9 ms·

People are misunderstanding this and claiming it's not problematic. Ben Torrell (an OBS developer) notes later in the thread that there is indeed GPL code compi

People are misunderstanding this and claiming it's not problematic. Ben Torrell (an OBS developer) notes later in the thread that there is indeed GPL code compiled into TikTok's executables; since source is not available and they have not got another license, it is unlicensed and hence illegal.

mynameismon 5y ago
Relavant Tweet: https://twitter.com/dodgepong/status/1471522226520346632 https://twitter.com/dodgepong/status/1471522226520346632
- trynewideas 5y ago
  See also https://twitter.com/dodgepong/status/1471528656199692292 https://twitter.com/dodgepong/status/1471528656199692292 and https://twitter.com/dodgepong/status/1471524716477300737 https://twitter.com/dodgepong/status/1471524716477300737 too twitter; didn't read: there's apparently OBS code evident in the decompiled app, and other GPL code as well, and OBS found out independently and are working to resolve it
  - mynameismon 5y ago
    Also important to note: OBS developers also found incidents of OBS code outside of that instance, and they are working with TikTok on the same.
  - 4684499 5y ago
    That's pretty fast for a beta released yesterday. Are the devs actively monitoring and reverse engineering every binary released that related to streaming? Also, where can I get the live studio executable? None of the links I found works, is that public release?
    - r1ch 5y ago
      I'm the one on the OBS team who originally found this. I saw a tweet yesterday from someone that's in the beta, and as with any desktop live streaming software (and especially with "Studio" in the name) I was curious if they were using any OBS Studio code or if it was developed all in-house. The download link is available in their JS, you can find the most recent installer link here: https://tron-sg.bytelemon.com/api/sdk/check_update?branch=master&pid=6974351561648511246&uid=&buildId= https://tron-sg.bytelemon.com/api/sdk/check_update?branch=ma... (note: you probably won't be able to actually use it without being in the beta group) Without even installing it, opening the setup files showed some immediate red flags, notably the "GameDetour64.dll", "Inject64.exe" and "MediaSDKGetWinDXOffset64.exe" look awfully similar to the way the OBS Studio game capture hooks work with our "graphics-hook64.dll", "inject-helper64.exe" and "get-graphics-offsets64.exe". I don't jump straight in to disassembling everything I come across, but when it's this obvious it begs further investigation, and after some disassembly I was able to confirm that OBS code was present in their binaries.
      - throwaway413 5y ago
        This is why I HN. Thank you for that clear account of the discovery, funny what a little curiosity can lead to. Not masking the names further makes me wonder if whoever actually implemented this may not have been aware of the repercussions.
      - samspenc 5y ago
        Wow this is amazing, thanks for digging in and doing this work. If this were Reddit, I would give you a gold award, but since this is HN, all I have to give is my 1 upvote.
        boogies 5y ago
        If you tap the timestamp you can favorite it (add it to the public list of favorite comments linked on your profile page).
      - sufficer 5y ago
        Reminds me how I caught someone stealing my mod code. Same variable names, and whereas I used spaces for indentation when most used tabs, this guy also coincidently also used spaces in the same areas. I challenged him on it and he played dumb. Thanks for reading my blog :)
  - duffsdevice 5y ago
    > and OBS found out independently and are working to resolve it What has OBS to resolve there? They could send a letter with an offer for a special license for one million dollars. If all open source contributors agree on thqt and have worked out how to share the fee.
addingnumbers 5y ago
People are misunderstanding this and claiming it's not problematic because the tweet in the HN link is idiocy. They show one URL in one installer script with an obsproject.com domain and conclude, from the presence of that URL alone, that the entire project is a whole cloth copy of OBS. That URL is nothing but a 302 redirect to the directx runtime at https://www.microsoft.com/en-us/Download/confirmation.aspx?id=35 https://www.microsoft.com/en-us/Download/confirmation.aspx?i... The linked tweet tells us nothing except that TikTok is essentially using obsproject.com's web server as a URL shortener.
- deleted 5y ago
  [deleted]
- mysterydip 5y ago
  Why would a company the size of tiktok want to depend on some open source project maintaining a URL? Would they be liable if it instead redirected to malware?
  - Sebb767 5y ago
    Possibly. But most likely there was a bug "crashing when DirectX is not installed" and some developer hacked a silent install for DirectX in without thinking too much.
    - OmegaMetor 5y ago
      A OBS developer went into detail here [1] about how they figured this out. [1] https://news.ycombinator.com/item?id=29592103#29595349 https://news.ycombinator.com/item?id=29592103#29595349
  - adolph 5y ago
    > a company the size of tiktok Is made up of smaller teams composed of individuals who may or may not take shortcuts and make good decisions on behalf of their company. If the choice is between "executive said 'hey use this open source in secret'" or "programmer took shortcut," my bet is on the latter.
ignoramous 5y ago
I wonder if the GPLv3 violation pulls in TikTok's other software and infrastructure under it. That'd be one for the ages (like OpenWrt was [0]) if FSF manages to reign it in! [0] https://thenewstack.io/the-open-source-lesson-of-the-linksys-wrt54g-router/ https://thenewstack.io/the-open-source-lesson-of-the-linksys...
- 2Gkashmiri 5y ago
  you are talking about the SSPL license, its not "open source license" like people will want you to believe but it sure is free software license giving more rights to users about where they get software/utility out of software
- borodi 5y ago
  OBS is GPLv2 so I don't think it would get to that level. Tho if the other GPL code is v3 then who knows.
  - munk-a 5y ago
    It really depends on the usage - if serverside components are also using OBS libraries for something then they'd be violating a contract in their server code regardless of the license version.
    - _flux 5y ago
      The use of GPLv2 code is fine for plain internal use. Only when you distribute the GPLv2-using binaries to third parties comes the license in play: you must provide also the source code to those third parties.
- dathinab 5y ago
  No it doesn't that's not how GPL (or any license) works. What happens is that it's a breach of contract (licenses are contracts) which lead to an termination that contract (1) (license) which grants the usage rights (copyright) for the software. Which leads a company to (roughly) following choices: - start complying with the license in time "before" the license gets invalidated - buy a proprietary license from the license holder - stop using the software, and pay damages for previous usage/contract violation/copyright infringement(1) This means you are not ever forced by law to release your software under GPL, but you might be forced by economics to do so, as you might not be able to afford not doing so (or it's just simply cheaper). (1): The topic how/when the contract becomes invalid and for which terms you can sue is tricky, and depends on the country in question. EDIT: Also even if GPL would work like that, there is no reason why e.g. their non-OBS boundled apps or infrastructure should be affected.
babypuncher 5y ago
It is absolutely problematic. Corporations will go to hell and back to make sure their IP rights are respected. The open source community should expect nothing less from them.
- squarefoot 5y ago
  My experience in companies using FOSS licensed code is a bit dated, but back then their opinion was more close to "we can do as we want with their code, those are just a bunch of hippies". I'm sure things have changed in almost two decades, but the sooner TikTok gets a letter from a law firm, the better.
  - delfinom 5y ago
    The problem is almost entirely because the hippies don't have money for the law firm or lawsuit. Only by projects joining groups like GNU or The Linux Foundation or Apache do the hippies suddenly have lawyers on tap.
randombits0 5y ago
I don’t mean any disrespect to anyone but can we go back to basics? Copyright applies to creative expressions. Purely functional expressions are not copyrightable. Regardless of license, only creative expressions within the work are protected. That said, what portions of the work are creative?
- kittywav 5y ago
  Computer programs are as copyrightable as literary works, and generally are counted as such within the context of copyright (see https://wipolex.wipo.int/en/text/295166 https://wipolex.wipo.int/en/text/295166). Please point out where it is determined that one has to demonstrate the "creativity" of a literary work before it is protected by copyright laws.
  - randombits0 5y ago
    Oh, please. 2+2=4 is not copyrightable. I’d further that any program in a CS101 textbook is equally uncopyrightable. Computer programs are only copyrightable to the degree that they contain creative expression. Purely functional expressions are not copyrightable, regardless of the creative effort to derive them. https://www.jstor.org/stable/1342160 https://www.jstor.org/stable/1342160
    - pure_simplicity 5y ago
      I would argue that everything creative has a functional side and everything functional has a creative side. The question is: where do we draw the line? How creative should something be before it is copyrightable and how functional should it be before it's not? Currently, precedent is on the side of code being copyrightable.
      - randombits0 5y ago
        Code is a tricky word. It’s very ambiguous. What if I lift a minor function? What if I study yours and base mine off of it? What if I type it all except for three lines I pasted from yours? The whole idea that a recipe can be owned is fascinating. Actual recipes, btw, are not considered copyrightable.
gjs278 5y ago
nobody cares
questiondev 5y ago
obs should be able to do a cease and assist, right? hopefully more, that’s illegal to steal someone’s code so they must give it back and pay possibly pay retribution’s depending on the judgement
- bschwindHN 5y ago
  *Cease and desist Though right now it's kind of an unintended assist
lupire 5y ago
To be fair, OP is a garbage tweet and not an explanation of the situation.

mynameismon 5y ago

Relavant Tweet: https://twitter.com/dodgepong/status/1471522226520346632 https://twitter.com/dodgepong/status/1471522226520346632

trynewideas 5y ago
See also https://twitter.com/dodgepong/status/1471528656199692292 https://twitter.com/dodgepong/status/1471528656199692292 and https://twitter.com/dodgepong/status/1471524716477300737 https://twitter.com/dodgepong/status/1471524716477300737 too twitter; didn't read: there's apparently OBS code evident in the decompiled app, and other GPL code as well, and OBS found out independently and are working to resolve it
- mynameismon 5y ago
  Also important to note: OBS developers also found incidents of OBS code outside of that instance, and they are working with TikTok on the same.
- 4684499 5y ago
  That's pretty fast for a beta released yesterday. Are the devs actively monitoring and reverse engineering every binary released that related to streaming? Also, where can I get the live studio executable? None of the links I found works, is that public release?
  - r1ch 5y ago
    I'm the one on the OBS team who originally found this. I saw a tweet yesterday from someone that's in the beta, and as with any desktop live streaming software (and especially with "Studio" in the name) I was curious if they were using any OBS Studio code or if it was developed all in-house. The download link is available in their JS, you can find the most recent installer link here: https://tron-sg.bytelemon.com/api/sdk/check_update?branch=master&pid=6974351561648511246&uid=&buildId= https://tron-sg.bytelemon.com/api/sdk/check_update?branch=ma... (note: you probably won't be able to actually use it without being in the beta group) Without even installing it, opening the setup files showed some immediate red flags, notably the "GameDetour64.dll", "Inject64.exe" and "MediaSDKGetWinDXOffset64.exe" look awfully similar to the way the OBS Studio game capture hooks work with our "graphics-hook64.dll", "inject-helper64.exe" and "get-graphics-offsets64.exe". I don't jump straight in to disassembling everything I come across, but when it's this obvious it begs further investigation, and after some disassembly I was able to confirm that OBS code was present in their binaries.
    - throwaway413 5y ago
      This is why I HN. Thank you for that clear account of the discovery, funny what a little curiosity can lead to. Not masking the names further makes me wonder if whoever actually implemented this may not have been aware of the repercussions.
    - samspenc 5y ago
      Wow this is amazing, thanks for digging in and doing this work. If this were Reddit, I would give you a gold award, but since this is HN, all I have to give is my 1 upvote.
      - boogies 5y ago
        If you tap the timestamp you can favorite it (add it to the public list of favorite comments linked on your profile page).
    - sufficer 5y ago
      Reminds me how I caught someone stealing my mod code. Same variable names, and whereas I used spaces for indentation when most used tabs, this guy also coincidently also used spaces in the same areas. I challenged him on it and he played dumb. Thanks for reading my blog :)
- duffsdevice 5y ago
  > and OBS found out independently and are working to resolve it What has OBS to resolve there? They could send a letter with an offer for a special license for one million dollars. If all open source contributors agree on thqt and have worked out how to share the fee.

addingnumbers 5y ago

People are misunderstanding this and claiming it's not problematic because the tweet in the HN link is idiocy. They show one URL in one installer script with an obsproject.com domain and conclude, from the presence of that URL alone, that the entire project is a whole cloth copy of OBS. That URL is nothing but a 302 redirect to the directx runtime at https://www.microsoft.com/en-us/Download/confirmation.aspx?id=35 https://www.microsoft.com/en-us/Download/confirmation.aspx?i... The linked tweet tells us nothing except that TikTok is essentially using obsproject.com's web server as a URL shortener.

deleted 5y ago
[deleted]
mysterydip 5y ago
Why would a company the size of tiktok want to depend on some open source project maintaining a URL? Would they be liable if it instead redirected to malware?
- Sebb767 5y ago
  Possibly. But most likely there was a bug "crashing when DirectX is not installed" and some developer hacked a silent install for DirectX in without thinking too much.
  - OmegaMetor 5y ago
    A OBS developer went into detail here [1] about how they figured this out. [1] https://news.ycombinator.com/item?id=29592103#29595349 https://news.ycombinator.com/item?id=29592103#29595349
- adolph 5y ago
  > a company the size of tiktok Is made up of smaller teams composed of individuals who may or may not take shortcuts and make good decisions on behalf of their company. If the choice is between "executive said 'hey use this open source in secret'" or "programmer took shortcut," my bet is on the latter.

ignoramous 5y ago

I wonder if the GPLv3 violation pulls in TikTok's other software and infrastructure under it. That'd be one for the ages (like OpenWrt was [0]) if FSF manages to reign it in! [0] https://thenewstack.io/the-open-source-lesson-of-the-linksys-wrt54g-router/ https://thenewstack.io/the-open-source-lesson-of-the-linksys...

2Gkashmiri 5y ago
you are talking about the SSPL license, its not "open source license" like people will want you to believe but it sure is free software license giving more rights to users about where they get software/utility out of software
borodi 5y ago
OBS is GPLv2 so I don't think it would get to that level. Tho if the other GPL code is v3 then who knows.
- munk-a 5y ago
  It really depends on the usage - if serverside components are also using OBS libraries for something then they'd be violating a contract in their server code regardless of the license version.
  - _flux 5y ago
    The use of GPLv2 code is fine for plain internal use. Only when you distribute the GPLv2-using binaries to third parties comes the license in play: you must provide also the source code to those third parties.
dathinab 5y ago
No it doesn't that's not how GPL (or any license) works. What happens is that it's a breach of contract (licenses are contracts) which lead to an termination that contract (1) (license) which grants the usage rights (copyright) for the software. Which leads a company to (roughly) following choices: - start complying with the license in time "before" the license gets invalidated - buy a proprietary license from the license holder - stop using the software, and pay damages for previous usage/contract violation/copyright infringement(1) This means you are not ever forced by law to release your software under GPL, but you might be forced by economics to do so, as you might not be able to afford not doing so (or it's just simply cheaper). (1): The topic how/when the contract becomes invalid and for which terms you can sue is tricky, and depends on the country in question. EDIT: Also even if GPL would work like that, there is no reason why e.g. their non-OBS boundled apps or infrastructure should be affected.

babypuncher 5y ago

It is absolutely problematic. Corporations will go to hell and back to make sure their IP rights are respected. The open source community should expect nothing less from them.

squarefoot 5y ago
My experience in companies using FOSS licensed code is a bit dated, but back then their opinion was more close to "we can do as we want with their code, those are just a bunch of hippies". I'm sure things have changed in almost two decades, but the sooner TikTok gets a letter from a law firm, the better.
- delfinom 5y ago
  The problem is almost entirely because the hippies don't have money for the law firm or lawsuit. Only by projects joining groups like GNU or The Linux Foundation or Apache do the hippies suddenly have lawyers on tap.

randombits0 5y ago

I don’t mean any disrespect to anyone but can we go back to basics? Copyright applies to creative expressions. Purely functional expressions are not copyrightable. Regardless of license, only creative expressions within the work are protected. That said, what portions of the work are creative?

kittywav 5y ago
Computer programs are as copyrightable as literary works, and generally are counted as such within the context of copyright (see https://wipolex.wipo.int/en/text/295166 https://wipolex.wipo.int/en/text/295166). Please point out where it is determined that one has to demonstrate the "creativity" of a literary work before it is protected by copyright laws.
- randombits0 5y ago
  Oh, please. 2+2=4 is not copyrightable. I’d further that any program in a CS101 textbook is equally uncopyrightable. Computer programs are only copyrightable to the degree that they contain creative expression. Purely functional expressions are not copyrightable, regardless of the creative effort to derive them. https://www.jstor.org/stable/1342160 https://www.jstor.org/stable/1342160
  - pure_simplicity 5y ago
    I would argue that everything creative has a functional side and everything functional has a creative side. The question is: where do we draw the line? How creative should something be before it is copyrightable and how functional should it be before it's not? Currently, precedent is on the side of code being copyrightable.
    - randombits0 5y ago
      Code is a tricky word. It’s very ambiguous. What if I lift a minor function? What if I study yours and base mine off of it? What if I type it all except for three lines I pasted from yours? The whole idea that a recipe can be owned is fascinating. Actual recipes, btw, are not considered copyrightable.

gjs278 5y ago

nobody cares

questiondev 5y ago

obs should be able to do a cease and assist, right? hopefully more, that’s illegal to steal someone’s code so they must give it back and pay possibly pay retribution’s depending on the judgement

bschwindHN 5y ago
*Cease and desist Though right now it's kind of an unintended assist

lupire 5y ago

To be fair, OP is a garbage tweet and not an explanation of the situation.