The question is a partial derivative of this one: Someone open-sourced an un-open-source project

Here is the situation:

There is a device and a proprietary software to manage that device. They are developed by some big international company. The proprietary software uses some kind of protocol to exchange information with the device. This protocol was reversed engineered partially via sniffering, partially by decompiling the proprietary software. The protocol itself looks quite huge, but only small part, say 5-10% of all functions was reversed and used in a new open source software.

Here are the questions:

  1. Is it legal to publish the open source software, say on github, where this reversed part of the protocol is used?

Note 1: The protocol itself is a relatively small part of the new open source software and not clearly visible from the first glance

Note 2: Yes, there are words about banning "reverse engineer" and "produce derivatives" in the vendor terms of use

  1. From the practical perspective: what can be the consequences from such an action and how it happens?

Note 3: Probable options could be: from noone notice, to simple ban of the project / developer account, to court invitation. E.g. a vendor employee notice the software on github and trigger the action

Note 4: The logic can also be the following: The vendor makes money on selling the devices. So appearing a software, which does not expose/exploit any vulnerabilities of a relatively old product will not hurt anyone, even can attract some attention to the products

  1. Bonus question: What happens if the new software is published as closed source on some app store?

Vendor itself should decompile the new software to prove that the protocol was reversed. This part is totally confusing.

  • What country is this vendor from and what country are you from? The laws around reverse engineering differ very widely from country to country. Also, what is the purpose of this open-source application? – Bart van Ingen Schenau Sep 14 at 14:01
  • The vendor and github are American companies. So they will probably cooperate. Does publishing on some Indian/Chineese/Other source code hosting change anything? – user10475643 Sep 14 at 21:19
  • This is more of a legal question than an open source one. The issue you are facing would be the same, even if the program you are intending to publish were not open source. – Brandin Sep 15 at 5:05
  • A small update for a practical perspective: I searched especially for the third-party software for the target functions and found one closed source app on an App store (6 months old) and at least two projects on github under GPL and MIT licenses (up to 3 years old). In one of the projects it is clearly said "reverse-engineered". So good so far. – user10475643 Sep 15 at 17:56

If you aren't allowed to "reverse engineer" and "decompile", what you did was illegal. So no, you are definitely not allowed to share results of such activity. Probably not even use it yourself. But that may depend on the exact details of the case, your local legal environment, and so on.

What practical consequences it may have is anybody's guess. They might never notice, or notice and don't care, or go after you all lawyers blazing. It might also happen that current owners don't care, but future ones might.

| improve this answer | |
  • 1
    Interface definitions or API often are not suitable subject to copyright claims as they are a precondition to allow interoperability. They are for instance explicitly exempt in European law; in all cases you might want to consult a lawyer if there are doubts and the degree you may reverse-engineer or copy an interface. – planetmaker Sep 15 at 5:16
  • It is a very useful comment. The vendor itself is very careful for publishing APIs (actually not publishing) for its products explaining it by "expensive support". Regarding "exempt in European law" does it concern only "official APIs" or also exempt "reverse engineered ones"? – user10475643 Sep 15 at 18:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.