I’m a automotive electronic and electrical engineer with little to no software experience.

I need to hire a developer to develop Windows GUI application that is used to configure and program a hardware device that I have designed. I’ve found someone who is extremely experienced in all of the fields that this device is to be used for and he wants to develop this app in Qt. All copyright etc will be mine.

He uses the open source version of Qt and I do not have the budget for the commercial license.

I want the app to be closed source and as hard as reasonably possible to reverse engineer.

Does using the open source version make this impossible?

Can someone explain in ‘layman’s terms’ to an inexperienced person how you can stick to the terms of LGPL without giving away your source code of making it easy to reverse engineer?

  • "Does using the open source version make this impossible?" - Are you asking if using the open source version makes it impossible to reverse engineer your program? Are you asking if using the commercial version would make it somehow harder to reverse engineer a program? – Brandin Oct 2 '18 at 5:15
  • I’m asking if I went open source it would make reverse engineering my program easier. The more I think about it though I’m not too worried as the logic is done in the hardware which has nothing to do with Qt as the windows app is just a programming and configuration tool – Terry Gould Oct 2 '18 at 7:45

I want the app to be closed source and as hard as reasonably possible to reverse engineer.

The first part of this request is easy to satisfy. The LGPL expressly makes the second part to some degree impossible.

Qt hosts a practical summary of the LGPL's requirements. I won't repeat the entire summary here (definitely read it!), but the first three items are major principles of the LGPL, so I'll offer slightly more explanation:

  • Complete corresponding source code of the library used with the application or the device built using LGPL, including all modifications to the library, should be delivered with the application (or alternatively provide a written offer with instructions on how to get the source code). It should be noted that the complete corresponding source code has to be delivered even if the library has not been modified at all.

The LGPL's most significant requirement is that you must offer the complete source code of the library (here, Qt), including any modifications you've made. This is pretty easy to satisfy: offer a download of Qt's LGPL source code from the same place you offer the binary, or include physical media with the source (or written offer) alongside a physical distribution of the binary.

  • In case of dynamic linking, it is possible, but not mandatory, to keep application source code proprietary as long as it is “work that uses the library” – typically achieved via dynamic linking of the library. In case of static linking of the library, the application itself may no longer be “work that uses the library” and thus become subject to LGPL. It is recommended to either link dynamically, or provide the application source code to the user under LGPL.

The LGPL obligates you to share only source code for the library itself, while an application that uses the library (i.e. the code you and your contractor are writing now) can remain free of this requirement. However, it is possible that, under copyright law, in at least some jurisdictions, static linking your application code to the library may cause your application code to become part of the same work under copyright law. This would cause source-sharing obligations to apply to your application as well. To avoid this complication, ensure that your application dynamically links to the library instead of statically linking to it.

  • The user is allowed to change and re-link the library used in the application or device – including reverse engineering. With LGPLv3 it is explicitly stated that the user also needs to be able to run the re-linked binary, and that sufficient installation information must be provided. In practice, this forbids the creation of closed devices, also known as tivoization.

This refers to the requirement to enable reverse engineering, which may be the a deal-breaker for you. The LGPL requires that users be able (both legally and technically) to replace the LGPL-licensed library with their own modified version. The language for distributing "Combined works" (application plus library) is in section 4 of the LGPLv3:

  1. You may convey a Combined Work under terms of your choice that, taken together, effectively do not restrict modification of the portions of the Library contained in the Combined Work and reverse engineering for debugging such modifications...

    • d) Do one of the following:
      • 0) Convey the Minimal Corresponding Source under the terms of this License, and the Corresponding Application Code in a form suitable for, and under terms that permit, the user to recombine or relink the Application with a modified version of the Linked Version to produce a modified Combined Work...
      • 1) Use a suitable shared library mechanism for linking with the Library. A suitable mechanism is one that (a) uses at run time a copy of the Library already present on the user's computer system, and (b) will operate properly with a modified version of the Library that is interface-compatible with the Linked Version.

In summary:

  • It must be easy for a user to link a modified version of the library.

  • It must be legal for the user to reverse engineer your application binary for the purposes of debugging LGPL library modifications. In practice, this likely means you can't legally restrict any reverse engineering, since you can't definitively prove that any act of reverse engineering is not done for the purposes of debugging a library modification.

    • Imposing arbitrary technical barriers to reverse engineering your closed-source application code appears to be permissible, as long as you do not intend to punish users who manage to bypass them, and as long as those barriers do not complicate the process of linking a modified library.
    • However, note that users may easily insert debugging code in a modified library, which could be substantial help in defeating any anti-circumvention mechanisms you include.
  • "It must be legal for the user to reverse engineer your application binary" - Where does the LGPL say this? If you read what it says about reverse engineering, LGPL is pretty clearly talking about reverse engineering "the portions of the Library contained in the Combined Work." I.e. the license itself is not saying that you must give permission to reverse engineer your application. – Brandin Oct 2 '18 at 5:23
  • Note that the Qt Company is in the business of selling their commercial licenses, so their information about the LGPL may be a bit skewed to steer users to their commercial license. For example this quote is quite misleading: "The user is allowed to change and re-link the library used in the application or device – including reverse engineering." The LGPL does not say that you must allow reverse engineering your application or device, even though the phrase "including reverse engineering" on that page could be read that way. – Brandin Oct 2 '18 at 5:48
  • 2
    @Brandin: The LGPL does say that reverse engineering is allowed to the extent necessary for replacing the LGPL licensed code – Bart van Ingen Schenau Oct 2 '18 at 6:19
  • @Brandin I was referring to the section 4 passage I quoted, "...do not restrict... reverse engineering for debugging such modifications" but I agree that's more narrow than allowing RE in general; I'll clarify. – apsillers Oct 2 '18 at 11:51

Let's keep this short.

LGPL licenses mean that the libraries under them must be open source, and it must be possible to change the LGPLed part and recreate the whole.

Practically, this means that all LGPL parts of the software should be in .dlls, and you are responsible for providing the source code for the LGPLed part, either as part of the total software package or on request. (This is stated for Windows applications, and the details will likely be different on different platforms.)

The rest of your application, which is the stuff you actually want to protect, may be closed source and whatever else you want.

  • "or on request"? Where does the license say this? – Brandin Oct 2 '18 at 5:18

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.