act necessary for the use of the copy of a program may be performed in accordance with its intended purpose by a lawful acquirer of that copy;

938 points by aleclm 5y ago

chris_wot 5y ago

And suddenly it became legal to decompile code to find exploits. Awesome!

brezelgoring 5y ago
Nothing stopped you from doing it before, only difference is, now you can do it openly. Hopefully for good purposes.
- chris_wot 5y ago
  Indeed, I quite agree.
cute_boi 5y ago
why is this a bad thing? If someone company like google/microsoft ships backdoors due to government then decompiling and finding bugs will help humanity right?
- chris_wot 5y ago
  I didn't say it was. I am genuinely happy that it is now legal.
adrian_b 5y ago
Do you really believe that anyone who has the intention to find exploits cares about whether decompilation is legal or not?
- chris_wot 5y ago
  No, not really. I like that it is legal to do so now.
crest 5y ago
</sarcasm> ?
- chris_wot 5y ago
  No, I was actually happy about this.
orra 5y ago
Reverse engineering for interoperability has been legal in the EU since at least the 1991 Software Directive. Yes, there's a requirement for interoperability, but "interoperability" is construed broadly. Interoperability in law relates to "interfaces", including APIs, and compatible file formats. Conceivably the term could also be used to describe an antivirus program which protects the program in question. That's good this is allowed. Besides, bad faith actors will reverse engineer for malicious purposes, regardless of the law.
maxpro 5y ago
As this would stop someone writing exploits from decompiling
dahart 5y ago
It did not become legal to decompile code to find exploits. This EU ruling affirms the legality only in the EU to decompile code only for the purpose of fixing bugs.
TeMPOraL 5y ago
One man's exploit is another man's accessibility feature. Exploits by themselves aren't good or bad - their use for malicious purposes is. See also: adversarial interoperability.
- chris_wot 5y ago
  Indeed, we are not disagreeing. I'm very happy that it is now legal. That's what I wrote, I think people have read into my comment that I'm being sarcastic, where I'm not.
_kbh_ 5y ago
this has always been legal in a lot of countries.

brezelgoring 5y ago

This sounds incredible, does it allow for redistribution of the fixed product? Or is it just for the purposes of notifying the creator of the problem and its solution in one go?

mrtksn 5y ago
You probably can buy, fix and re-sell software. I recall about some EU court ruling that made it clear that you can definitely sell the software you bought.
- gambiting 5y ago
  It's been ruled this way over and over and over again - you can definitely resell OEM software no matter what the licence says, it's your right as a consumer in the EU. My company bought a 50-user MSSQL 2019 licence for cheap(like €1000) because a company was going into bankruptcy and software was being sold off separately to all hardware.
moreira 5y ago
I can't tell, but it'd never be allowed. Grab an AAA game, fix a bug in it, and now you're free to redistribute the game without consequences. That'd be insane.
- roflc0ptic 5y ago
  Yeah a patch should be fine though
- brezelgoring 5y ago
  My idea wasn't to redistribute the whole thing, but to distribute a patch that other owners of the game can use by themselves? Now that's a win. I also love the idea of adding newer OS compatibility to old software, seeing old video games running on Windows 10 would be thrilling. Perhaps do the same for drivers of old hardware? Also a win, IMO. Another big question, in these patches, can I do only the fixes I can justify? Or can I go wild and remove the parts I don't like? I'd love to remove telemetry from my TV and all those weird apps it comes with that are in Chinese and are unusable outside China.

orra 5y ago

IMHO this is a sensible decision, one that reflects the clear underlying intention of the statute. Article 5(1) of the Directive says: > [certain acts] shall not require authorization by the rightholder where they are necessary for the use of the computer program by the lawful acquirer in accordance with its intended purpose, including for error correction. Essentially, they have ruled that other Articles in the Directive do not supersede this Article, and that reverse engineering to correct an error can be necessary. This court, the CJEU, has good form on sensible decisions regarding computing. For example, SAS vs World Programming (C‑406/10) allowed reverse engineering for interoperability. That case, also, was the court upholding the clear intention of the statute. Moreover there was UsedSoft vs Oracle (C-128/11), allowing the resale of software licences, including the right to download the software where necessary, upon purchasing a second hand licence.

agilob 5y ago
This is sensible because it's the same as taking laptop apart to replace failing RAM or disk.
- orra 5y ago
  Absolutely agreed, morally it's the right decision. I was just focusing on the law because copyright expansionists have a lot of institutional capture, or at least the ear of legislators. So even though the intention of the Directive was clear, I wouldn't have been entirely shocked if the court had decided against decompilation being allowed for fixing bugs.
phkahler 5y ago
So patching it to work without company servers after they've been shut down might be ok too!
- orra 5y ago
  You'd hope so. There's also the CJEU case of Ninetendo v PC Box & 9 Net (C-355/12), which sets out circumstances where it's lawful to sell a device which circumvents DRM. Alas in that case, the bar is set too high: it's not enough for there to be legitimate reasons to break the DRM; that has to be weighed against the 'rights' of copyright holders.

detaro 5y ago

Nice to see the court confirm the law is as broad as it was taken to be, and that it can't be worked around with EULA bullshit.

balozi 5y ago
The EULA is still an agreement. Potential end users have an opportunity to not accept the agreement and walk away. I think this ruling is populist pandering that ends with reduced incentive for commercial software. Undermining property rights has never resulted in freer societies.
- matheusmoreira 5y ago
  > The EULA is still an agreement. Agreements can't violate the law. They most certainly cannot deny people their rights. > Potential end users have an opportunity to not accept the agreement and walk away. No, they can and should be able to use the software regardless of any abusive clauses included in the contract. Companies should be punished for even thinking they could get away with confusing laymen with their illegal conditions. People have the right to reverse engineer. Companies are just gonna have to deal with it. It doesn't matter if they lose money. > Undermining property rights has never resulted in freer societies. Real property rights, yeah. Intellectual property is not real property. It barely makes sense in the 21st century.
- yariik 5y ago
  > The EULA is still an agreement. I can't agree to anything that is impossible for me to understand or even to read.
- no_time 5y ago
  This is the exact opposite of undermining property rights. You sold a thing to me. Your control over that thing ends when I hand over the money. I may be forbidden from patching in a new logo and reselling it, but you that's about all you can expect me NOT to do with it.

oytis 5y ago

Can someone share cases/anecdotes of decompiling software to fix a bug? Never done it myself nor heard someone doing that. Unless you consider not being able to run a program without license a bug :)

to11mtm 5y ago
I can't do one for Decompiling, but I reverse engineered a Pole-line drafting application in order to write utilities to fix the data corruption it sometimes caused.
niea_11 5y ago
GTA Online fix to reduce loading times [1]. Rockstar awarded the guy 10k$ [2] 1: https://nee.lv/2021/02/28/How-I-cut-GTA-Online-loading-times-by-70/ https://nee.lv/2021/02/28/How-I-cut-GTA-Online-loading-times... 2: https://www.pcgamer.com/rockstar-thanks-gta-online-player-who-fixed-poor-load-times-official-update-coming/ https://www.pcgamer.com/rockstar-thanks-gta-online-player-wh...
- xojoc 5y ago
  And there was some talk about that previously: On HN: https://news.ycombinator.com/item?id=26296339 https://news.ycombinator.com/item?id=26296339 (703 comments) On Lobsters: https://lobste.rs/s/jzj4q9 https://lobste.rs/s/jzj4q9 (25 comments) And Reddit: https://www.reddit.com/r/programming/comments/luq9oz https://www.reddit.com/r/programming/comments/luq9oz (1022 comments) P.S. these threads where found with a site I'm building: https://discussions.xojoc.pw/?url=https%3A%2F%2Fnee.lv%2F2021%2F02%2F28%2FHow-I-cut-GTA-Online-loading-times-by-70%2F https://discussions.xojoc.pw/?url=https%3A%2F%2Fnee.lv%2F202...
deleted 5y ago
[deleted]
yarcob 5y ago
I have decompiled AppKit on macOS occasionally to debug issues in my app. For example, in one case I discovered that double clicking a cell sometimes only selected part of the contents. With Hopper I was able to verify that the bug is that AppKit just selected the range from 0 to 32000, assuming that would be enough. I was able to work around the issue by manually selecting a bigger range. (I also reported the bug to Apple, they told me they won't fix it because it's a deprecated API. Doesn't matter that 100s of apps, including Apple's own, were still using it...) In another case, I found out that an obscure feature (text attachments with custom cells) was crashing because AppKit called -release too often, so it was impossible to use the feature. Apple had apparently broken it when implementing the force touch functionality for dictionary lookups. Another time Cornerstone, the SVN client, was broken on a prerelease version of macOS. I don't recall the details, I think they called -registerDefaults: too early. I was able to fix it by writing a dynamic library that changed the -registerDefaults: implementation so that it ignored the first call (today with hardened runtime this fix wouldn't be possible anymore without disabling system integrity protection).

einpoklum 5y ago

I dislike this ruling, because: 1. It affirms the legal right of people or abstract entities to prevent you from copying information - that is, to have the state punish you for copying information from one page to another or from one file to another. This is immoral, anti-social. 2. It affirms the legal right to prevent you from creating modified, adapted, combined or partial versions of a piece of software or text, when you have a copy of the entire original. 3. It only allows decompilation by someone who has paid for the right to hold a copy of a program, and then only for the purpose of getting the program to work properly. Now, you could say "but that's EU law" - and while that's true, but it doesn't make it any better. People should face no negative consequences for making copies of things, whether exact or modified.

dane-pgp 5y ago
So you admit that the problem is the law, but you dislike the fact that the judges correctly interpreted it. If you want judges to be able to rewrite laws to your liking, you should be aware that other people with worse views on copyright might also want judges doing that.
seoaeu 5y ago
You were hoping that the court would find the very concept of copyright to be invalid?

all_these_years 5y ago

I am not a legal expert at all, but I guess this blurs a bit more the separation between open source and closed source... It looks like the only remaining issue is the licensing model, which would need to consider the legislation on where the software is acquired or executed. EULAs will probably be rewritten, lawyers will profit.

b20000 5y ago

will this allow decompilation of EU politicians so we can fix them?

sigmar 5y ago

>the act of correction of its errors, may not be prohibited by contract what is considered an "error" here? If I think Spotify made an "error" by calling up ads on their free tier, am I still following their ToS if I decompile and patch the app to remove ad code?

ginko 5y ago
Hopefully
elygre 5y ago
In a court case, you should probably be prepared to argue how that is an error, based on the legal mechanism that allows you to use Spotify in the first place. Then the court would answer your question. (No, I think you would not get away by that)
sigzero 5y ago
No, that would not work.

toolslive 5y ago

IANAL but what's the point/use of having a rule (like an EULA that forbids decompilation) that cannot be enforced?

nolok 5y ago
Because when you threaten users with it, most of them will comply to avoid legal actions, even if they are clearly in the right. Then add cases where "are clearly in the right" is a lot murkier to decide, and they will comply even more. Hell, the company itself might have had their lawyers figure out the user is in the right but the cost of proving it would be so high they won't succeed. Then add cases gravitating around massive sanctions if you're wrong, like copyright infringement. No every day individual is risking insane sanctions if they're wrong, even if they're 99. 9% sure they're right, and the eula allows the company to manipulate them without even committing to a legal action.
- alerighi 5y ago
  What sanctions? I've never seen one even fined for pirating software or any other kind of media, let alone someone fined for decompiling or altering software in general. Is something that everyone does. The only thing that can get you into trouble is if you that kind of things for a profit, and that is right, but if you do that for personal use or to share it on the internet without profiting for it, nobody will ever do you anything...
  - __MatrixMan__ 5y ago
    Does Aaron Schwartz count as a counterexample? I realize he was never formally convicted but they were in the process of throwing the book at him when he died.
  - kwhitefoot 5y ago
    > never seen one even fined for pirating software or any other kind of media, It has happened in the US. Se https://www.theguardian.com/technology/2012/sep/11/minnesota-woman-songs-illegally-downloaded https://www.theguardian.com/technology/2012/sep/11/minnesota...

jhgb 5y ago

Already enshrined in my country's copyright act: decompilation for purposes of interoperability, bug-fixing, or education is exempted from copyright protection, and I don't see how a legal provision could be overridden by a contract.

kolinko 5y ago
Ditto in Poland. Also, it’s legal to use decompilation or even cracks to make and use backup copies of the software you purchased legally.
- kgeist 5y ago
  Here in Russia there's federal law (since 1992): "A person who lawfully owns a copy of a computer program or database has the right <...> to carry out any actions related to the operation of a computer program or database in accordance with its purpose, including <...> correcting obvious errors."
detaro 5y ago
if an EU country, obviously, since this court ruling is just confirming the 1991 EU copyright directive for a specific case.
- jhgb 5y ago
  Yes, an EU country, but as far as I can tell, we've already had these provisions since before our accession to the EU in the 2000s.
  - krzyk 5y ago
    EU law supersedes local law. So if your country one would prohibit such actions, EU law would take precedence and allow it.
    - jhgb 5y ago
      I may be wrong but I was under the impression that local law would have to be harmonized to comply with it in this case anyway. So at that point you have no contradiction of the two. That the local law would diverge instead sounds highly hypothetical.

thriftwy 5y ago

Next step: extremely large fines for putting such provision on EULA.

balozi 5y ago
Why not just simply decline the EULA?

zamalek 5y ago

This becomes incredibly interesting in terms of e.g. Denuvo. This anti-piracy middleware has been shown to make games unplayable, and this EU law seems to support removing it.

uncoder0 5y ago
I can't believe studios let their publishers force this kind of tech into their run loops.
- bigbillheck 5y ago
  Publishers are the ones with the money.
- InvaderFizz 5y ago
  It's understandable from a publishers perspective. Even if it only lasts a month before being cracked, it allows the publisher to capture that first month of sales without competition from TPB. That first month is typically the most important time in a game sales lifecycle. Counter to that, it should be a policy to remove Denuvo 90days post launch, as it does, in fact, cause performance issues and such.
  - sillysaurusx 5y ago
    Out of curiosity, is there any data to support this mindset? It's probably true, but Curiosity(TM).
    - pnt12 5y ago
      I don't have sources, but I believe that half the sales happen around the first few weeks.
    - zamalek 5y ago
      A closely related topic is "the tail of game sales." You will probably find game developers talking about it if you search for that. Honestly, though, the (frankly ridiculous) propensity for pre-order success radically upsets this argument.

__MatrixMan__ 5y ago

I hope somebody in the EU uses this to sell kits that rid Deere & co. equipment of its notorious maintainability bugs.

wiz21c 5y ago
Or cars... Or washing machines... Everything has some form of computer in it nowadays...
- __MatrixMan__ 5y ago
  Oh yeah, absolutely. But I have a special place in my heart for someone who would use the law to ensure that less food is available.

deleted 5y ago

[deleted]

systemvoltage 5y ago

What about Fonts? Can someone find a "bug" in the font and fix it according to their taste?

SSLy 5y ago
Only one way to find out: get sued by a foundry and wait for the court's opinion.
ClumsyPilot 5y ago
An obvious bug would be fonts unsuitable fir visually impaired, low contrast, etc

deepsun 5y ago

Meta: .jsf? I thought Java Server Faces died a decade ago.

everyone 5y ago

I thought EULA's are not really worth anything anyway, cus if a case actually comes to court any EULA is usually ignored, cus all users ignore them + they often have loads of illegal stuff in them.

hyperman1 5y ago

How does this interact with yesterday's facebook story. Facebook has a buggy UI that makes it hard to unfollow everything. Some dev created a plugin to fix this. Facebook banned him and lawyered up. Is the plugin legal in europe or not? Is fixing a dark pattern a bugfix? https://news.ycombinator.com/item?id=28801908 https://news.ycombinator.com/item?id=28801908

np_tedious 5y ago
Sounds like two distinctions. Not sure if either is legally relevant 1) browser extension (which I guess is kind of a client side JS modification?) vs decompilation 2) bug vs feature addition My uninformed take is that Facebook's claim is weak to begin with, but that this judgment doesn't really influence anything
- deleted 5y ago
  [deleted]
rafale 5y ago
It reminds me of the issue of whether game cheats are legal or not. Activision is losing a lot of money because cheats are ruining the game for everyone. Here, the only "victim" is Facebook itself. And it's not cheating as much as automating a manual process. My opinion is that Facebook overstepped here. A net negative move with all the bad PR they got, of which they already have plenty. And the attentionthe plug-in got.
Decker87 5y ago
Why wouldn't it be legal?
indemnity 5y ago
When did you acquire or purchase the Facebook app?
- speedgoose 5y ago
  All the time with my personal data. You don't even need to install anything. Many applications and websites will do share your data to Facebook. Friends too. It's great.

cyborgx7 5y ago

If the legal system was anything but a farce all EULAs and TOSs would be declared invalid, as all parties are aware that they aren't being read before being agreed to.

user5994461 5y ago
Fact is, they are invalid in many countries. One major rationale is that the EULA/ToS is only visible after purchasing the product, which makes it void automatically. How could the customer agree to something they are not aware of and cannot read?

chuckee 5y ago

While I welcome this decision, it is absurd that the law places any limits whatsoever on the act of examining how an artifact you legally own functions. What they like to call "reverse engineering", because describing in plain language what is being forbidden would reveal what a severe limit on personal rights this is. Especially as we are being surrounded by devices where "reverse engineering" is the only way to determine what they do. Such laws are no less than restrictions on what we are allowed to discover about our environment.

burrows 5y ago
> it is absurd that the law places any limits whatsoever on the act of examining how an artifact you legally own functions. You’re just smuggling in your own implicit definition of “legally own”. As you’ve pointed out, “ownership” is a legal construct. One that can feature any number of limitations or clauses through the execution of a contract.
- chuckee 5y ago
  > You’re just smuggling in your own implicit definition of “legally own”. I suppose before trade secret laws were effectively expanded to items in our own homes, the commonly accepted definition of "own a thing" was "you are allowed use of the thing, but not to examine how the thing works"? It's not I who is doing the smuggling, and there's a reason the law uses obfuscatory language.
  - zootboy 5y ago
    I don't think "you can't examine how a thing works" has ever been a condition of ownership. And even current trade secret laws carve out exceptions for information that can be obtained via other means. The Uniform Trade Secrets Act (with 1985 amendments) explicitly mentions reverse engineering being OK and includes references to relevant case law.

herio 5y ago

It would be interesting to know how they would classify modern "rented" software like the Adobe CS Suite or Office 365. They are installed on your machine but works like SaaS. It's kind of a gray area for me at least, does it mean you own a copy or not? I'm sure it doesn't but I also know that legal system do not generally deal in shades, they are binary, either a or b. If it legally means that you own a copy, this would in theory allow you to patch the online checking out of it to keep it running.

brezelgoring 5y ago
You can still decompile the binaries for Office products today, they are desktop products after all. Same for the Adobe CS suite, AFAIK. What you can't do is decompile the server-side stuff. In case that stopped working somehow, you could find a way to remove the dependency on online stuffs from your desktop product, it's been done before, often in cracks. If they fully move to web based SaaS and abandon desktop implementations completely, then yes, you'd be right, you'd no longer be able to modify it in any way.
qwertox 5y ago
Same question goes for an unwanted FinFisher installation on your machine. After all, you're somewhat of a licensed user if a licensed user installed it lawfully on your machine. And since it has bugs in it, it should meet the criteria.
analog31 5y ago
I'm thinking of an analogy: Renting a house. If the house needs repair, I'd probably give the landlord a fair chance to fix it, but would also feel entitled to fix it myself if the problem interfered with the functioning of the house.

swayvil 5y ago

This will definitely encourage the production of bug-free commercial software.

alkonaut 5y ago

Wait is decompolation ever forbidden anywhere? Why? I’m not reproducing anything until I use anything I learned producing something similar, at which point I might be in trouble (at least if I publish the reproduction). But forbidding decompilation? That’s like forbidding someone to buy a car to take it apart and learn exactly how it was put together - which is what every manufacturer does with competitors’ cars.

Jensson 5y ago
Decomplication isn't forbidden, however a lot of acts related to decomplication are forbidden. Similarly you cannot reverse engineer a car and use that knowledge to build a replica to sell or to mass produce copies for your company to use. The special case here is that the information gained from decomplication can legally be used to fix bugs. So basically the law is there to protect small shops from having their product stolen or their licence agreement circumvented by big companies. Otherwise a big company could just buy a single licence of your software, reverse engineer it, change it so that they get features for free they otherwise would have to pay for etc.
- alkonaut 5y ago
  But either something is patented or otherwise protected, or it isn’t. You can’t sell a car whose secret sauce to high margin sales is a fender production method that will be obvious to anyone taking it apart and then cry foul when someone does take it apart. > buy a single licence of your software, reverse engineer it, change it so that they get features for free they otherwise would have to pay for etc. That seems like standard licensing? The forbidden part about unlicensed use of software is using it.
- userbinator 5y ago
  Similarly you cannot reverse engineer a car and use that knowledge to build a replica to sell or to mass produce copies for your company to use. Yes, actually you can... that's why the whole aftermarket exists. AFAIK it is trademark law that prevents you from selling a true replica, but otherwise how do you think all those compatible parts --- in fact many of them better than OEM --- were created? You can build an entire small-block Chevy and not use any parts manufactured by GM, for example. The same goes for the rest of the vehicle. Even replacement body panels are available. The main difference is that software has zero cost to copy, whereas trying to create an entire car from 100% aftermarket parts would cost many times more than the real thing.

ajsnigrutin 5y ago

I'm really not sure why software is treated differently from eg. hardware. Am I allowed to modify my washing machine, if i want to eg. use it for sous-vide? Sure. I might lose my warranty, I might not be able to resell it as a washing machine without disclosing the not-up-to-electrical-code work, but I'm pretty sure the manufacturer can not sue me for modifying it and/or posting an instructional video of how to do it. Buying software and treating it as a "borrowing" is something that has to be stopped.

Jensson 5y ago
Problem is that when you buy software you often get more code than you paid for, and that code is hidden by a feature flag. Reverse engineering the code and fixing that feature flag is therefore illegal, because otherwise that business model wouldn't work. In practice nobody will sue you as an individual for doing that, but lets say that Microsoft does it to avoid millions in licensing fees, then you have a reasonable legal case against them. If what you say would be completely legal then many big companies would absolutely start doing that. Do you think that would be a good thing?
- gpm 5y ago
  It's easy to compile (or transpile in interpreted languages) the code needed to implement a feature flag entirely out of the binary you distribute to customers who haven't paid for it. I don't see that this is a problem.
- ajsnigrutin 5y ago
  So what? If they sold a feature, it's yours. If I buy a car containing eg. heated seats, but the feature is disabled, because I didnt select the proper addon package, who is going to sue me, if I add a switch, and connect the heating elements to 12V supply myself? Or buy an addon controller? Or even buy addon seat heaters?
  - Qwertious 5y ago
    In practice, if you buy the car hypothetically containing heating seats but the feature is disabled, then the hypothetical company (that is probably Tesla) will void your warranty and refuse repairs. Which is a great argument for Right to Repair, but makes everything a hassle on the consumer side - any future interaction with the company around the vehicle is a landmmine waiting to be triggered.

solarkraft 5y ago

Well, cool. It’s nice that it’s allowed now. Now please make it feasible or, better yet, unnecessary.

wly_cdgr 5y ago

People are definitely gonna use this ruling to justify reverse engineering games to modify the game design, claiming that the balancing/mechanics are "buggy". Some of that will be in earnest, some of it will be cover for pirates. The stuff that will be in earnest will make for some interesting arguments about who really owns a game design once it's out in the world, and what constitutes a bug vs a design choice/flaw

patrakov 5y ago

I don't see how the ruling helps. 1. The copyright holder can include a dummy clause in the contract that prohibits decompilation, except if there is a written permission from the copyright holder, or in cases where existing local laws permit it. This is sufficient to turn down the part of the law that applies only where there is no such clause. 2. The copyright holder can always claim that decompilation is never necessary for the user to have the errors in the program corrected, or to achieve interoperability. "Indeed, all the user had to do is to pay $1000000000 for UltraPremium support". P.S. I am not a lawyer.

EEBio 5y ago
You can correct any errors regardless of any contractual provisions. In the absence of contractual provisions, you can perform additional changes to the software. So if there is a bug, you can fix it yourself, whether or not the provisioning company has a(n) (un)paid plan for you that fixes it. This makes sense - otherwise you could once in a while let a bug "slip" to production intentionally and then ransom your users for more payment. The relevant part of the law: > Whereas this means that the acts of loading and running necessary for the use of a copy of a program which has been lawfully acquired, and the act of correction of its errors, may not be prohibited by contract; whereas, in the absence of specific contractual provisions, including when a copy of the program has been sold, any other act necessary for the use of the copy of a program may be performed in accordance with its intended purpose by a lawful acquirer of that copy;