51

Someone (Person_A) is sharing an open source project (Project_A) on GitHub. The Project_A is a decompiled version of another project (Project_B). But the original Project_B is not open source, and Project_B never granted Person_A permission to open source the project. Clearly, the GitHub sharer A violated the software license of the original Project_B.

Now my question is: if another person followed the open source license of Project_A, will that be a violation?

I'm asking because it's hard to verify the validity of the open source license on GitHub.

Improve this question
10
  • 12
    "Clearly, the github sharer A violated the software license of the original Project_B." Not necessarily - decompiling is a permitted activity in some jurisdictions under some circumstances; see for example the UK CDPA 1988, Section 50B.
    – Philip Kendall
    Jun 24, 2020 at 17:19
  • 31
    @PhilipKendall The act of decompilation can be fine, but publishing the result is a clear violation.
    – amon
    Jun 24, 2020 at 18:03
  • 9
    @PhilipKendall That citation (Section 50B) also says "supplies the information obtained by the decompiling to any person to whom it is not necessary to supply it in order to achieve the permitted objective" - which is what the OP is describing, so this is expressly not legal nor permissible under CDPA 1988.
    – Dai
    Jun 25, 2020 at 6:05
  • 2
    What open source license did Project_A claim to have? GPL, at least, tries to make it clear that a decompiled version would not meet the license's definition of 'source code' (only the "preferred form of the work for making modifications" counts as source in that license).
    – Brandin
    Jun 25, 2020 at 14:29
  • 2
    @Brandin Project_A is under MIT license.
    – Ryan
    Jun 25, 2020 at 18:48

4 Answers 4

Reset to default
81

Person A has no right to distribute that software, and is committing a copyright violation. Since they hold no rights in the software, they cannot grant a license to others. Any license they purport to offer is void.

Third parties that are relying on A's license are probably acting in good faith, but they didn't actually receive a license. When they become aware of the infringement, they would have to stop using the software.

Not every license is valid, and that is a problem when managing open source supply chains. Some projects make such issues less likely by asking all contributors for a Developer Certificate of Origin (DCO), where the contributor affirms that they either made the contribution themselves, or know for sure that it is covered by a compatible open source license. Corollary: don't use niche projects that were uploaded by a single contributor, unless its clear (e.g. from the commit history) that they created it themselves.

Improve this answer
2
  • 5
    Third party, Person_C, that is relying on A's license shared the Project_A on his website. Person_B, the original project owner, contacted Person_C about the infringement. Realizing the license of Project_A is not reliable. Person_C immediately took down Project_A. Will Person_C be safe now?
    – Ryan
    Jun 24, 2020 at 20:55
  • 24
    @Ryan - If C was acting in good faith according to A's license (assuming C had no reason to believe it was invalid), then C is somewhat protected. C can't be sued for willful infringement like A can. C can absolutely be forced to stop using and distributing the software and destroy any copies they have. C's exact liability will vary based on locale and circumstances, and you'll probably get a better answer to that on law.se.
    – bta
    Jun 25, 2020 at 0:21
13

The Project_A is a decompiled version of another project (Project_B). But the original Project_B is not open source, AND Project_B never granted Person_A permission to open source the project.

You are asking a legal question (so consult your lawyer).

I am not a lawyer, but I am understanding that in the European Union, decompilation or reverse engineering of a binary software may sometimes be legal (e.g., for purpose of interoperability).

Clearly, the GitHub sharer A violated the software license of the original Project_B.

That is your opinion, but what matters is what a court would decide.

(I am not a lawyer, and my understanding is that there are legal systems where this won't be a license violation; as an example, hash tables algorithms in Ocaml and in Rust are probably very close. See however in the USA the Google vs Oracle case, rumored to deal with 7 lines of source code.)

A known precedent is Nouveau, obtained by reverse engineering of Nvidia binary drivers.

You may need to go to court. This is quite costly (possibly more than the value of Project_B) and may take years.

A related question is software patents. Legal framework is different in the USA and in Europe. On the economical side, read The Simple Economics of Open Source (and see also references in this draft report), and Steven Weber's The Success of Open Source book.

It could be more rational and beneficial (for both parties) to cooperate with Project_A.

According to rumors, some Nvidia engineers are legally cooperating with Nouveau.

David A. Wheeler's sloccount utility might be used to estimate the economical value of Project_B, based on which you could make a rational decision (cooperation vs. legal fight). Be aware that open source does not mean "no economical value": a lot of corporations are involved in GCC or in the Linux kernel and are making money by developing open source software. Be also aware that Debian or FreeBSD or Xorg are not made by unpaid amateurs, but essentially by a community of cooperating professional software developers. See Phoronix and LWN.

PS. In France, see APRIL and AFUL. I am member of both. Contact perhaps the FSF and the EFF and GPL-violations.

PPS. The important question is do you prefer to feed (that is spend your money on) lawyers or software developers.....

Improve this answer
5
  • 4
    While the act of decompilation may be legal, sharing the result under a different license (and presumably as if you owned the copyrights) would still be a violation of copyright law.
    – Bart van Ingen Schenau
    Jun 25, 2020 at 8:52
  • 16
    While the information required to build Nouveau was obtained through decompiling the drivers, it isn't the decompiled code - instead it was written fresh from the information obtained.
    – Grump
    Jun 25, 2020 at 9:03
  • 4
    "That is your opinion, but what matters is what a court would decide." No. Unless the original project's license allowed it to be decompiled and granted the right to distribute the decompilation, then the violation of the project's license is a matter of fact, not of opinion. The legal consequences of that violation would be for a court to decide and would depend on jurisdiction, but the violation of the license agreement is simply a matter of fact. Also, this is not comparable to Nouveau for the reason Grump mentioned. They did not just distribute a decompiled version of NVidia's code.
    – reirab
    Jun 25, 2020 at 16:54
  • 1
    Basil did ever considered changing your name on this stack to I'm not a lawyer?
    – Pedro Lobito
    Jun 29, 2020 at 6:48
  • 1
    No. Most people on these forums are not lawyers. And lawyers should be even more careful in giving legal advice
    – Basile Starynkevitch
    Jun 29, 2020 at 7:36
2

Ditto what Basile Starynkevitch posted, I believe that there are some cases where reverse engineering or de-compiling are legit for research and education. The DMCA is the document that you probably would want to look at for more details on what is and isn't allowed. I suspect the legality of this is largely going to depend on what the copier is doing with it.

Now, your question relates to someone using the possibly illicit copy. US law holds that you are still guilty of breaking the law, even if you are unaware of the law for criminal law (ex: I cannot murder someone and claim I don't know it was wrong), I suspect that the same holds true for civil law.

If you use were to sell a product using code that was infringing on a copyright, you would likely still be liable for damages should the copyright holder decide to sue. It's a minor consolation, but this would create solid grounds for you then suing the person or company that committed the copyright violation in the first place.

But IANAL, so take all of this post with a grain of salt. Consult a real lawyer if this is important to your or your company. Do not assume that my speculation is good advice, or even correct.

Improve this answer
1
  • The brocard ignorantia legis non excusat (ignorance of the law is no excuse, approximately) is a great deal older than the US.
    – MadHatter ♦
    Jul 11, 2020 at 6:10
-3

It is receiving stolen property.

Clearly the person that is releasing the code is wrong, but so is anyone taking the new code.

If you accept something that you know or should suspect is stolen then you are committing a crime in most areas.

Improve this answer
1
  • 9
    Violating copyright is not stealing. Conflating the two does nobody any favours, except maybe the MPAA.
    – MadHatter ♦
    Jul 8, 2020 at 5:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.