3 ms·

Surely a judge won't make a company provide their source code in discovery unless you can provide evidence that it uses code stolen from you. I think that's wha

by paulgb 5y ago

Surely a judge won't make a company provide their source code in discovery unless you can provide evidence that it uses code stolen from you. I think that's what bink is getting at -- if you suspect that someone is using your stolen code but they remove any public-facing evidence that would convince a judge to have them provide the code to you, what recourse do you have?

woodruffw 5y ago
> Surely a judge won't make a company provide their source code in discovery unless you can provide evidence that it uses code stolen from you. In this particular case, there appears to be ample public evidence that the code was stolen (people have demonstrated that the stylesheets and assets distributed by TRUTH were taken directly from the Mastodon project). So I suspect, in this particular case, that a judge would not object to a source code audit during discovery. To the more general point: there are mechanisms that the court can avail itself of in more ambiguous situations. For example, a judge would be perfectly within their power to require the defendant to provide their source code to an independent evaluator.
jenny91 5y ago
No, it's right. In the US you can sue them if you suspect they're using your software in an infringing way, then use the discovery process to unearth this evidence.
- paulgb 5y ago
  You can try, sure. But AFAIK you can't just serve someone papers and compel them to turn over documents; a judge's discretion is involved in the process. If you say "I wrote some open-source self-driving car code and I think Waymo is using it", there's no way they're just going to hand over their self-driving car code.
  - pas 5y ago
    No, obviously. They can appoint an expert to do this fact-finding. Sure the defendant will file a motion to dismiss the whole lawsuit probably claiming that it's frivolous, or whatnot.
gpm 5y ago
> they remove any public-facing evidence You screenshot the evidence before letting them know that it exists, and then you take that to the judge. "But we took down the site" isn't going to stop them from ordering discovery or stop your screenshots from being evidence... It can't be a total fishing expedition, but it doesn't need to be much more (as I understand it, not a lawyer). There's also always the human element, someone on the inside let's you know (and indeed, you might compensate them for that, like the Software Alliance does). There's also the fact that most software isn't exactly... subtle... about what it is in the backend. Error pages and such are often quite distinctive.
- paulgb 5y ago
  I see the ambiguity now, but I meant if they remove the evidence before making it public. Sure, if the code itself spans the client/server boundary, it's easy to find it, but it doesn't really work if they're just using a library on the backend that isn't exposed directly to the user.
bink 5y ago
This is exactly what I was getting at. In the case of commercial software so long as the suspected violation occurs at a company with a license agreement that allows these audits then they can be audited at the drop of a hat. I can picture an open source project knowing that a company must be using their code but not really having a way to prove it in front of a judge ("their software is behaving suspiciously similarly ours"). These projects are unlikely to have the resources or desire to go through the legal steps necessary to get an audit granted by a judge. Or in this case, they at one point were using the software in violation of the license, but if they claim that they are no longer doing so and have obfuscated the front-end so it's not possible to prove anymore... I'm curious how that would play out.

by paulgb 5y ago

woodruffw 5y ago

> Surely a judge won't make a company provide their source code in discovery unless you can provide evidence that it uses code stolen from you. In this particular case, there appears to be ample public evidence that the code was stolen (people have demonstrated that the stylesheets and assets distributed by TRUTH were taken directly from the Mastodon project). So I suspect, in this particular case, that a judge would not object to a source code audit during discovery. To the more general point: there are mechanisms that the court can avail itself of in more ambiguous situations. For example, a judge would be perfectly within their power to require the defendant to provide their source code to an independent evaluator.

jenny91 5y ago

No, it's right. In the US you can sue them if you suspect they're using your software in an infringing way, then use the discovery process to unearth this evidence.

paulgb 5y ago
You can try, sure. But AFAIK you can't just serve someone papers and compel them to turn over documents; a judge's discretion is involved in the process. If you say "I wrote some open-source self-driving car code and I think Waymo is using it", there's no way they're just going to hand over their self-driving car code.
- pas 5y ago
  No, obviously. They can appoint an expert to do this fact-finding. Sure the defendant will file a motion to dismiss the whole lawsuit probably claiming that it's frivolous, or whatnot.

gpm 5y ago

> they remove any public-facing evidence You screenshot the evidence before letting them know that it exists, and then you take that to the judge. "But we took down the site" isn't going to stop them from ordering discovery or stop your screenshots from being evidence... It can't be a total fishing expedition, but it doesn't need to be much more (as I understand it, not a lawyer). There's also always the human element, someone on the inside let's you know (and indeed, you might compensate them for that, like the Software Alliance does). There's also the fact that most software isn't exactly... subtle... about what it is in the backend. Error pages and such are often quite distinctive.

paulgb 5y ago
I see the ambiguity now, but I meant if they remove the evidence before making it public. Sure, if the code itself spans the client/server boundary, it's easy to find it, but it doesn't really work if they're just using a library on the backend that isn't exposed directly to the user.

bink 5y ago

This is exactly what I was getting at. In the case of commercial software so long as the suspected violation occurs at a company with a license agreement that allows these audits then they can be audited at the drop of a hat. I can picture an open source project knowing that a company must be using their code but not really having a way to prove it in front of a judge ("their software is behaving suspiciously similarly ours"). These projects are unlikely to have the resources or desire to go through the legal steps necessary to get an audit granted by a judge. Or in this case, they at one point were using the software in violation of the license, but if they claim that they are no longer doing so and have obfuscated the front-end so it's not possible to prove anymore... I'm curious how that would play out.