0

I want to release some software anonymously.

My first idea was to release it to the public domain, but I have found out that it is not a safe practice due to incompatibilities with the legislation of some countries.

After some research I concluded that the license I need is ISC. Its problem is that it needs a copyright holder and I do not want to publish my full name.

Is there a way to hold a copyright anonymously?

Mathematically, attributing the copyright to base64(sha3_256(<my real name> | <long secret nonce>)) is as strong as putting my real name directly.

Will it be enough in on a court?

EDIT

Due to the confusion generated, I clarify that the algorithm base64(sha256(<my real name> | <long secret nonce>)) means the base64 encoding of the result of applying SHA-256 hash to the concatenation of my name and a long enough (256 bits) secret random nonce.

Because SHA-256 is prone to length extension attacks, I will replace it with the safer SHA3-256 for extra safety.

  • If you plan on releasing it under a Free license (since you thought about public domain...) you could assign copyright to the EFF or a similar group. Not sure if you would have to copyright it first, or if you can just donate it and let them copyright it. Might be worth an email or two to the group(s) in question. – ivanivan Jul 26 '18 at 13:46
4

You are free to publish works anonymously. This case is well-covered by international copyright laws (e.g. Art 7 (3) of the Berne Convention). Publishing anonymously is largely equivalent to publishing pseudonymously, except that the identity of a pseudonymous person is known. For example, what I publish here under the name "amon" is pseudonymous and keeps all my rights as if I had published under my real name. In contrast, the inventor of Bitcoin “Satoshi Nakamoto” has used a pseudonym with unknown identity, and is therefore (still?) anonymous.

Unfortunately anonymous works are a legal headache for users. The work is still copyright-protected like any other work. In most jurisdiction the copyright term ends 70 (or 50) years after the death of the author. For anonymous works the author is not known, and the term ends 70 (or 50) years after publication. However, the author may be identified later. If you (or later copyright holders such as your heirs) claim the copyright before it is expired, then the life + 70 years term applies again. A related problem are orphan works where the copyright holder is not known, therefore the copyright term cannot be calculated reliably.

So if you don't want to exercise your copyright it is best to actively disclaim copyright to the fullest extent possible, i.e. dedicate the work to the public domain and issue a fallback license for jurisdiction where this is not possible. The CC-0 is the best available legal instrument for that purpose.

You could in principle also use a MIT-style license such as the ISC which keeps the copyright intact. The copyright notice doesn't have to hold your real name, using "anonymous" should be fine. Compared to CC-0 users are required to keep the notice, which may actually be desirable as it becomes less likely that the work becomes an orphaned work. There ISC also includes a disclaimer which the CC-0 lacks. Of course trying to hold an anonymous author of a public domain work liable for anything is a bit silly, but you may still enjoy the minimal legal protection of a disclaimer.

Your idea of using a hash of your identity would allow you to publish anonymously, and would allow you to claim the copyright of the anonymous work later. However, this is not necessary for publishing anonymously, and only makes sense if you do plan to disclose your identity later. If you have published anonymously under the CC-0 you will already have disclaimed your copyright to the fullest extent possible, so disclosing your identity would have minimal value.

2

For copyright law, there is no difference between an anonymous copyright holder and a copyright holder who operates under a pseudonym that is not known to be related to a particular person.

This means that you don't have to use your real name in the copyright statement, but you can just use "user3368561" or "anonymous" instead.

The hash you proposed will probably also be accepted as a pseudonym, but I don't see the point in going to that length unless you expect that you will need to break anonymity at some point in the future and that would usually be over a lawsuit regarding copyright infringement.

2

I agree with another answer that a pseudonymous work is covered under copyright equally as an anonymous work. Furthermore, your proposed system will probably allow you to prove to a court your identity as the original author, if you later decide to come forward to enforce your copyright.

However, I'll add that you really don't want the ISC license, since that is a permissive license with the requirement that you preserve a copyright notice. This is not an onerous requirement for recipients, but it's not something you, the licensor, actually want, since you have no interest in including a copyright notice.

Instead, consider the CC0 license, which both

  1. commits your work to the public domain where applicable, and
  2. licenses your work under an ultra-permissive license (which does not carry attribution requirements) in jurisdictions where you cannot fully commit your work to the public domain.

These two features in tandem ensure there is no copyright difficulty for others using your work.

0

I have very recently addressed the issue of anonymous and pseudonymous copyright here, so I won't go over that ground again. The advice being given here about CC0 seems good to me, so I won't comment on that, either.

What I will do is warn you against rolling your own crypto, as it never ends well. In this case, you propose to identify yourself with a hash which is sha256(name|nonce) (I'm leaving out the base64 as it's just a shortening exercise). Should you ever need to prove your ownership, you will produce name and nonce, to show that the ORed result sha256s to give your hash.

Problem is, once you've done that, it's trivial to produce another name with a different nonce that gives the same result. So as soon as you've proved ownership you're open to any number of challengers each of whom has proof of ownership equal to yours, and who need only claim that they didn't know the ownership was in question until they (eg) saw your proof in the papers, and realised you had stolen their name and nonce and that it was time for them, the true owner, to come forward. This will be difficult to disprove.

Instead, as I do in the linked answer, consider generating a custom gpg keypair, and using it to sign the pseudonymous declaration. Your distributed software should include a copy of the public key. You can at a later time prove ownership of the private key without compromising it.

  • 1
    "the ORed result" -- Your answer is a good warning if your assumption here is correct, but I strongly suspect it is used as a concatenation operator here. | and || are fairly common ways of expressing that. – hvd Jul 24 '18 at 8:10
  • It's also used for NAND, and, as you say, a number of other things, though Wikipedia suggests that the double vertical bar is used for concatenation. Nevertheless, the OP's strategy still relies on providing the input to the hash function in order to prove ownership, and I'm reluctant to say for sure that that's no help to an attacker who can choose alternate inputs. Why take the chance, when there are other strategies that are known to be resistant to such compromise? – MadHatter Jul 24 '18 at 8:29
  • 1
    As others said, its | is the concatenation operator as is common in the context of cryptography. My proposed algorithm is a simple HMAC, i.e. a secure algorithm. A PGP signature is another option. Its problem is that the long-term storage of a multi-KB file plus a passphrase (to decrypt the secret key) is harder than storing a passphrase alone (the nonce). – user3368561 Jul 27 '18 at 12:02
  • 1
    As a side note, cryptographic hash functions are secure in a post-quantum scenario. PGP isn't. For long-term storage, if applicable, a hash-based algorithm is always a better choice. – user3368561 Jul 27 '18 at 12:05
  • 1
    @MadHatter Copyright declarations have zero impersonation strength. If I want I can publish a work under your name. Why my algorithm must be different? The only thing I want is a pseudonym that only I can prove related to my real name. Anybody can use it as any other name or pseudonym ever used in copyright declarations. – user3368561 Jul 27 '18 at 12:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.