Many of you may know who Eric S. Raymond is. For those of you who don’t, he’s one of the father’s of the open-source software movement. He’s the author of the 1997 essay and 1999 book The Cathedral and the Bazaar.
He’s gotten quite active on X, mostly regarding AI. (A little bit about politics, but mostly not.) Anyway, he had a post this morning that caught my eye and that I thought you’d be interested to see.
It’s about how powerful AI tools have gotten regarding decompiling software. He has some thoughts that this ease of decompiling may make all software effectively open source.
I think Raymond may be right. In fact most/all end user software could disappear at some point in the not too distant future. IMO.
I recently visited my previous employer. The servers that handled our phone system and voicemail are gone. The mid range IBM server is on its way out. I noticed a couple of servers that once ran windows virtual machines are still in a rack but I didn’t ask if they were still in use.
Basically just about everything runs in the cloud, and the employees use their MacBooks attached to wide screen montitors to run Chrome.
Decompiling a code base and posting it in the open is not the equivalent of making code in an open source approach. Otherwise, you agree that I can deconstruct and publish your otherwise secret recipe for stew while brooking no personal affront or civil penalties from you (and at the same time, get wonderful accolades for my abilities as a chef).
Also, a stand that it is OK to deconstruct a software code that was built with cost investment and give it away (under a mantle of thereby making it “open source”), ostensibly because everyone will benefit, is an end justifying a means.
Finally, I seriously hope that we do not get to such a world where all software is just a race for the fastest to deconstruct what someone else created and post it for free. I learned a long time ago that sometimes, software that is free costs me more time to use than is worth its cost.
I think Raymond’s point is “effectively” open source. There are four fundamental freedoms that generally define what constitutes open source software; one freedom is that code can be freely inspected. (That’s in Freedom 1.) That’s probably what he’s referring to here.
Under the law decompiling (reverse engineering) something does not violate a trade secret—whether it be a slaw recipe or a AAA game. It’s also not copyright infringement to decompile software. Copying it, is a different story.
A software license could prohibit decompiling.
So you could have is a breach of contract merely by act of the decompiling.
But if you read the post, you will see Raymond is talking about software secrecy not republishing software.
By the way, I do agree that (at least in the U.S.);
If someone (who is not under a duty of secrecy) reverse engineers a recipe, there is no trade secret violation. “Reverse engineering or independent derivation alone shall not be considered improper means.” Cal. Civ. Code § 3426.1(a). The federal DTSA says the same thing in the definition of improper means: it “does not include reverse engineering, independent derivation, or any other lawful means of acquisition.” 18 U.S.C. § 1839(6). The UTSA reaches the same result through the official commentary and the case law. Buying the finished product and working backward is proper means. Independent derivation is proper means too.
This discussion only deals with the civil penalties. It does not speak to the question of personal affront, which is a different matter altogether. But there is a whole category of YouTube channels that make “copycat” recipes for things like Panda Express Orange Chicken, to Chick-fil-a sauce, to seemingly anything under the sun. Those YouTubers don’t claim to be original authors of the recipes. Maybe that avoids the personal affront problem by giving credit to the importance of the original creator and original creation.
“Free” is two different things in terms of FOSS software. There’s “free” as in “free beer,” and “free” in the sense of “free to modify, adapt, share, etc.”
It would be a fascinating case to see how this would work if nobody actually ran the software. Lots of applications have “by using this software…” license screens that pop up, but clicking through those screens isn’t even necessary to decompile.
The most interesting thing in this space lately might be “clean room” rewrites. One AI decompiles, and turns the original code into a comprehensive specification. This isn’t using any of the original code, but rather just documents the spec for a rewrite. Then another AI picks up that spec, and re-implements from scratch.
The argument is that since the re-implementation step doesn’t touch any of the original code, there’s no copyright violation. It’ll be interesting to see how it plays out in court, if it gets to that point.
I’m hoping we don’t move into a world where ever-more-bizarre patents supersede copyright as a preferred method to try to protect software.
Thanks for the polite and detailed response to improve my ignorance in the legalize.
The key takeaway for me is the (possible) breach of contract in decompiling licensed code. Which is to say that, Raymond (or anyone else) is prohibited from decompiling code (e.g. to make the code “unsecret” even without an intent publish it openly) that has been licensed with restrictions against doing so.
Pretend we have no license on the code to prohibit decompiling it. For clarification, publishing code for open access makes the code open source. Decompiling a proprietary code makes it “unsecret”, not open source. Decompiling a proprietary code to make it “unsecret” and modifying that “unsecret” code is making a derivative of the “unsecret” code, not making it open source. Publishing the derivative of the “unsecret” code as open source is not copyright infringement because the published code is a derivative work. Now to the question: Isn’t publishing an “unsecret” code without any derivation to it copyright infringement because doing so is making a copy of code that is licensed only to the one owner for use, not for distribution?
Your post reminded me that I believe someone has recently talked about doing exactly this. They had one agent decompile code. If memory serves, that agent did not disclose the code, but described the functionality so one person (or the agent) was able to develop the functional spec. Another programmer with no knowledge of the original code then clean-wrote a program based on the spec.
I can’t remember where I saw it. And maybe you’re talking about the same thing that I saw. This will be interesting because potentially the first decompile (if that’s what the agent did) still could be a violation of a license agreement. So, if someone developed software based on a decompilation and published it, there might still be a breach claim.
I agree with you, otherwise, that someone hacker at home who decompiles software for his/her own curiosity, but doesn’t do anything with it, likely isn’t facing a breach lawsuit (assuming the license includes a prohibition of reverse engineering and decompiling, which no doubt it would). Technically, it’s likely still a breach of the agreement. But, in this hypothetical, there is no damage arising from it and no reason the licensor would even have occasion to learn about it. (Dear reader, I’m not suggesting licensor-ignorance is a defense to a breach.)
Yes. I think that is the technically correct take away. If the license has an anti-reverse-engineering provision (which most commercial licenses do), then decompiling is a default of the license. If it’s done in the privacy of one’s own home, done for personal purposes, and doesn’t result in any published disclosures, copying, or the like, the breach probably is not going to amount to damages or even a claim. But a licensor could pursue a breach claim against someone who just decompiled the software—again, assuming prohibitory language in the license and assuming that language is enforceable, etc.
This is kind of true. It doesn’t make it open source, there is still not open-source license. The owner of the software copyright probably doesn’t have a claim based on the disclosure. But any copying (as defined under the copyright act, including derivative works) would potentially be a copyright infringement.
Yes, that’s right.
I think this part is probably wrong. If the work is subject to copyright protection, the decompiling may not be an infringement, but creating and publishing derivative works likely still is. That’s why I was saying earlier, I think Raymond’s point in his post was that the software is “effectively” open source. Not actually. His post is too concise and doesn’t get into these nuances. These are the kinds of questions that will likely be litigated. But based on pure, current, copyright principles, just because you know what’s “in” the software doesn’t mean you can copy it, change it, and republish it.
Most likely. The question comes down to this. If I have software on my computer in a binary. An .exe file in Windows, say. If I make a backup copy that’s generally considered a fair use. But if I take that exe file, and then make a “companion” decompiled version, I think the copyright owner could at least make the argument that I made a copy and that doing so without authorization is an infringement. Thus ensues litigation and lots of arguments over these issues.
That’s why Raymond’s post should probably looked at the technical possibilities of having these AI tools, the pragmatic reality — secrecy in software may be over. That does not actually means the software has magically become open source, etc. So, your responses are all valid, appropriate, and well-considered.
Personally, I would take ESR’s post with a very large grain of salt. For one thing, that guy’s a nut. For another, any time someone claims “the end” of something, they’re almost always wrong. Things tend to continue much as they are, with smaller changes here and there. To pronounce the end of an entire industry doesn’t make much sense to me.
Also, wouldn’t decompiling a binary fall under the DMCA?
I took his post as a thought piece. “Nut” or not, the post raises interesting ideas regarding software licensing and access among other things. Also, and maybe more important to you point is, “nut” aside, he’s a stalwart advocate of open source software, so he has a stake in this. He may long for the secrecy to end. Not saying that he does, but it’s possible.
Re DMCA. Possible DMCA violation, but probably not for a lot of software. The Digital Millennium Copyright Act would apply to decompiling software if the process requires bypassing digital locks, encryption, or technological protection measures. So in the absence of any of those, likely no DMCA problem.
Yup, same thing. They call that a “clean room rewrite”.
The question to me is, what binds the license on the person doing the decompiling?
Construct a hypothetical here where I get a disk from Goodwill. The disk, if I run the software, pops up a license agreement. But I don’t do that. I decompile it, and publish the code. There’s no initial purchase from the software vendor which could have attached the license. Goodwill certainly isn’t an agent of the software author.
Can the software author argue that the license applies to me whether or not I agreed? I think that would be a pretty bizarre legal finding, although I’m obviously not a lawyer.
As somebody that writes code, I think this would be truly fascinating to see argued. Because there’s an argument that goes like this:
Source code is compiled into an executable. The code itself has never been provided to the end user, just the compiled version.
De-compiling it almost certainly doesn’t yield the original source code. It yields code that does the same thing, but if you put the two documents next to another they almost certainly won’t be the same.
As a fun “extra,” they might not even be in the same programming language. You can “decompile” Pascal to C, since the “decompile” is starting with machine code and just representing it in the target language.
Given all of that, can it actually be copyright infringement if I publish the “source” of a Swift project that was created in Pascal in 1985? Especially if I never agreed to the license agreement, but just decompiled code on a disk?
I agree with you about derivative works probably still being a violation, and that it wasn’t ESR’s point in the first place.
Practically speaking, he’s arguing that there’s no “secret algorithm” protected by code, and that “security though obscurity” is even more of a non-thing than it was previously because we can inspect just about anything we want.
