Can Watermarking Help Find GPL Violations?

bitkid writes "I recently run across techniques that can be used to watermark program code. While I yet have to see some source code for this to play with, the authors claim that the watermarks can be introduced into the source code and can be found in the compiled executable. My question for the slashdot-crowd is: Do you think free software (GPL or other viral licenses) should be watermarked? This could help to find GPL violations (think Everybuddy or Linksys) or can be used in court someday against the next SCO to prove authorship. What might be the ramifications of this?"

Comments

Useful, but easy to get around.

[The Head Sage]

This would be useful to prove that code is under the GPL, but this could be simply gotten around by just looking at the code, then rewriting it yourself. But, of course this will take time and money, something the big business hate to spend.. But the technology is useful.

Re:Useful, but easy to get around.

[floydigus]

Absolutely right.

Furthermore, you could automate the process by writing a script to do things like randomising white space, replacing variable names, and even rewriting simple flow control constructs.

I would suggest that if it is deemed important to be able to establish the originator of the code, then the originator should publish it as theirs as soon as it is written, or at least give it to an independent witness for safekeeping.

Re:Useful, but easy to get around.

[LostCluster]

You may be on to something... create an organization that accepts code and stores it with a datestamp forevermore. No need for random-access hard disk, just archive the material to tapes, CDs, or DVDs and properly maintain them. If your ownerhsip of the code is ever called into question, you can obtain 3rd party proof that the code was on that time period's record, proving you had the code as of that time.

Re:Useful, but easy to get around.

[kasperd]

randomising white space, replacing variable names

Those are stuff that cannot be seen in the resulting executable, the watermark is claimed to be found even in the resulting executable. (Yes I know in some cases variable names can be visible in the executable, but you can easilly prevent it from being there.) I somehow doubt this watermarking is at all possible. With optimizing compilers it is hard to find resemblance between source and executable. Finally knowing how the watermarks are made on the code, it is probably easy to write another but slightly similar algorithm that will remove the watermark.

Re:Useful, but easy to get around.

[Anonymous Coward]

The problem is not that optimising compilers will stop the watermark coming through. If the same optimising compiler is used the watermark will remain the same.

The problem is different compilers optimise in different ways, so the watermark will differ for the same code depending on what compiler (and compiler options) were used.

Re:Useful, but easy to get around.

[Anonymous Coward]

Watermarking is useless because compilers often mangle the code beyond recognition.

What can be useful is embedding easter eggs into GPLd software, and then trying to invoke them in suspected violations.
Of course, these 'eggs' should be secret and subtle, like when given an invalid string, write the same string backwards into a temporary file. And be sure to put in lots of them, so the violators don't get to remove ALL of them.

Re:Useful, but easy to get around.

[sholden]

Or you could just register the copyright and use the existing institution (or the equivalent in your jurisdiction) that has been doing that task since before computers were invented.

Of course registering every cvs checkin is going to get expensive :)

Re:Useful, but easy to get around.

[Alsee]

I somehow doubt this watermarking is at all possible. With optimizing compilers it is hard to find resemblance between source and executable.

If you read the PDF you will see that it is still detectable in the executable. That is because the watermark isn't actually in the executable directly, it is placed in the data structures that the executable creates/uses.

I do agree with your other point though. If you know about the process then I can't imagine any way they can prevent you from writing a program capable of removing, replacing, or obliterating any watermark.

-

Re:Useful, but easy to get around.

[Anonymous Coward]

Isn't this typically what "knowing" violatators of GPL'ed do ? Take the code then reformat it with new var names,etc to their needs only keeping the initial structure?

Re:Useful, but easy to get around.

[NickFitz]

Or you could just register the copyright and use the existing institution

Excellent advice, but it doesn't work for those of us outside the US. Here in the UK (and AFAIK the rest of the EU) copyright resides with the creator, but there is no place of registration.

The registration road is one that the US followed many years ago, and it provides an excellent degree of legal protection. But the history of copyright law in the UK has tended towards an "If you wrote it then it's yours, now can you prove it?" model, and proving it is a difficult thing to do nowadays if you publish an original work on the net.

Here we have no national registry of claims of copyright as a matter of public record. Maybe the EU should move towards this model (although I deeply distrust any approach that would actually require registration).

Of course registering every cvs checkin is going to get expensive :)

Hmm... strictly speaking, every copyrighted work should be deposited with the Briitish Library, Bodleian Library (Oxford), Cambridge University Library, National Library of Scotland, Library of Trinity College Dublin and the National Library of Wales. Hope their CVS servers are up to scratch ;-)

Re:Useful, but easy to get around.

[ichimunki]

Excellent advice, but it doesn't work for those of us outside the US.

According to the FAQ at copyright.gov, many foreign-made works can be registered with the U.S. copyright office.

Re:Useful, but easy to get around.

[i.r.id10t]

Print it out, snail-mail it to yourself, with some marking on the outside that will allow you to identify it as project #42 revision 6.9 or whatever. Should the need arise, hand it to the judge un-opened.

Re:Useful, but easy to get around.

[nolife]

But what prevents someone from using your code and when you produce proof of date, the say they created it on date -1 month from your claim?

Re:Useful, but easy to get around.

[grosa]

Furthermore, you could automate the process by writing a script to do things like randomising white space, replacing variable names, and even rewriting simple flow control constructs.

this won't get you anywhere. i had a class on pattern matching software to pick out plagiarism in student submited code at my university, and the guys developing it aren't exactly idiots. things like changing lines around, changing variable names, changing spacing and indentation style didn't do anything. the software caught everything.

i don't know the exact heuristics they use to determine how related two pieces of code are, but it definetly looked more at the underlying pattern than at the surface level code. it always sort of worried me that if you had the same line of thinking as someone else, or you both talked about a way of implementing something and then went off and worked on it separately that the software would catch your code as being related, but it never did. they might have a human scan any positive matches for false negatives though.

see also ESR's comparator that was mentioned here a few months ago. it is supposedly also not fooled by style changes.

Re:Useful, but easy to get around.

[cperciva]

Hmm... strictly speaking, every copyrighted work should be deposited with the Briitish Library, Bodleian Library (Oxford), Cambridge University Library, National Library of Scotland, Library of Trinity College Dublin and the National Library of Wales.

I believe that only applies to *printed* works.

Re:Useful, but easy to get around.

[Pig Hogger]

Furthermore, you could automate the process by writing a script to do things like randomising white space, replacing variable names, and even rewriting simple flow control constructs.

Now, I'd like to know by which compiling process randomized white space, and "different" variable names will show up in object code...

Re:Useful, but easy to get around.

[mlush]

This would be useful to prove that code is under the GPL, but this could be simply gotten around by just looking at the code, then rewriting it yourself. But, of course this will take time and money, something the big business hate to spend.. But the technology is useful.

Assuming that it does what is says on the box (ie it can be found in the compiled executable. etc etc)

The watermarking be easy to get round, however if one is caught it is quite clear that the violation was completely intentional. Distastful as it is one could even sue under DMCA as the copy protection has been circumvented

Re:Useful, but easy to get around.

[weileong]

Erm... isn't the history of digital watermarking pretty dismal so far? I mean, the RIAA tried to watermark music but Ed Felten and gang pretty much demonstrated the futility of that (and pretty quickly, too).

Are software binaries really so different that watermarking would work for it?

Re:Useful, but easy to get around.

[karolo]

Well, I don't know about other countries, but in Spain there is an equivalent procedure, called "Deposito Legal" (legal deposit), and they have specific instructions for computer programs, I have used it. I would imagine that at least France (from where Spain used to copy these sort of things) has something similar.

Re:Useful, but easy to get around.

[Hellkitten]

I somehow doubt this watermarking is at all possible.

const char* watermark = "This is mine"

This should work, but is trivial to remove if you have the source. Might be less trivial if you don't, but have decompiled something, which is what the linked article discuss.

So while watermarking can work for closed source I don't think it can work for opensource software, if the copyright infringers have any clue at all. It's likely to be known that the ugly kludge in foo.c is actually a trick to get the string "This is GPL" into the executable without it beeing obvious

Re:Useful, but easy to get around.

[stew77]

but this could be simply gotten around by just looking at the code, then rewriting it

This is not getting around, this is the legal way of doing it without violating the GPL. Reusing the code directly under non-GPL licenses is forbidden, but writing code that implements the same algorithm is not. Unless, of course, you have a software patent on that...

Re:Useful, but easy to get around.

[angel'o'sphere]

But the history of copyright law in the UK has tended towards an "If you wrote it then it's yours, now can you prove it?" model, and proving it is a difficult thing to do nowadays if you publish an original work on the net.

Here we have no national registry of claims of copyright as a matter of public record. Maybe the EU should move towards this model (although I deeply distrust any approach that would actually require registration).
I disssagree. If you have created something, you usually have kept the interims work pieces, like drafts, first milestones or in case of software, analysis and design documents. Probably you have used a version control system.
Prooving that yours is yours in cases that matter will be quite easy.
How often have you heared about "he ha stolen my copyrighted work" cases?
They rarely happen. Most of copyright cases arise from uncertain ownership or via several countries boarders.
angel'o'sphere

Re:Useful, but easy to get around.

[angel'o'sphere]

I agree completely. I think furhter there are far easyer and more reliable possibilities. E.g. creating a kind of checksum based on higer level informations, like data flow, control flow or program structure, like inheritance etc.
Of course that can be changed also, even far enough to "obscure" the origin. But changing the inheritance graph of code is not that easy ...
the problem with watermarking, IMHO, is that as soon as the schema is known it can be "removed" or "destroyed".
angel'o'sphere

Re:Useful, but easy to get around.

[__past__]

This should work, but is trivial to remove if you have the source. Might be less trivial if you don't, but have decompiled something, which is what the linked article discuss.

Trivial even when compiled, just have to care more about the lengths of strings.

$ sed -e 's/Free Software Foundation/SCO Group. All rights reserved/' /usr/local/bin/bash > /usr/local/bin/scosh
$ chmod +x /usr/local/bin/scosh
$ scosh --version
GNU bash, version 2.05b.0(1)-release (i386-portbld-freebsd5.1)
Copyright (C) 2002 SCO Group. All rights reserved

Re:Useful, but easy to get around.

[NickFitz]

I believe that only applies to *printed* works

Not if this law makes it onto the statute books.

Something gives me the impression they haven't really thought this one through... :-)

Re:Useful, but easy to get around.

[cperciva]

Not at all. That law does not require that any works be deposited with copyright libraries; it simply allows the minister to make regulations which would specify which works did, or did not, need to be deposited.

Now, trusting ministers to make sensible decisions (eg, requiring that peer-reviewed e-journals be deposited, not requiring that web sites be deposited) may be hopelessly optimistic, but the law isn't completely absurd.

Re:Useful, but easy to get around.

[Anonymous Coward]

The article states that the technique resists obfuscation so simple randomizing whitespace and even changing things like variable names might not work. Though it seems difficult to believe this without seeing an actual example.

Re:Useful, but easy to get around.

[Fareq]

Simple problem:
If it is under the GPL then theoretically, you want people to be able to improve your software (so long as they distribute the source afterwards.

Nobody can read code that has been obfuscated and then watermarked, so nobody will look at your code, so nobody will improve it, so what the hell is the point of using the GPL?

Just release under a different license if you don't want people to modify it.

Besides, most watermarking is done as a post-compile process -- meaning that the watermark wouldn't be in the source code, in many cases -- just the obfuscation.

Beware the flipside

[egg troll]

I would be very careful with using something like this. Its nice to think that one could use watermarking for protecting GPL'ed code. However, should the technique prove successful, expect to see everything under the sun watermarked by less benevolent entities.

Re:Beware the flipside

[Karamchand]

Could you please elaborate on the "less benevolent entities", perhaps giving some examples of what bad situations might arise? I just haven't get it yet.
Thanks!

Re:Beware the flipside

[Anonymous Coward]

Shouldn't you not be using code from those entities anyway?

Re:Beware the flipside

[dotgain]

Umm, call me crazy, but are you new here?

Re:Beware the flipside

[Valar]

So? You already shouldn't be using code owned by the said 'less benevolent entities.' Your arguement boils down to "It makes it harder to steal!" I'm all for the protection of software copyrights by both technical and legal means. Now, if it is a question of someone illegally claiming ownership via watermark, the true owner should have plenty of evidence on hand to prove the rogue watermarker has no legal ground to claim ownership-- just as if I took all of the linux source files, put a comment at the top that said "Copyright 2003, Me" and started distributing it.

Of course, you are the egg troll :)

Re:Beware the flipside

[Directrix1]

It doesn't matter what you do to code as far as watermarking goes. If the watermarking method is publicly known than it can be easily changed anyways too look like it was watermarked by someone else. For instance you could watermark your code by having variable length whitespace before your comments or something. But that could easily be changed.

Re:Beware the flipside

[jroysdon]

non-free or open source (ie commercial) entities.

Actually, there would be nothing wrong with this. If it's good for GPL'd software, it's good for all software to protect IP.

The real trick is what if some non-GPL code is watermarked, but in fact watermarked by the real author (in other words they "borrowed" the code and then watermarked it)?

Re:Beware the flipside

[Anonymous Coward]

No, but apparently, with a uid in the 600,000's and an inability to formulate a proper url (hhtp is not a valid protocol and it's followed by two slashes, not to mention the enigmatic lack of a period before the TLD and after the subdomain; all of this was repeated three times so I doubt it was a typo), I'd say you are.

Re:Beware the flipside

[Kenja]

"expect to see everything under the sun watermarked by less benevolent entities"

Because only open source developers should be able to protect there IP.

Re:Beware the flipside

[Anonymous Coward]

However, should the technique prove successful, expect to see everything under the sun watermarked by less benevolent entities.

What's your point? That people we don't like shouldn't be allowed to enforce their copyrights? Watermarking in this manner is completely transparent to the end-user, and cannot be used to control use, which is what the "less benevolent entities" you are talking about are so reviled for.

Re:Beware the flipside

[geoffspear]

Information wants to be free, unless it's released under the GPL.

Re:Beware the flipside

[Anonymous Coward]

KNOW THIS ASSWIPE... Some of us don't code for profit. We do it because we like to. So why should profit matter to people like us att all? Just because you want to hack some code (which it's unlikely that you do) just to make a pile of money, don't lump all other coders in that ridiculous cult of "creating wealth". Some of us just want to code because we can. Fucking moron.

WTF?!

[TriCCer]

This has no effect on GPL:ed code... The code is written, it can be copied, there is _NO WAY_ to watermark TEXT. Why is this news?

Re:WTF?!

[Anonymous Coward]

Errr - maybe you should try reading the article??? idiot!

Re:WTF?!

[Anonymous Coward]

RTFA, shithead.

Re:WTF?!

[adrianbaugh]

What would be the point in watermarking text? I take it (I haven't read the article but I don't reckon you have either) what is proposed is some way of coding so that a particular watermark structure has to get generated by the compiler and will appear in the executable binary. I have no clue whether this is possible or not, whether it would survive (say) an obfuscator program being run on the source or being compiled with a different compiler, or minor changes to the code, but imagine these would be pretty crucial features.

Re:WTF?!

[Suppafly]

This has no effect on GPL:ed code... The code is written, it can be copied, there is _NO WAY_ to watermark TEXT. Why is this news?

Either you are an idiot, or you just were in such a rush to make the 3rd post you forgot to read the article or even think about the concept of watermarking.

It would be trivial to put a watermark in sourcecode, you just have to develop the program so that the watermark was essential to the programs operation.

Re:WTF?!

[Suppafly]

What would be the point in watermarking text? I take it (I haven't read the article but I don't reckon you have either) what is proposed is some way of coding so that a particular watermark structure has to get generated by the compiler and will appear in the executable binary. I have no clue whether this is possible or not, whether it would survive (say) an obfuscator program being run on the source or being compiled with a different compiler, or minor changes to the code, but imagine these would be pretty crucial features.

Read the article, or atleast the summary on the IEEE link. They specifically address these knee-jerk complaints.

Re:WTF?!

[Anonymous Coward]

RTFA

Re:WTF?!

[adrianbaugh]

Hmm. I've now read the article and it seems I was right. The watermarks aren't perfect though, 8% of them can be destroyed by either a decompile/recompile or an obfuscator attack. It seems pretty specific to java, too, which (to my mind) makes it of pretty limited use given how desperate the rats seem to be to get away from that particular sinking ship. (Yes, I know Java's great'n'lovely'n'wonderful, but Windows support is laughable so 95% of users are barely able to use it, so save your flames for Redmond...)

Re:WTF?!

[TriCCer]

it wont work. open source is too "open" for this to be possible.

Re:WTF?!

[adrianbaugh]

Er, what complaints? I wasn't complaining about anything, just speculating on the nature and limitations of the technology. Anyway (see other post) I've now read it and my speculations turned out to be pretty much right - the points I mentioned are requirements, and to some extent they're met.

Re:WTF?!

[mark-t]

It would be trivial to put a watermark in sourcecode, you just have to develop the program so that the watermark was essential to the programs operation.

And it's just as trivial to remove the dependancy on the watermark from the code becase you would have the source code to be able to see how it works.

Unless you are talking about obfuscating the code so that it is incomprehensible to most... in which case, why bother with open source at all?

Re:WTF?!

[BobTheLawyer]

what on earth do you mean?

Re:WTF?!

[Suppafly]

again, read the article. they are talking about java code in which you dont have the source, but an easy to decompile class file.

even if you did have the code as with gpl software, it wouldn't be totally trivial to remove the watermark, because it wouldn't be immediately obvious which code contributed to the watermarking.

Re:WTF?!

[Anonymous Coward]

It would be trivial to put a watermark in sourcecode, you just have to develop the program so that the watermark was essential to the programs operation.

Please supply proof-of-concept that developing a program with this property is trivial. *Even in the case of programs implemented in java*

Re:WTF?!

[mark-t]

again, read the article. they are talking about java code in which you dont have the source, but an easy to decompile class file

I had read the article, but the post to which I was responding made reference to "source code", which is what I addressed.

even if you did have the code as with gpl software, it wouldn't be totally trivial to remove the watermark, because it wouldn't be immediately obvious which code contributed to the watermarking

People who write code that can't be easily understood by reading the source code may as well not be bothering with open source in the first place. One of the best reasons to releasae source code is to get the benefit of a large number of people maintaing it, but if nobody can understand what the code does, what good is it? All that will end up happening is potentially useful code will get rewritten from scratch by someone else.

Re:WTF?!

[sosume]

Oh, come on, he is right.

If you can get a local copy of the class file, you can decompile it, rearrange it and create a new binary with a different (or nonexistent) watermark.

If you make source code or the executable dependent on the watermark (bad idea) this can be easily circumvented as well (won't go into the tech details but it is easy to do)

Nothing is bullet-proof in the digital world. Get used to it ;)

Re:WTF?!

[TortiusMaximus]

And when you learn how to program, and learn about such topics as "steganography", and how such topics differ from "stenography", perhaps you won't be such a fucking idiot ;)

Re:WTF?!

[Rick Zeman]

When you learn how to program, and read such topics as "stenography" you won't be such a fucking idiot.

And when you become functionally literate and learn how to comprehend what you read, you'll find out all about "steganography." Or do you want him to become a secretary, you putz?

Re:WTF?!

[kirinyaga]

the point to watermarking code is :
a) locating the code portions related to the watermarking is not trivial. It doesn't mean the source code is unreadable, it means locating this code cannot be done via automatic tools, you need actual humans (i.e. paid programmers who cost you money) to browse through thousands of source lines.
b) removing that code isn't trivial either. Once you located the code, you see it consists of lines dispersed through several thousands lines of code. Since the watermark is deeply embedded in the data structures of the program, to remove it you need to carefully examine and rewrite large portions of code. Again, this cannot be done via automatic tools, you need programmers to do it, then you need to test the code to be sure no bugs were introduced in the process.
Basically, watermarking code means to remove the mark you need to spend a lot of money with humans specialists, who will spend almost the same time and efforts removing the watermarking than it would have cost to program the thing from scratch.

I think not

[Espectr0]

GPL appears to common sense still found in people, and simply decency.

If the trademark stuff gets too hectic, then maybe this will be needed, but for now i dont think it's needed

Re:I think not

[LuxFX]

If the trademark stuff gets too hectic

If?

Can I have directions to your hole, I'd like to live there too.

Re:I think not

[deanj]

I would tend to agree with this thinking.

If people object from this sort of thing in commercial products, then they can't very well turn around and advocate it for this and still have a moral leg to stand on.

Re:I think not

[Anonymous Coward]

Can I have directions to your hole

Best. Pickup Line. Ever.

Re:I think not

[DrEldarion]

I would tend to agree with this thinking.

I would, if I could decipher that first sentence.

-- Dr. Eldarion --

Re:I think not

[Espectr0]

Sure, come down here to Venezuela, we are a poor country, but somehow we are the #3 country rated on people's happiness (some scientific study made a few weeks ago)

We don't know what AOL is and we don't know what DMCA is. What more could you ask?

Re:I think not

[Anonymous Coward]

im living in your mother's hole right now. come on in

Re:I think not

[tumbaumba]

Can I have directions to your hole, I'd like to live there too.

That's easy. Get on a nearest interstate. Drive to the north. Once the road ends come out and walk for another thousand miles. Keep to the Great North. We'll see you there.

Your friends from geeks heaven.

Re:I think not

[Anonymous Coward]

directions:

www.goatse.cx

Its open source

[Anonymous Coward]

The watermark can be pulled out, and even propreitry software can dewatermakred, you just need to be a binary overlord to crack it.

Re:Its open source

[LittleDan]

Well, this can always be solved by some DRM. And then when the DRM fails, all we need to do is invoke then DMCA. That's the key to open-source: proprietary DRM and invoking unfair laws.

A better idea

[Anonymous Coward]

Is to switch to BSD license.

Watermarking is so RIAAish.

Re:A better idea

[hobbes75]

yep.

The ramifications.

[caluml]

What might be the ramifications of this?"

It might cause the sky to fall down on our heads, or the atmosphere to evaporate, killing us all with solar radiation.

Re:The ramifications.

[ari_j]

You do realize that the atmosphere has already evaporated, right, and that's what makes it an atmosphere instead of an ocean or skating rink?

Re:The ramifications.

[Anonymous Coward]

Learn to kwack, so you can duck, when the sky falls.

Watermark?

[NicenessHimself]

we are talking about a bunch of 1s and 0s here. If it can be watermarked, it can be unwatermarked. A simple script will be able to rearrange stuff to disrupt the watermark without affecting the execution of the program.

Re:Watermark?

[Doomrat]

we are talking about a bunch of 1s and 0s here. If it can be watermarked, it can be unwatermarked. A simple script will be able to rearrange stuff to disrupt the watermark without affecting the execution of the program.

Yes, a bit like how it's easy to reconstruct a burned down house from its ashes.

Re:Watermark?

[NicenessHimself]

Well I think burning is lossy.

On the other hand, digital watermarking is hardly http://lzip.sourceforge.net territory!

Watermarking can't be lossy, since it can't affect operation. Any non-lossy translation, however clever, can be detranslated?

Haven't digital watermarks and obfusication etc got a real bad press recently? There was that DMCA case with the professor not allowed to say how he cracked watermarks, iirc.

Re:Watermark?

[Naerbnic]

Perhaps this is true for static data (as in a bunch of source code), you can insert a watermark into code, which will create a dynamic watermark (i.e. something that depends on the runtime operation of the program). To make a long story short, you cannot easily remove it by rearranging binary code, and it's difficult (i.e. NP-complete for those in the know) to analyze the software to remove. Tack on the fact you can tamperproof the code (i.e. make the behavior of the program depend on the existence of the watermark), and you have a pretty difficult path to walk if you want to remove it.

More info can be found in this paper, if you're into reading that sort of thing.

Re:Watermark?

[Doomrat]

Watermarking is different from just breaking data. It's similar to PGP signing stuff.

Re:Watermark?

[NicenessHimself]

Golly, I had no idea asymetric cryptography was involved!

I envisage a 'watermarker' as being some program you run your app through and it records a signature, which you can treat as a 'fingerprint'. You can then run that watermarked program through a checker, and it will tell you how close (100%) the match is?

There are commercial programs which translate binary applications from one instruction set at a time, sometimes as a simulator, sometimes outputting a compiled program.

A program is just a flowchart. It can be translated into any other equiv form quite easily.

I imagine that translating an x86 binary to ppc and then back again using a different off the shelf tool would be pretty effective.

Things like 'make the app rely on the logic!' type hints are used by shareware authors all the time.. and they are routinely cracked.

Re:Watermark?

[dmh20002]

thx. that paper was some interesting stuff.

Re:Watermark?

[Temporal]

Did you read the articles? The second link discussed a watermark for Java programs which generally withstood decompile/recompile attacks as well as obfusication attacks. The whole point of watermark technology is that it is made difficult to remove the watermark without destroying the data.

Before you discount their techniques, you should probably read the papers. I have a sneaking suspiscion that these people, who have spent a great deal of time researching this topic, may know some things you don't.

Re:Watermark?

[NicenessHimself]

Sorry, did mean to come across dismissive.

Has someone yet tried to write a tool specifically to unwatermark their watermarks?

Re:Watermark?

[Anonymous Coward]

NP-complete for those who arn't in the know. Those in the know know undecidable - ala Halting problem.

Re:Watermark?

[Naerbnic]

You are correct. That's what happens when I write these things too quickly.

Re:Watermark?

[Anonymous Coward]

for i in `find | grep watermarked code` ;
do
rm -w $i
done

Yep, it's that easy, I guess the whole watermarking movement will implode shortly. Hate to do that to everyone.

Re:Watermark?

[Doomrat]

As somebody else mentioned, it's arrogant to think that they haven't thought into this deeper that you have.

Re:Watermark?

[anethema]

Well really, this is for GPL programs. It's not like you have the executable and are trying to get rid of some watermark. You have all the source code and can removing any watermarking code at your leasure.

Even if the source is big, a large programming team shudnt have too much trouble. finding whatever code watermarks the executable.

Tho, I didnt RTFA, so maybe there is a way of obfuscating it? Ahh well

Just an extra step

[Moeses]

I think this would only help the most blatent copying. If the watermark code is embedded in the datastructures of the source code either it would be fairly easy to remove or the software would be in such a state that it would be hard to maintain and evolve. The attempt to avoid piracy would have a negative long term effect on the project.

I can still see this being useful if blatent copying of the software is the biggest problem the project faces, however I'm having trouble envisioning a scenerio where that's the case.

details about watermarking techniques

[gripdamage]

The paper cited in the first link is from a professor I once had.

On his website I found his full article, if you want some details about watermarking techniques. It's has a lot more meat than presentation slides.

Re:details about watermarking techniques

[Theoria]

The original poster made a comment about never getting to play with watermarking code. Along with some informative papers about software watermarking, obfuscation, tamperproofing, etc and uses for such techniques, there is an implementation on the SandMark website.

Re:details about watermarking techniques

[cpghost]

If I were to implement a watermarking scheme, I would add an option to gcc (and gas and ld), which would perform like this: 1. ELF sections would contain a watermark. 2. A cyrptographic checksum (SHA) will be appended to the watermarked ELF section. 3. C initialization code would verify the integrity of the ELF section, and refuse to start if it were tampered with. Of course a few additional steps need to be taken in order to avoid circumvention of this scheme. Now, if some dumb company or individual were to tamper with the watermark, the cryptographic checksum won't compute anymore and the startup code would refuse to load the program. Of course, this scheme is far from perfect: a. The startup code could be replaced by a script/proggy which modifies ELF files. b. Checksums need to contain a secret seed of else they would be computable too. But for casual tampering (of _binary_ executables), this would be more than enough.

as usual

[snarkh]

The submitter did not bother to look at the atricle (or rather the presentation).

The main idea is that you embed the watermark into the code and then obfuscate it. The resulting code is unreadable, otherwise watermark would be trivial to remove, which makes it absolutely useless as far as open source is concerned.

Re:as usual

[lifebouy]

I don't know about binaries, but in source code, couldn't you just tuck in a few unprintable characters in a particular sequence? If it became rampant, then people could find it if they were looking for it. But who would? Those who are lazy enough to use such code are lazy enough not to think of it. Not that lazy is a bad trait for programmers, quite the contrary. Some characters are zero length if I recall correctly, so they don't even show as a space. I could be mistaken on that, though. At any rate, a few of these sequences buried randomly through your code should suffice, because if you had to take it to court, the code in question could be brought in as evidence.

Re:as usual

[dspeyer]

From the GPL (section 3):

You may copy and distribute the Program (or a work based on it, under Section 2) in object code or executable form under the terms of Sections 1 and 2 above provided that you also do one of the following:
* a) Accompany it with the complete corresponding machine-readable source code,
...
The source code for a work means the preferred form of the work for making modifications to it. (emphass added)

So, unless you plan to do maintainance on obfuscated code, this is no good for GPL software. In fact, it's no good for Open Source software of any kind.

Admitadly, you could use unobfuscated code and refuse to reveal the watermark, but it's kind of tricky to keep things secret in the OSS world.

Re:as usual

[ifdef]

I think one could do this effectively without obfuscating the code at all. I've heard about code that, when a certain key sequence is entered, displays a copyright message (the text of which might be a little bit obfuscated in the source). In the case I heard of, it was completely effective at proving that the software was stolen.

The point is that people who are going to steal software are not likely to spend very much effort at all to figure out how it works. On the other hand, someone who *does* figure out how it works and modifies it, probably could have written it themselves anyway and wouldn't need to steal it.

Re:as usual

[p3d0]

A simple search-and-replace on that code will wipe out your clever watermark.

Re:as usual

[screenrc]

How can you s/// to remove the watermark, when
you don't know the watermak sequence?

Re:as usual

[p3d0]

Use your imagination. If the watermark is just a string of some kind, it should be painfully obvious which string it is, and you can just delete it. If the watermark is encoded in the identifiers used, you just search and replace lots of the indentifiers and the watermark is gone. If it's encoded in the whitespace, you just strip all unnecessary whitespace. etc. etc.

If you can think of a source-code watermarking scheme which can't be trivially defeated with search-and-replace, I'll concede the point. The reason the one in the article works is because the code is obfuscated, and that is not suitable for OSS.

They are talking about Java

[HBI]

Wouldn't that have been a nice thing to put in the post text?

Obviously Java's structure (class files, interpreted code, easy decompilation) makes this easier to accomplish than it would be in C or C++ (or any other language compiled for a particular architecture). It just doesn't make all that much sense for code intended for C compilation, where the source code is freely transmitted. You rewrite out the watermark, it's as easy as that.

its for java and its binary watermark, not source

[Anonymous Coward]

Caveat - I haven't read the paper but from the description is looks like you apply your watermark to the class files after compilation.

So,
1) only protects binaries not source ... therefore not applicable in its current form to source code which would be required for any usefullness to GPL.

2) its for Java which is easier due to the cannonical form (bytecodes) that can be manipulated by the watermarking tool. You could probably do this to protect GPL binaries but with less portability

IMHO opinion, not usefull for source but sure if you're worried that some of your precompiled binaries are being ripped, then maybe.

For source, you need to detect common code patterns and use source tools that have been discussed elsewhere on /.

Ummm...

[praedor]

Couldn't the watermark be very easily defeated simply by copy-pasting the code text into a new file and recompiling? You could also simply manually copy word for word the code anew and, poof!, no watermark.

Only if the algorithm is a secret

[iceco2]

and even then it would be tricky, and me
be circumvented.

Whatermarking is based on taking advantage of some redundancy in the data marked. If ypu are aware
of the redundancy you can elliminate it.

signing code is much more tricky than signing sound
or images, and they havn't figured out yet how
to make any of these tamper proof.

probably simply adding more optimizations would erase most watermarkings.

Me.

Does it really matter???

[Pedrito]

I wrote a book ages ago about Windows File Formats. Included in the book was some code which was written by a third party. I obtained permission from the code's author to put it in the book, but it was very clearly copyrighted by the author of the code, both in the code, and in the book.

So Intel is working on a product and they just swipe up the code out of the book, never ask for permission or anything, and use it in a commercial product (VTune). The author of the code, of course, was furious. He approached Intel. They blew him off. He had reverse engineered their code. He could produce an exact replica of the binary with his own code using the MS C compiler.

He never got anything out of Intel. I suppose he could have hired attorneys, but he wasn't a wealthy guy. He couldn't find attorneys to take it without cash up front. So my question is: How do watermarks help him? I mean the guy could put the binaries side-by-side, and there was no question, it was his code.

Your code is as protected as the lawyer you can afford...

Re:Does it really matter???

[Anonymous Coward]

So why did he publish that code in the first place ?
This is fucking pathetic, either you are for code reusability or not.
Frankly, having that very code benefiting people in the form of VTune ( which is a very good tool) is a fucking good thing is it not ?
Fucking hypocrites.

Re:Does it really matter???

[Namaseit]

Guess what. FSF protects the copyrights it holds. It has plenty of cash to take companys to court. Thats why you have a choice. Give your copyrights to FSF and they will take care of it. Or keep it yourself. Its called free software. Was his a free software project? Im guessing not. If you read the title it is mainly aimed at GPL code. Which has the backing of the FSF.

I see this as a response from companies and SCO who say that the Free Software Community needs to change its way of including code from unknown parties as it might be copyrighted. This is to take preventative measures so that GPL code doesnt make it into *THEIR* products. Then later on a company cant try to say that they own the copyright on the code in a GPL project that they originally stole it from. Just as some people have questioned SCO about whether or not they actually stole code from the Linux Kernel.

Re:Does it really matter???

[thogard]

Does the FSF take care of it? 3com put gnu tar (and zip) into their nbx phone system. GNU "took care of it" and now 3com wants money for the next grade and hasn't provided any source for several years worth of versions of GNU contamiated code. So I'm stuck with a system that the license says I can mess with the code but I don't have it and the thing is so full of bugs.

Re:Does it really matter???

[Anonymous Coward]

The FSF is still working with 3com on that case.

Re:Does it really matter???

[Anonymous Coward]

Good. Because there junk is broken and I need source to fix it.

Re:Does it really matter???

[Anonymous Coward]

"He could produce an exact replica of the binary with his own code using the MS C compiler." So I am to infer that Intel is using Microsoft's compiler to compile VTune, rather than using their own (excellent) compilers...

Re:Does it really matter???

[Herkum01]

Your code is protected as long as you are willing to protect it. Too often people seem to think that they will NEED a lawyer to do a lawsuit. If this guy had just followed up in court, there was a darn good chance that he could have gotten a settlement.

The legal process may seem complicated but when it comes down to it, a judge will listen to a regular Joe just as intently as he would a lawyer. If you are too intimidated to go in front of a judge, you have already lost. Don't let some lame-ass attorney tell you have to purchase justice, do it yourself. The result can be very liberating.

Re:Does it really matter???

[Alsee]

Just a random thought...

If he's given up on trying to persue it himself he could throw the code under a GPL license and transfer the copyright to the Free Software Foundation. Let them persue it. The case should be a slam-dunk if you have a copy of the book that pre-dates VTune.

-

Re:Does it really matter???

[julesh]

Quite possibly, depending on how long ago this happened. Intel's compilers have only recently become compatible enough with MS's to be able to readily integrate code compiled with one into the other. They probably produced versions for various different compilers, the MS one was the one this guy got hold of.

Re:Does it really matter???

[julesh]

The case would have been clouded by the publication of the code in an instructive book.

A programmer could easily hold up a copy of your book, and say "I learnt how to do this kind of thing from this book. It says to do it this way, so I did". This would be a fairly convincing argument.

I'm not saying that Intel were right to take the code, but rather that:

a) the lawyer was probably right not to take the case without an advance payment. I'd say there was at best a 30% chance of winning (based on my experience with how the UK courts handle such things, I have no experience with the US judicial system).

b) Intel probably didn't realise they had done anything wrong. Example code in textbooks is usually considered fair game by most programmers. It is there to be instructive - they were instructed by it.

(nb - I've just realised I might have misunderstood you here, was the code printed in the book as an example, or was it included in a companion CD or something like that? If its just the latter then ignore my comments)

I know! I know!

[dotgain]

Just keep it to yourself and mod me down thanks.

Pointless.

[Clinoti]

Does this not go against what open source is all about? It's open code given without the extremes of ownership like water/copy/trade-marks. Where does this apply with CVS and open project developments?

I like the idea behind it but I don't think it's the answer. It would be easier and more applicable to have a 3rd party database that held published coding rather than having to graph and mark my work everytime I released etc... this way I have it (1) in the public domain and (2) have a published reference for it. (For smaller works).

And borrowing code despite our hatred for it is one of the tools of software development, not so much in the word for word copying and ctrl-V (thats a whole separate discussion) but capturing the methods and innovating them, then re-releasing it into the wild for the next innovator or janitorial white hat. Thats what open source coding is for me anyway not the profit or the credit but the goal.

Re: Pointless.

[Black Parrot]

> Does this not go against what open source is all about? It's open code given without the extremes of ownership like water/copy/trade-marks.

No, all GPL'd code is supposed to be copyrighted. The GPL just grants the user certain rights that are not normally available under copyright law.

Look at the headers in the source for some of the GPL'd programs on your system, or visit the FSF Web site and see what is recommended for those headers.

No, it can't

[anthony_dipierro]

Isn't the code itself a watermark? Sure, you can change things here and there, but ultimately the similarities are going to be far to much to be pure coincidence.

The purpose of digital watermarking seems to be to identify unique instances of the thing being watermarked. So if I have a copy of Britney Spears' album, it's obviously copyrighted by her record company. With watermarking I can get more specific, and see that it was burned from a CD which was sold to Bob Jones. With the GPL this isn't useful. Sure, the code might have been derived from a copy sold to Bob Jones, but he may have legally made a million copies and distributed them around the globe before the GPL was violated, by someone else. You can't control the watermarks, because you can't control the distribution.

Re:No, it can't

[julesh]

Isn't the code itself a watermark? Sure, you can change things here and there, but ultimately the similarities are going to be far to much to be pure coincidence.

A lot of code is very generic. Much code could easily be reimplemented as a new implementation that produces almost identical object code just by starting with the same specification and compiling with the same compiler.

How then do you tell if the code was copied?

(Actually, the answer's easier than watermarking - use a non-obvious, unlikely, but otherwise equivalent solution)

Re:No, it can't

[anthony_dipierro]

How then do you tell if the code was copied?

Why do you care? If it's generic code, it's probably not copyrightable in the first place.

RTFA

[NivekEnterprises]

OK, i'll make it easy on all of you. Hear is the article:

A Practical Method for Watermarking Java Programs

Akito Monden, Hajimu Iida, Ken-ichi Matsumoto, Koji Torii, Nara Institute of Science and Technology
Katsuro Inoue , Osaka University

Java programs distributed through Internet are now suffering from program theft. It is because Java programs can be easily decomposed into reusable class files and even decompiled into source code by program users. In this paper, we propose a practical method that discourages program theft by embedding Java programs with a digital watermark. Embedding a program developer's copyright notation as a watermark in Java class files will ensure the legal ownership of class files. Our embedding method is discernible by program users, yet enable us to identify an illegal program that contains stolen class files. The result of the experiment to evaluate our method showed most of the watermarks (20 out of 23) embedded in class files survived two kinds of attacks that attempt to erase watermarks: an obfuscactor attack, and a decompile-recompile attack.

Disallow Software Patent Holders From Using GPL

[Anonymous Coward]

If we could eventually get to the point of GPL code disallowing use by any software patent holders we could choke them off too.

It is becoming impossible to write code without violating some patent granted by the unknowledgeable patent office.

Just what we need

[Anonymous Coward]

The FSF thought police.

Re:Europeans, mod this up right now!!

[Anonymous Coward]

I recently run across techniques

or confuse run with ran without puttin have in front of the adv.

Re:So what?

[PigeonGB]

Uh, then how do consultants and companies who provide "services" like adding features and customization make money?

Answer: They DO believe in money for services.

Re:Tottaly offtopic...somewhat.

[Starky]

It means "if I remember / recall correctly."

Not easy -- story submitter is confused

[0x0d0a]

Look at the techniques. This stuff is designed for use on binary-only software (with the sole exception of the comment embedding, which is easy to strip, and the embedded strings, which are easy to remove/modify).

The approaches they're talking about are done at the compilation phase or post-compilation on Java bytecode.

It's *extremely* difficult to produce good, reliable watermarks, because different compilers will build software differently, as will different optimization options.

I'd essentially say that source-based watermarks are a lost cause (at least with C, and with the current constraints of readability and simplicity on code).

A much better approach would be a project that does fuzzy comparisons on binaries, and is somewhat aware of ELF. Basically, you'd have a program that would have a set of known GPL code (a compiled Linux system would work well) and compare it to a set of compiled code.

This is still not perfect if the person is malicious and just tries using a different compiler. This has happened before with xvid and use of icc. However, there aren't *too* many compilers out there.

Hmm...this is an interesting problem.

A more interesting approach that just occurs to me now -- in general, the proportions of compiled code should be roughly the same, independent of compiler -- adding padding, etc. Generate a call graph of the function tree in a set of GPL code. Then your checker would do fuzzy matching on chunks of that call graph against the suspicious code. It'd take a bit of massaging. It'd also still need some manual looking at the target once identified. However, this should be able to run in a pretty automated manner (even if it takes a long time to run) and could potentially turn up some interesting goodies. It'd certainly discourage commercial folks from ripping off GPL-using authors and companies.

Try taking a Windows system with a lot of installed (non-GPL) software and a Linux system with a lot of (GPL) installed software. Start a comparison running. See what turns up.

Re:Not easy -- story submitter is confused

[sICE]

It's not that fuzzy - i mean you seem to look like you know what all this stuff is about, and no offense is intended here - but, sadly, you underestimate the power of modern cracking and reverse engineering tools you have at your disposal.

Even with compiler optimizations and processor specific instructions AND EVEN different compilers, you can actually find and detect "similar HLL code" (there's a tool called DATING that can do that - contact me for a copy, it's hard to find - and which the name is a pun to the IDA FLIRT abilities). I dont know for different cpu, but i guess it would be ressources hungry, and i dont know of a tool that can catch those for now. Try anyway to have a look at VMWARE binaries - win32/linux - with it, you'd probably be surprised.

blah, dunno what i wanted to say next it's late here... ~<:(

Re:Not easy -- story submitter is confused

[0x0d0a]

Even with compiler optimizations and processor specific instructions AND EVEN different compilers, you can actually find and detect "similar HLL code" (there's a tool called DATING that can do that - contact me for a copy, it's hard to find - and which the name is a pun to the IDA FLIRT abilities).

[shrug] If you post a link to a source archive, I expect more than a few people would be interested. I think it would have to go well beyond FLIRT to be useful for this problem, though.

I just took a look at FLIRT -- FLIRT produces a signature based on the first 32 bytes of a function, allowing for holes. This might work for a relatively small function set (such as the library function identification that IDA is trying to allow). However, it's not going to deal with the differences between icc and gcc, even. As a matter of fact, flipping the -fomit-frame-pointer flag to the same version of gcc with the same optimization level is liable to cause it to throw up its hands in disgust.

Re:Not easy -- story submitter is confused

[pVoid]

While your idea is noble, it's also more of an academic excercise... and even if it *does* become legal, I would abhore it.

Why? How do you define false positives?

Re:Not easy -- story submitter is confused

[0x0d0a]

How do you define false positives?

A tool like this couldn't distinguish between positives and non-positives alone. But it could isolate code to be reviewed by authors -- if it could email the GNOME folks and say "80KB of very similar looking code is in Adobe Photoshop", it'd let people start poking at it. Given a bit of poking at disassembly, it's not that hard to see whether the code's been swiped.

And I'm not sure what you'd mean by "if it *does* become legal"...surely there'd be no legal problems with running something like this.

Re:Not easy -- story submitter is confused

[WhaDaYaKnow]

(there's a tool called DATING that can do that - contact me for a copy, it's hard to find - and which the name is a pun to the IDA FLIRT abilities).

And also an excellent name if you want people to NEVER be able to find it using Google.

Re:Not easy -- story submitter is confused

[julesh]

And I'm not sure what you'd mean by "if it *does* become legal"...surely there'd be no legal problems with running something like this.

Hard to be certain. In order to operate, it would have to create a temporary copy of the program being analysed in memory. This may or may not constitute a copyright infringement, depending on your particular jurisdiction and how the judge / jury / evil fascist dictator (delete as applicable) is feeling on that particular day.

Many countries have specific provisions to allow reverse engineering, which would probably get you off the hook. However, I don't believe the USA is one of them, which is probably the primary area in which the program would be used. If the code is obfuscated in any way and your program strips away this obfuscation, that could be argued to be a circumvention measure of a copyright protection device, thus bringing the DMCA into play.

IANAL, etc.

Re:Not easy -- story submitter is confused

[0x0d0a]

In order to operate, it would have to create a temporary copy of the program being analysed in memory.

At least in the US, this is an exemption. I've seen it before, darned if I remember where. If you couldn't do this, you couldn't send data over a network, execute binaries, etc.

Many countries have specific provisions to allow reverse engineering, which would probably get you off the hook. However, I don't believe the USA is one of them, which is probably the primary area in which the program would be used.

This is exemption (f) of the DMCA if used to ensure inter-program compatibility.

Re:Not easy -- story submitter is confused

[pVoid]

I meant: if it becomes a tool lawyers can base themselves on.

But I see your point.

Re:Not easy -- story submitter is confused

[Anonymous Coward]

email the GNOME folks and say "80KB of very similar looking code is in Adobe Photoshop"

That's a laugh. I'm sure all the Photoshop guys are sitting around, and one of them goes "Hey, what's the code in the Gimp where it opens 50 different windows and you have to right-click on everything to do the most basic functions? Let's steal that!"

Yes, I know it was an example. :-P

Free SCO t-shirt

[Anonymous Coward]

Free SCO t-shirt

Get them while they are available.

In 2 years this company is going to be bigger than Microsoft.

Don't miss a chance to tell your children.

Is this a big problem?

[NanoGator]

Pardon my naievity. I just wanted to ask, are GPL violations a big problem?

If it's happening all the time and this is a method slow progress of it, then I don't see a huge issue with it. But if it is a once in a while type of thing, then how could this have anything but a negative impact on GPL? The potential is there (reality could tell a different story) for people to shy away from it, worrying that they haven't quite got all their ducks in a row. If it's easy to automatically scan their code and say they're in violation, well then what? I guess what I'm trying to say is that it could be mishandled, thus treating the users of GPL code like they're potentially thieves. It strikes me that one of the compelling factors of GPL is their reliance on the honor system. Whatever you do, don't play games that can damage that bright point of GPL.

Maybe I'm looking at this the wrong way. I suppose it could be used to defend against an accusation not unlike what SCO has claimed. "You copied our code!" "No, we used GPL'd code, see?" In that case, my previous comment about disrupting GPL's trust might not be as likely. "Well, we're just doing it so that this sort of thing doesn't happen again." I can see people nodding their head in agreement in that case.

In short, it's one thing to do it if your aim is to defend yourself from SCO'esque accusations, it's another to use it to look for victims to sue. Whatever is implemented, be very careful about damaging GPL's image to the community that values it.

Re:Is this a big problem?

[GigsVT]

It depends on what you mean by GPL violation.

There are lots of people doing things they shouldn't do, such as selling appliance type things with embedded Linux, and not complying with the GPL in so far as making the source properly available. This happens a lot, and it usually takes someone complaining to the Linux news outlets before they comply.

There's also a couple more obvious major GPL violations that come up from time to time.

Then there's the grey areas. Is taking GPL PHP code that generates HTML/Javascript code, modifying it, and putting it up on your web site considered "distribution"? It is outputting snippets of HTML/JS code that are contained within the GPLed program. The HTML/Javascript code could be considered executable, as much as any other interperted language. This is one of the things the FSF might clarify in newer versions of the GPL, because it's really not something that is clear at all right now.

Anyway, apparently this watermark requires obfuscating the code, in which case it's incompatible with the GPL anyway. The GPL requires distribution of source in the "preferred form for modification", specifically to address code obfuscation.

Re:Is this a big problem?

[Quill_28]

Ah yes, if the GPL were perfectly enforced, then business would stop using the GPL and move to free'r licenses, I believe.
Sorta like if MS could prevent piracy then more people would turn to the free stuff.

this paper really doesn't prove very much

[wfmcwalter]

The paper in question says their watermarks resist "attacks" from regular java bytecode obfuscators, and from decompile-recompile. But neither of these are "attacks" at all - neither class of program was designed to deliberately remove watermarks. It's very similar to the way digital image watermarks can survive some simple photoshop operations like crop, resize, etc. Photoshop isn't a watermark attack tool either - but Ed Felten's team had little difficulty in designing custom programs that could remove watermarks from digital pictures and audio. The paper doesn't include proper programs written to attack their watermarks.

Currently, there seems to be no way to embed a sensible digital watermark that can't be removed from audio, as one can always make little changes to the original that make little difference to the listener, but upon which the watermark depends. I figure the same is true for software - one can always add new variables, reorder parameters, reorder instructions and insert fake ones, unroll loops, inline functions, stuff like that. It's what polymorphic viruses have been doing for years.

So could one use a virus checker to find GPL software fragments in binaries? No. Embed an existing virus in another (itself polymorphic and/or encrypting) shield, and the virus checkers won't find it.

So, this _might_ find code fragements unintentionally or idly included in a proprietary binary. But if a manufacturer wants to deliberately steal software, then they can encrypt it and polymorph it, and it'll take reverse engineering to find it. And the whole point of these watermarks is that they work automatically, without the need for reverse engineering.

Code cannot enforce law.

Not possible with open source

[HoleNdaBitBucket]

Read the presentation. Although complete sentences aren't exactly present, there seems to be the indication that access to the source can provide an attack on the watermarking scheme: well, duh, if it's open source just modify the source to eliminate the watermark.

But what's the likelihood a lazy company/individual will actually do this before violating the GPL? Probably slim, but more of the world seems to be going GPL anyway; and if the whole world did GPL, why would you need watermarks?

Point is: if the monopolies of the world insist on using GPL code without releaing the source, they'll expend the effort to remove the watermark.

Re:Europeans, mod this up right now!!

[Anonymous Coward]

You missed a couple:

9 - Get rich
This one might be a bit hard. Even in America, it takes a lot of work to make real money. You will have to be smart enough to invent some good ideas, and patient enough to see them through. If you're from Europe, you are probably used to treating your work casually while you goof off and act snooty, but you'll have a hard time blending in with Americans that way.

10 - Stop whining
This may be even harder than #9. As a European, you are no doubt accustomed to whining about everything while never doing anything. In the United States, such attitudes simply result in you getting left behind. The real Americans will get out there and do the jobs that need to be done, regardless of how dirty their hands get.

Good luck!

...and NOT open source

[MarkusQ]

Furthermore, they are not talking about techniques that you could use if the "attacker" had access to the source code. (See the full paper, linked to in a comment above.)

This would work about as well for open source software as adding easter eggs (which they also discuss). From my perspective, this is a fine paper but easter eggs are still a lot more fun to write.

-- MarkusQ

Comment removed

[account_deleted]

Comment removed based on user account deletion

Silly

[mrsev]

Does it not defeat the point to tell everyone it is there? If we know it is going to be used we can work around it.

Strangelove:
Yes, but the... whole point of the doomsday machine... is lost... if you keep it a secret! Why didn't you tell the world, eh?

using watermarks for tracking

[paulbd]

personally, as the lead developer of a large and significant (though niche) libre software project, my interest in watermarking is not to prevent illegal copying but merely to trace copying. i have thought recently about embedding serial numbers in executables. nothing would check them, providing little incentive for hackers to remove them, but they would allow me to learn who redistributed the program and on what scale. perhaps.

Google is your friend

[Anonymous Coward]

http://www.faqs.org/docs/jargon/I/IIRC.html

Re:Google is your friend

[Anonymous Coward]

Not for somethiing like this, all i get is a ton of IRC stuff, which i expected,

Seems like a bit of wasted energy

[Anonymous Coward]

If someone is really serious, they'll retool the code enough to get away from that. It would catch some, a lot of people carte blanch take code and embed it in their own applications without fully understanding it. They are catchable as it is though.

This seems kind of like copy protection though, you can spend effort doing it only to have it circumvented. Eventually most software places reach some point where the give up on the tricks and either require active authentication, a piece of hareware or they ignore it. It's quite a bit different from the bad old days when they would do tricks to disks to prevent them from being copied.

I prefer that we place our efforts in GPLing more software and making it better rather than trying to watermark what we have. If we're really worried then maybe we should have a whistle blowers program set up for the developers of software to call and rat out their companies should the GPL be violated.

MOD UP PARENT

[Shimmer]

Obligatory comment.

Performance hit

[ChrisMaple]

The first article compares normal and watermarked code. The watermarked code is significantly slower and bigger.

GPL'ed code can not work with binary watermarking

[Anonymous Coward]

... unless the pirate is really stupid. With GPL'ed code, one would have to disclose the source code and the build process, including the specifics of the process used to watermark the binary. The "source after insertion of the watermarking code" is not the source, according to the GPL

A would-be pirate of GPL'ed code probably would be smart enough to remove the watermark step.

Re:Europeans, mod this up right now!!

[Anonymous Coward]

HEY a troll think ill feed it.

What in the world are you talking about we learned all about these sorts of thing from the euros. Perhaps you should bone up on number 4.

or how about this
1. Why would I WANT a gun. It is my 'right' but I do not need it. But that is the 'teeth' to our rules (the constitution). We have guns...
2. Stone what the hell is a stone. I weigh 190lbs thank you very much. Or 13.5714286 stone. But I though the rest of the world had a hard on for kilos, or 86.1825503 kilograms. But Im american so therefor im 'fat'.
3. Yes need to learn MORE lingo like 'I pulled one in the loo'. Instead of 'I fucked her in the bathroom'.
4. Know my history very well thank you very much. And I know where poland is. Do you know where say Oregon is? Because most people outside of the united states dont care. What makes you think I care about YOUR geography. Oh and dont think americans are the masters of 'weapons of mass destruction', being invented by the French and British.
5. Yes like we should spout on about being one big happy UN family. How we should be using the Euro. Stuff like that. Also that 'free market' you dont like so much has made your goverment sponsered programs look rather expensive havent they with your 3 euro per minute calls. Im sure your doing a lot better now with your 30 euro per month cell phone. How other countries dont use the 'global standards', that were invented by a committee that forgot to invite the people who make the stuff.
6. Yes you watch too much of the tele if you think thats all people do. I earn a decent wage thank you very much. Its also kept some compaines honest. Make shoddy work and you might get sued...
7. Yes there are babies out there. But it comes more from people not taking responsibilty for what they do. Hey with freedom comes responsibility. Like watching what you say so you dont get a number 6 done to you.
8. I know, Ill watch some BBC. Oh wait thats the same sorta crap too. But there are no chanels like the history chanel, or pbs, or TLC, or Discovery. But you KNEW that right.

Think Ill excercise my right of free speach to ask you to keep your damn mouth shut. As you do not know what you are talking about.

So there you have it 8 myths about american life refuted. Come on over its actually kinda nice here just like there. But please wipe your feet before you come in. For it is easy to sit on the side an take pot shots. But its much harder to go and do something about it. You sir are a racist. You too can follow his easy 8 steps and become a racist as well. Peace!

I can remove the watermark from the source

[NoSuchGuy]

or not?
With the GPL I am allowed to do that.
Only if I use binaries, there can be a watermark embedded.

NoSuchGuy

YEah.. but who cares?

[mindstrm]

The point is not that watermarking is foolproof.. but, let's say you suspect some software out there is using your code without permission.. you need some kind of evidence in order to get a court to order a more thorough review... you can't just say "This might be mine because I said so, your honor". Watermarking would let you analyze a binary from some vendor (no reverse engineering involved here), and, if the mark is found, and the software could concievably contain your code, is probably enough evidence to get a court to proceed.

Additional reading..,

[Anonymous Coward]

For further reference.

Such an organization already exists

[Anonymous Coward]

It's called the US Copyright Office.

You deposit your code with the Copyright Office. It costs a nominal amount of money ($20 IIRC). At a later, the copyright holder can obtain a certified copy from the copyright office, with a certificate that says what day it was filed. This can be used as legal evidence.

Re:Such an organization already exists

[yerricde]

The UK doesn't have a Copyright Office. Neither does Australia. I guess they'd have to use their traditional notary channels.

Re:Such an organization already exists

[Bombcar]

Ever though how hard it would be to prove when a time machine was invented?

GRIPE

The question is SHOULD it be done?

[csoto]

ESR and others argue that GPL is "free" as in "free speech." Well, in the United States, we enjoy a lot of this "freedom" (at least until the RWEs are through with us). Much of this has to do with the fact that we go to great lengths to NOT encumber ourselves with systems designed "to get the bad guys." Rather, we depend on a system of mutual responsibility and respect for the law. It's only when an infraction occurs should we seriously consider using effort to detect such fraud. Americans need to be less afraid of their neighbors and demand each other to rise to our expectations.

Re:The question is SHOULD it be done?

[Brandybuck]

When you say "RWE", I think you mean "neocon". Which makes you're post even more relevant. What changed the party of Barry Goldwater and William F. Buckley into the party of George Bush and Michael Savage? The answer is laziness.

It's difficult to defend the principles of liberty. But it's really easy to root for the "home team". The Republicans got lazy and replaced a principled defense of liberty and limited government with populist cheering for their home party. Now they have a leadership that speaks liberty while practicing authoritarianism. Don't think I've got kind words for the Democrats, though. They sold out as well, for essentially the same reason.

So what's the lesson to be learned? Simply that trading liberty for security is the devil's bargain. I would rather have a few minor license violations "slip" through, than to resort to legalistic bullying and community surveillance.

No

[Anonymous Coward]

No

Re:You suck.

[Anonymous Coward]

Not really. You were already born, and therefore the crime already has already been committed. It's best to just move on, accept the mistake your parents (brother and sister as we all know) made and move on.

What about rcsid?

[diablo-d3]

Many GPL/LGPL'ed programs and libraries use a rcsid type of system. Every file something like static char rcsid = "@(#) $Id: file.c,v 1.7 2002/04/11 14:35:13 username Exp $"; in them. Its easy to take them out, but some people who steal code are to ignorant to take them out, and they only help when people steal whole files, but are they still worth using to id code?

Lost cause

[t_allardyce]

Its cutting off your nose to spite your face sort of thing, and is probably something that OS is just going to have to live with for the moment until the concept of OS wins over and eventually is the norm.

Re:RTFA

[Anonymous Coward]

OK, i'll make it easy on all of you. Hear is the article:

?? - Wear is the article?

Re:Europeans, mod this up right now!!

[Anonymous Coward]

Amusingly, most of the stereotypes apply to several other countries in the world.

I'm an American, I found a couple of these funny (like the watch the Watch Abysmal TV, or the 'Sue everyone you ever meet), but the rest are just so generic and apply to much more than just Americans.

I wouldn't call it flamebait or troll. It'd either have to be funny or mean, and it didn't really succeed in being either. America has its problems (just like every other country...) but we also have a much much larger area and more people than most english speaking countries. Not only is it really hard to generalize with such a large population, but it sheds some light on some of those stereotypes like why geography isn't our best subject. If somebody wants to criticize me for not being able to point out Austria (not australia :P) on a map, then my response would be "Okay, point out where Mount Rushmore is. Disney World? Hollywood? Idaho? Devil's Tower? Yosemite? etc". The United States something like 1/3rd of a rather large continent, as opposed to many other countries that are barely bigger than an average sized American state. Most of us here in the US have to travel really far to leave the country.

Piece of advice for all of you who enjoy blasting America: Consider what life over here is like before you make fun. Want to make fun of us over the geography stereotype? Think about what it'd be like for you to travel to the Americas from Europe. Want to make fun of us over gun ownership? Think about how America gained its independence. Want to make fun of us over percieved obesity? Well, you can have that one. It's a little ironic, really. A good chunk of that obesity comes from working too hard, believe it or not. Who has time to cook a decent meal these days? Want to make fun of our lingo? Think about your own slang. Wanker? Pfft. Yeah that's such a cool term.

In short, if you're going to make fun of America, at least pick on something that is unique to us and a legitimate criticism. I'll even throw you a couple of bones here: America's obsession with celebrities and the circus we call a legal system. Believe me, you'll even get Americans laughing at jokes about those.

Re:Europeans, mod this up right now!!

[Anonymous Coward]

• How to use a comma.
• How to use a question mark.
• How to use an apostrophe, you idiots!

HTH. HAND.

Code comes naturally watermarked, just use what is

[hansreiser]

In any piece of code there are certain patterns to it. Look for them. Particularly data structures which the code's effectiveness is tightly linked to. Most thieves are lazy, so they will leave some of the code unchanged. Very few persons are both willing to steal code and willing to take the time to fully obfuscate it.

The nice thing about this approach is you can wait until you suspect someone of stealing before you even bother thinking about the issue.

Oh, and in response to someone who asked if GPL violations are common. Yes they are, very common indeed, because free software is easy to get the source code for. Lots of startups, especially ones involved with web caching, steal from GPL'd code long enough to ship a first release.

More on accepting code for storage

[frovingslosh]

I'll go a step further: Some organizations (like say SCO) might not want to release their code to an outside party. And an outside party might not want to accept it and then be sued if there is ever any doubt as how some Linux code ended up in SCO Unix. But there is really no need for any concern here: The submitter can always (and in the case of non-open code should perhaps be required to) submit the code in an encrypted form with a well know encryption system. (Perhaps PGP). Then if there was ever any need for proof they could submit the plain text code in question and the key for that module and have it verified that the code had been submitted and when. This relieves the concerns over letting valuable source code out-of-house and still provides the verification that SCO seems completely lacking (there may well be published Linux sources that would prove SCO's claims false, maybe even on my bookshelf with known dates, but that can't be determined until SCO is will to say what code they think they own).

Heck, if it were not for the current concerns that CDR media self-destructs in a couple of years, I might even be willing to take such a task on myself. Anyone have any insight on a reliable and trusted form of storage (that is affordable in large amounts) that might make this work?

Of course, there are concerns on both keeping duplicates and liability. To be anywhere near safe multiple locations would have to be used to store the files (should this be the responsibility of the storage agent, or should the owner maximize his chances by submitting to multiple storage sites and accepting that the sites keep only one copy that might be destroyed by fire or even another 9/11 type terror attack?)

There is another valid use for this too, software escrow. Some businesses fear doing software work with a small contractor unless he hands over all of his sources, because if he goes out of business or dies they might go down the tubes with him. On the other hand, small contractors are just as concerned about turning over their technology and having it stolen (a company in the state of Washington that is said to do this comes to mind). An escrow service would help with this; but it would be difficult for any such service to verify back to the client company that the source placed in escrow was good source rather than just something submitted to make the client think the true source was in escrow. Again, any thoughts on this, short of having the storage/escrow company actually build a working copy of the software from the source?

Re:More on accepting code for storage

[4of12]

Some organizations (like say SCO) might not want to release their code to an outside party.

I, too, will admit to being embarrassed about some old code I've written.

Re:What is theft?

[Lord Bitman]

If you took time to re-write every line of code so that it was "obfuscated", as in, no longer had any of the same structure or even ways of going about doing things.. is that theft?
if I watch Star Wars, like Star Wars, and make my own movie with the same plot (Non-X who wants to be X becomes the best X ever thanks to barely-explained element Y over the course of two hour or so), having none of the same characters or settings (though characters and settings exist which carry out the same roles where neccessary), am I doing anything criminal?

I'm not trolling, I'm asking: Where's the line between "theft" and "inspiration"? If completely re-writing code to carry out the same functions (having said code as refrence) is theft, then cloning something the way OpenOffice tries to is certainly also theft, not to mention that SCO's claims would have no defense against them whatsoever.

I'm not bashing the GPL, I just think you're being extreme in saying that such a level of "obfuscation" would still have you as a theif.

Re:Bravo

[recursiv]

On either being a great troll,
Or a stupendous idiot.

Re:Europeans, mod this up right now!!

[Anonymous Coward]

11 - Learn something about hygiene.
In American, it is common to bathe or shower at least once per day. Covering up your stench with perfumes is not acceptable in America.

I hope this helps.

Unreadable == useless?

[Tim Ward]

The resulting code is unreadable ... which makes it absolutely useless as far as open source is concerned.

Um, surprising as it may sound, I have looked at some open source code, you know, and some bits of it could reasonably be described as, you know, just a tad "unreadable". So there's nothing to be lost here.

Re:Unreadable == useless?

[Anonymous Coward]

gotta love these..

"X makes all Y worthless"

"no I once saw a Y that was already kind of worthless"

how retarded are you that you think this is a valid contradiction of the previous statement?! what the fuck is wrong with you?

UK Method

[Gonoff]

Put a copy in an envelope - printed or CD, whatever you like. Post it to your solicitor and have them put it in their safe unopened.

Later when Parasitesoft trys to claim you stole it from them, the solicitor can produce this as legally acceptable evidence of its date of existence.

Re:UK Method

[amorsen]

You may just as well just give it to your solicitor instead of mailing it. The date stamp proves nothing - you might have sent an empty open letter, then put the CD or print in afterwards.

Re:UK Method

[malthusan]

Address it on the backside of the envelope (the side with the flap) and place the postage over the flap once it's sealed. When the post office postmarks it, the stamp will cross the flap onto the envelope. The intact postage and postmark serves to show the envelope hasn't been opened since it was posted.

I do this with my own writing (that is, I post it to myself) so I have the means to prove creation date should it ever become an issue.

Re:UK Method

[angel'o'sphere]

Probably you should google for the "post mark" method.
There are allready (since ages) law cases which got lost by trying this method. There are als law cases where one trying the "post mark method" tried to forge his evidence.
And if you ask a lawer, his first attempt will be to get the "post mark method" out of your mind.
angel'o'sphere

Re:UK Method

[stephanruby]

I'll second "the postmark method" is a myth comment. I would post a link to it, but this myth keeps coming up so many times on Slashdot. It's not even funny.

Oops

[Anonymous Coward]

That should be "In America,".

Sorry for any inconvenience.

BS

[yerricde]

I'll bite...

...your head off.

1. http://linux.tucows.com/preview/8092.html
2. You haven't described your grandma's physical disabilities.
3. http://www.kde.org/ AND http://www.apple.com/macosx/
4. http://support.daemonnews.org/
5. True. FreeBSD and NetBSD split soon after 386BSD's release, and then OpenBSD split from NetBSD when the maintainers stopped tolerating Theo's eccentricity.
6. http://www.freebsd.org/
7. Distros include binaries.
8. True on the desktop, apart from Mac OS X. Half credit.
9. POSIX conforming apps are source code compatible across Linux and BSD.
10. http://www.yahoo.com/

Score: 85% troll

Re:BS

[merdark]

HUH?

That's just weird man. Weird. :)

Re:BS

[merdark]

OH! You were replying to a hidden post. Now it makes sense. I thought you were replaying to the original AC, in which case the post was a most perplexing random list of stuff. :)

Waterproof

[ireallylovelinux]

What happens when it gets wet?

Coffee Marking

[HermanAB]

I don't know about water marking of code, but coffee marking is common.

Heck, I've lost two keyboards to spilled coffee so far this year...

You can't?

[way2trivial]

Hmm.. I can think of a few ways...

they all require secrecy, until the time of need. (lawsuit)
simplest form would be to insert extra characters to the text based on a set formula.. i.e. after every 49th "A" insert a space.. and after every 273rd "e" insert a tilde
most people will take it for a typo..
yet if you can show the consistency, you might be able to defend it..

GPL? Why not BSD?

[UltraSkuzzi]

I've never been a big fan of the GPL, and though I sympathize with Linksys, I think they should still follow the guidelines of the GNU GPL. Shoulda have used BSD...............

I assume you mean patents (n/t)

[Anonymous Coward]

Bleh.

Re:Europeans, mod this up right now!!

[Anonymous Coward]

'Thank, you, as, IF, I, really, care'?

Use hidden 'fingerprint' ?

[Slowleggs]

What about secretly adding some code, preferably something all compilers would treat the same? I assume a text variable would do? e.g: var char[20] ='Wde3kbv9s4s8se/#f,#q"; Or preferably something that would seem more 'authentic', like 'SLPT version 3.107' ? In my simple mind I am in the hopeful belief that no compiler would alter it, but rather store it as simple text? Now someone clever would have to think out a better 'fignerprint'. It has to be long enough so there's no real chance for random data to be alike the fingerprint, and seem like a real variable. This won't work of course, if the thieves changes all the variable names.

Re:Europeans, mod this up right now!!

[Anonymous Coward]

glad you could refut all my .'s in fact just to piss you off i am going to use bad speling and gramer just for u so instead of talking about what was wrong you point out gramur earors i hatttttttttes gramur nazis

Also before you get your panties in a bunch. Think about this, its a informal forum. Have fun. If I was writing a novel MAYBE just MAYBE I would give a shit. Peace!

Seems pointless...

[Junior J. Junior III]

If you have access to the source, you could probably find a way to remove the watermarks, unless they are somehow tightly worked into the executable code itself. And, if they're tightly worked into the executable code itself, then this has to mean that the code will not be as efficient, and that there'd be some kind of performance cost to watermarking that does not benefit the end user at runtime.

Behavior Fingerprint?

[natron8080]

Some benchmarks were posted the other day comparing scaling of a few BSD kernels and two Linux kernels, which gives me an idea.

Do you think you could collect statistics from a running gpl'd program (exe1) and compare it to a "mystery" programs (exe2) statistics, given the same input, and if they match too closely, put (exe2) to the torch to find more similarities?

To minimize variables, you could run both on some combination of hardware emulators (bochs), and system call/library emulators (wine/cygwin), and have tables of OS overhead for common functions to subtract off. Granted it would be initially a lot of work, but as programmers are lazy, we attempt to automate as much as humanly possible.

Re:RTFA

[Anonymous Coward]

What, didn't you here him correctly?

Not worth the trouble.

[gweihir]

The problem is that it would need wide deployment but could be used only once of a few times.

The reason is that once the nature of such a watermak is knowen, all currently published schemes can be easily removed. Proving publicly that one piece of code was stolen is enough for that.

In addition, depending on the language and compiler used, finding a watermark can be extremely difficult. Just think of different levels of optimization, different compiler verions and different libraries used. The often proposed scheme to use variable names is almost completely useless. Replacing all variable names with generic ones can possibly be done with a perl-script written in a day.

In my personal opinion watermarking is not advanced enough today to prove anything. And there is a good possibility that it never will be.

Reply: Does it really matter??? No ...

[OldHawk777]

Watermarking will just be another way of clouding an issue. With GPL-IP you need a protective shield, that is accepted by the UN (under international treaties) and major governments that are willing to pound and fine pirates and thieves of GPL-IP. The UN needs to come together to provide for the common defense of GPL-IP, the Public property of humanity (the Genetics, Genome, Evolution, ...), ... a few other major items.

As for all the copyright and patent stuff, let them protect their shit, it is their right (I have always paid the OEMs and OSDs for my hardware and software). Twenty/fifty years from now they, their company, and products will be under the pile of dust (I suspect), but for now expect a powerful affiliation of the vicious, powerful, and foolish to try and maintain by any means the present amicable conditions for greed and control. They will try their best to destroy GPL, Linux, .... They may even subcontract to India, Pakistan, Iran, Saudi Arabia, Israel, ... to develop major/unique viruses for Linux, Open-Office, ... in attacks to destroy the "Open Source and GPL" communities and others with open standards concepts.

I do believe it is advisable that every new version (X.0) release should be properly labeled and identified for contributors/community (GPL-IP) then placed in the LOC, ECLAS, IPL, PG, maybe other major libraries. of major "open source" products (Linux, Open-Office, ...), and major public property content is a gift to humanity and should be properly achieved and protected from potential destructive practices of megalomaniacs. Such official filling and library index registration should be able to provide legal evidence and protection for posterity.

OldHawk777
Reality is a self induced hallucination.

Re:Reply: Does it really matter??? No ...

[Brandybuck]

The "free" in Free Software does not mean "socialism". I think you need to sit back, take a deep breath, and rejoin reality.

Re:Reply: Does it really matter??? No ...

[OldHawk777]

You missed it. Socialism, very funny. I have always considered socialism, communism, ... as dysfunctional as any other form of plutocracy including aristocracy, draconian states, capitalist republics (profit based economy), ....

Pluralistic Democracies (as opposed to a plutocratic democracy) would seek a performance based economic model that significantly rewarded performance, but did not enrich greedy profit motivated failures.

I pay for all my software and hardware ... not only the MS-Win products I have, but also Mandrake 7.0, Redhat 9.0, ....

I believe in payment for products and performance, I am against thievery/piracy/cons/scams/... of all sorts, I expect the capitalist republic profit motivation to (as already proven in my reality) to seek profit not performance. If there is expectation that destruction of "open source/standards" in this capitalist republic profit economy will provide greater profit, then I do expect attacks against the products and communities supporting "open source/standards" .... Someone on the news just needs to say frequently "they are all a bunch of hackers", God Bless America (GBA), they are attacking the homeland. BS-Image is everything (it will hang you/US) when news is a sound-bite from a talking head.

OldHawk777

Re:Reply: Does it really matter??? No ...

[Brandybuck]

I have always considered socialism, communism, ... as dysfunctional as any other form of plutocracy including aristocracy, draconian states, capitalist republics (profit based economy), ....

Then you need to reread your parent post. When you use terms like "the Public property of humanity" and "major public property content is a gift to humanity", you are advocating collectivism, the most prevalent form of which is socialism. You need to look up the word. I didn't use it pejoratively, as the media likes to do, but according to its economic and political definition.

Pluralistic Democracies (as opposed to a plutocratic democracy) would seek a performance based economic model that significantly rewarded performance

The marketplace already significantly rewards performance. Yes, it's true. You may not realize it though, because what the general public sees as "performance" may be different than what you see. You (and I) may value software reliability, robustness and security highly, but the fact of the matter is that the general public does not. They value ease of use higher. To them, Windows has higher quality than Linux.

How does this help GPL?

[scdeimos]

Having read the .PDF paper and then skimmed the /. comments it would seem few people have taken the time to actually read (or understand) the paper before commenting on it. Hats-off to those who have.

What is the essence of this watermarking technique?:
- For embedding copyright information into individual .class files, as opposed to signing .cab's for whole Java apps/applets.
- It modifies compiled Java bytecode, shuffling eight bytecode operators in targeted "dummy" class methods. The shuffling is able to encode only three bits per operation, so watermarks need to be short or dummy methods need to be large.
- It relies on the watermarked dummy method(s) appearing in stolen (decompiled/recompiled) .class, which is achieved by pretending to call the dummy method(s) from other methods using always-false logic constructs.

What are its downfalls?:
- The technique is specific to Java. Forget about using it for other languages which output platform-specific machine code binaries, although it might be possible to modify it for use in .NET and other bytecode environments.
- If an intelligent thief (or smart optimizing compiler) is able to detect the always-false condition used to shield the dummy method(s) the watermark(s) will be removed.
- The larger your watermark, the larger you need to make your dummy method(s), or you need to embed more of them. The larger you make your dummy methods, the more obvious it will be that there's something strange about them.
- Optimizing compilers could still destroy the modified operators used to form the watermarks.

The paper also claims it protected more .class files from decompile/recompile attacks than *I* feel it should have: five of the ten .class files crashed their test decompiler (Mocha), thereby "protecting" their watermarks. If someone is keen to re-source your .class file, particularly if there's money to be made, I'm fairly certain they'd try another decompiler instead of giving-up on just one crash. I suspect that these five .class files could be decompiled by another utility, so the question of their watermark protection remains unanswered. Potentially this could cause up to 18 (instead of 3) of their 23 watermarks actually being defeated. This is entirely feasible, since only 3 of the 8 watermarks fully tested survived (the other 15 being in the five .class files which crashed Mocha).

How does this technique benefit GPL? I'm not sure that it would. Even if the above problems were fixed:
- To submit "source code" for your protected .class, you'd have to compile it, watermark it, decompile it and then post the decompiled version. Not very pretty and what about comments? I suppose you could have a Perl script reinsert comments from the original source, or copy-and-paste the watermarked dummy methods back in.
- It's really designed to embed personal/corporate copyrights into code, protecting the IP of the submitter not the GPL community. I suppose the GPL community could design a community-wide watermark policy, but then that would become public knowledge and so thieves would be aware of its existence and be inclined to search harder to remove it.

Re:Europeans, mod this up right now!!

[Anonymous Coward]

Want to make fun of our lingo? Think about your own slang. Wanker? Pfft. Yeah that's such a cool term.

I was born and raised in the US of goddamned A, and I still think "wanker" beats the hell out of "masturbator" any day of the week.

Then again, I'm a filthy, unemployed techno-hippie with a case of Canada-envy.

You missed the point of Free Software

[Brandybuck]

Do you think free software (GPL or other viral licenses) should be watermarked? This could help to find GPL violations (think Everybuddy or Linksys)

You missed the point of Free Software. Ignoring some of the antics of zealous fringe, the idea of "Free Software" isn't to be a separate-but-equal analogue to proprietary software. The point of Free Software is freedom, not surveillance. Too many advocates for Free Software say their contributions are free, but act as proprietary masters with their obsession over owning, controlling and regulating the software.

It saddens me to see people advocating watermarking Free Software. Next they'll want a "FSSA" analogue to the BSA and their brownshirts.

Never work with Americunts

[Anonymous Coward]

If you've ever worked with them you'll know what I mean. They talk (and yanks really _can_ talk) good work but never actually seem to do any. They're always on the phone or having meetings.

Bit like when you fight them, they talk a good fight and threaten a lot but when the fight happens they cannot take a punch and seem genuinely surprised that they were beaten.

The point is...

[screwdriver]

not to make it impossible to remove the watermark, but to make it too much trouble. If it is easier/cheaper to write the code from scratch than it is to remove the watermark(s) from existing code, then it has done its job.

New perfume required

[Anonymous Coward]

No amount of bathing will cover up the stench of burning yanks in Baghdad. Reminds me of victory.

fix the root problem

[Anonymous Coward]

okay it's a childish thing to say but if humanity can fix the root problem ("why do people steal/why are people dishonest") then the issue goes away, as does a huge number of other issues that plague humanity.

sorry for stating the obvious but i hate to see developer resources pulled off "deep thought" projects, usability projects, porting, etc. to focus on preventing illegal usage of GPL code.

the other side of the coin is proprietary code...the value of which is really in question. if indeed proprietary code is a "negative branch" that will die out, as i beleive, then the point is moot anyway.

Re:Europeans, mod this up right now!!

[Anonymous Coward]

How to use a comma.
How to use a question mark.
How to use an apostrophe, you idiots!

Lame rebuttal, you lose.

-1: Obvious

[Principal Skinner]

01001001 00101100 00100000 01100110 01101111 01110010 00100000 01101111 01101110 01100101 00101100 00100000 01110111 01100101 01101100 01100011 01101111 01101101 01100101 00100000 01101111 01110101 01110010 00100000 01101110 01100101 01110111 00100000 01100010 01101001 01101110 01100001 01110010 01111001 00100000 01101111 01110110 01100101 01110010 01101100 01101111 01110010 01100100 01110011 00101110

Re:Europeans, mod this up right now!!

[merdark]

Wow, the amount of snotty ego in your post just *screams* "I AM AMERICAN". Do you ever wonder why the rest of the world hates Americans?

Here, educate yourself. And don't worry, it's your own academics presenting this material so it's cosher.

http://www.projectcensored.org/

Yes, this is Univeristy sponsored, and accurate.

ubiquitous GPL code == BAD?

[natron8080]

Ok, assume a corporation CAN sucessfully steal GPL code, with or without watermark. Let's say M$ paints an IE browser look on top of the mozilla firebird codebase:

1. Is it a bad thing that their software just got better, faster, and more standards compliant?
2. Doesn't this even out the playing field, as far as proprietary technology goes? Everyone starts at 0.
3. The mozilla developers would have real speed/memory/feature competition from M$, as opposed to the "we'll never touch IE code again" stance of M$.
4. More company coders would be familiar with and able to develop on open source projects in their spare time (or convert even!).
5. GPL projects aren't really in competition with corporate firms. GPL software doesn't lose profit margins if there's better software out there.

So aside from ethical issues, why should the GPL community really care?

Re:ubiquitous GPL code == BAD?

[melonman]

Absolutely. The GPL community has to get its story straight.

If the Open Source way of producing software is self-evidently going to produce better results, as we are repeatedly told, it doesn't actually matter much if a company nicks a bit and hides it in a proprietary product, as, by doing this, according to OS logic, they will immediately start to fall behind the OS fork of the code.

If that's what we believe, who cares about copyleft violation? If it isn't what we believe, can we please change our propaganda accordingly?

Re:ubiquitous GPL code == BAD?

[The_DOD_player]

GPL projects aren't really in competition with corporate firms. GPL software doesn't lose profit margins if there's better software out there.

Bzzzzt.. wrong! They are in competition, but one that doesnt nessarily involve money.
Most small time GPL programmers are not writing their software for money, but that doesnt mean its OK for Micro$oft, or any other CS company, to rip off their work.

Programmers are writing GPL'd software as a gift to the world. It is not OK by any means, that the worlds richest software company steals that gift, and sell it to the very people, who were supposed to benefit from it.

If you think its all right that software companies rip off your work, publish it under BSD style licens, or place it under public domain. GPL is for Free software and should be respected.

Re:ubiquitous GPL code == BAD?

[argent]

* Open source software *doesn't* automatically produce better results. It has different strengths and weaknesses, but it's not uniformally better. (there is no silver bullet)

* They may fall behind the OS fork of the code, or they may subsidise their development from other sources and surge ahead of the OS fork of the code.

* And this isn't what "we" believe. It's what certain people who have a high profile in the OSS movement claim, but that doesn't make it fact, and there's a lot of us spods out here who don't believe in the Code Fairy.

Me, I don't like the GPL, but I am willing to admit I may be wrong, and if I'm wrong then it would be criminal to let it lapse.

Everyone should be able to watermark software

[Thomas Frayne]

Everyone should be able to watermark software. Further, forging a watermark should be a felony. This is not a matter of good guys vs bad guys, or open source vs closed source. It is a matter of protecting everyone's intellectual property from thieves, GPL'd code, and Microsoft's code alike.

The road to hell

[Anonymous Coward]

It sounds like Microsoft. We have become our enemy.

Viral license? WTF?

[Anonymous Coward]

It's a license. If people don't want to use it, then they can just leave it alone. It has a name called the GPL. I thought it was the detractors of GNU/Linux who used these derogatory terms.
This is like saying, yeah I'm a "pirate" when I go download a backup copy of my old tape collection. It might seem amusing to speak of oneself like that, but it depends who's company you're in. You wouldn't say that in front of just anybody, would you?
It's like people in the black community calling each other nigger. Well, that's cool when you know who you're talking to and you're all friends, but when you're posting a story to /., you damn well know, if you're an editor, a lot of the people planning to reply aren't friends of GNU/Linux.
This becomes like a group of blacks referring to each other as niggers in front of a group of white co-workers. That's not really appropriate. Now I say "in front" because it's right there in the topic. It's no sombody's opinion posted in a reply, it's an editiorial move.
If people in the comments want to use lose terms to refer to themselves in a casual way, that's cool. Lord knows I'm not against a fuck you and screw that shit here and there. But I think using derogatory terms in the body of the topic is weird.
What's next? A story about corporate market share for the communist GNU/Linux system?
Isn't that poisoning the debate the follows?

No legal value

[Futurepower(R)]

No legal value in this. Urban myth.

Re:Europeans, mod this up right now!!

[Anonymous Coward]

"Wow, the amount of snotty ego in your post just *screams* "I AM AMERICAN". Do you ever wonder why the rest of the world hates Americans?"

The rest of the fucking world fucking hates fucking Americans??? Then why the fuck do hunders of fucking thousands of them fucking try to become fucking americans every fucking year? How the fuck is this fucking relevant to the fucking thread you fucking fuck???

Why become like them?

[Steeltoe]

Right. And how about ol'fashioned TRUSTING PEOPLE on this issue? If somebody misuses code, they will be found out sooner or later. Anyhow, it's not like you lose anything on it. Later they'll be all the wiser for being permitted to make a mistake.

Are we no better than the big conglomerations where we can't trust anyone and are filled with fear and dread of all the abuse that _MIGHT_ happen?!?

I just ask. It's up to you to answer..

Doesn't work...

[Kindaian]

It's GPL... so the code is there... so... it won't work...

For closed sources... it will work... for open sources... no can't do...

Microsoft's new search engine

[jonpry_oneword]

I can see it now, msn updated to download all java applets and inspect them for there patented watermarked hello world app.

Sanity is madness put to good use

GPL was ripped off where I worked.

[Music of the Spheres]

It would certainly be useful. I was recently sacked from a small company, I believe for pushing the GPL licensing issue. The company I worked for, has wrapped up a couple of well known GPL'd products and sold them on to a customer without the copyright notices etc. I'm wondering whether I should pursue this. However, as they distributed the downloaded executables for this rather than re-using source code, watermarking isn't really necessary in this case...

Re:GPL was ripped off where I worked.

[prizog]

Hi. I work for FSF investigating license violations. If FSF holds copyright on the programs involved, please me know more details. Write to license-violation@fsf.org.

Celebrity Obsession

[pommiekiwifruit]

OK, it's pretty bad when you keep electing B-movie actors to govern California (at least the current one had a decent budget for special effects!), but most UK "newspapers" have a similar obsession with the mundane affairs of famous people, and I am sure that applies to other countries as well.

For instance, if an expensive football player goes to the hairdresser, that is front-page news on all the tabloid newspapers.

I sympathise with your complaint that outsiders critisise the "wrong things" about the USA (e.g. unbridled gung-ho military power, calorie intake, geography, death penalty, human rights) which are things that are prioritised differently in the USA by a large chunk of its population, but that is the nature of inter-culture comparisons. We can at least agree on the lawyers. I would add spammers :-) (and yeah, I'm sure they *must* be korean even though they advertise fake viagra in english through US phone numbers. Pretty much all my spam comes from the USA, apart from C++ job offers (UK recruiters) and the occasional Nigerian millionaire.)

At the same time, USians make feeble attacks at British things (e.g. cars still driving on the left since we were never Napoleonised, bad dental care, eating fruit (limes) to prevent vitamin C deficiency, using the word "liberal" as an adjective not a swearword) and miss the wide open targets that matter to locals (double the death rates from some cancers, Victorian public transport, schizophrenic attitude to USA/EU, binge drinking).

And at the french, they (USians) forget about the French navy saving their ass in the war against the British, and focus on WW2 - Germany invades Poland: France and UK declare war: USA says "yeah, go on guys, here's some IBM computers" until they get attacked by Japan a few years later. God, I hate defending the French :-) But if you're going to attack them, how about mentioning that they're always on strike or burning lambs when they're not working 35 hour weeks or blowing up greenpeace boats. But yeah, the surveys about hygiene do still come out in the newspapers.

As for geography, the papers keep printing surveys that e.g. most florida teachers couldn't find florida on a map of the USA (and that's a bloody easy one!) so I might have a decent chance there :-)

Had Bush 2nd even left the country (or got a passport) before he became president?

Re:Celebrity Obsession

[Anonymous Coward]

"At the same time, USians make feeble attacks at British things (e.g. cars still driving on the left since we were never Napoleonised, bad dental care, eating fruit (limes) to prevent vitamin C deficiency..."

Maybe. Though these days I feel that stupid shit like that is said in defense. But, then again, I don't know who slung the first wad of mud.

We'z not perfect over here. I wouldn't be the least bit surprised if we started it. We're funny like that.

"As for geography, the papers keep printing surveys that e.g. most florida teachers couldn't find florida on a map of the USA (and that's a bloody easy one!) so I might have a decent chance there :-)"

I wouldn't use Florida to measure the IQ of the country. It's sort of like measuring the collective IQ of England based on a survey taken by the cast of Benny Hill.

"Had Bush 2nd even left the country (or got a passport) before he became president?"

He was just in Australia last week. Heh. Serious, it was in the news that he was heckled by a couple of senators or something there. Amazingly, he did get in a pretty good shot back. "Do you honestly believe that the world would have been better off with Hussein in power?" (not a verbatim quote.)

He leaves the country all the time.

Re:Celebrity Obsession

[Anonymous Coward]

"Had Bush 2nd even left the country (or got a passport) before he became president?"

He was just in Australia last week.

I am aware he travels now, because he sometimes has to! I meant before his appointment. I know Clinton got about a bit (and still does) but I heard that most US politicians don't even have passports.

Re:Celebrity Obsession

[Anonymous Coward]

Oh I see what you mean...

I honestly don't know, but if you were to tell me he didn't I wouldn't have the slightest reason to dispute it.

Re:READ IT

[Anonymous Coward]

What a whippersnapper. I miss Sig11...

We need a copyright registry. FSF?

[Futurepower(R)]

It would be great if the Free Software Foundation would create a copyright registry. Anyone would be able to upload any file and get back an MD5 sum and a digital time stamp.

The U.S. Copyright Office copyright registry is too expensive! It costs at least $20, it is necessary to fill forms, mail by snail mail, it takes weeks to get acknowledgement, and it is not private!

I suggest that the cost be $1. Pay a minimum of $10 by credit card, and have credit for 10 uploads of 20 megabytes or less.

With MD5 sums it is not necessary to save the file.

Re:We need a copyright registry. FSF?

[prizog]

Copyright registration must be done through the Library of Congress, because of US copyright law.

Sorry.

Re:Europeans, mod this up right now!!

[Anonymous Coward]

Thousands more try to become Europeans than try to become Americans. You suck.

Er....

[brunes69]

If you looked at the code, and re-wrote it yourself, it wouldn't be a GPL violation.

The only way it would be a violation is if you could prove it was a derrivative work, and for that there'd have to be at least some line of code the same... having *functionally equivalent* lines of code != derrivitive work. If that was the case then Encyclopedias would have ben sueing eachother since the beginning of time for publishing "functionally equivalent" information.

NP=P?

[Anonymous Coward]

-it's difficult (i.e. NP-complete for those in the know) to analyze the software to remove
-Humans are no more powerful than turing machines.
-Humans can reverse engineer a program in time proportional to the execution time.

If these all hold we're on the edge of a mathematical breakthrough..

Re:RTFA

[Anonymous Coward]

thats a load of horseshit you idiot.
a decompile-edit-recompile attack will take care of any silly watermarking scheme.

Re:What is theft?

[Anonymous Coward]

im posting anonymously since i founded and work for a rather large company. the company was founded on a product which was commercially developed by a former competitor. The competitor at that time was selling the product and we didnt have one..it would take us too long to write one. we bought a copy using a dealer who we had a prior relationship with and we decompiled the code (it was java). Once that was done we saw they had a large and complex watermarking scheme (actually a licensing/copyright scheme) with an obfuscator run on it.
it took us ~1 week to remove all that shit, use our own obfuscator (which was better than theirs!) and voila -- we had a functional product. they lost market share rapidly since we could outprice them (negligible development cost) and we could ship more products than they did. they went bust a while later.

Sorry, Software CANNOT be HARDENED

[Anonymous Coward]

On the (Im)possibility of Obfuscating Programs- Barak, Goldreich, et al. 2001

Once again a lot of missing points!
If you secure for purposes of audits... good.
Software watermarks can be found at fullylicensed in Germany amongst several commercial outfits.
And, if you secure because time is a more valuable commodity than data... good.

Yes. Your terminology is better

[csoto]

"Neocon" (as in conservative without a brain) is a better descriptor. Thanks for the suggestion.

Don't get me wrong, either. I'm also fiercy anti-Democrat. They've become no better than Republicans. To call them "liberal" is as laughable as calling a Republican a "conservative."

Back on topic: In our quest for ultimate geek nirvana, let's pick a better set of values than those ascribed to the United States political parties.

Re:Reply: Better, I can see how you miss the point

[OldHawk777]

Better, I can see your point, from your interpretation of the key phrases you selected. Now here is what I think is the main point protecting GPL-IP, Open source and standards, Public Domain (due to age or intent of creator) property must be as aggressively protected from wanton and major assaults by profit motivated thieves and pirates. To do this laws must be passed by governments and internationally agreed upon, just like current laws governing commerce, ....

Many folks today do not understand that there is public property (sometimes called not-for-profit code/content/IP/...), which is not for free (and is not a school, city/national park, ...), but does exist primarily for the good of humanity not for exploitation (as attempted with the human gnome/genetics) by the international capitalist republic steering the WTO/IMF/... for influence expansion of the capitalist republic. In this manner you are correct there are some folks that have decided (for the greater good of humanity) to provide very real IP to the collective resources of humanity. Again, this concept does not advocate collectivization, but does mean that if someone wants to contribute, then what is provided should not be vandalized and/or exploited by the greedy and unethical fools for profit.

Therefor, I can lookup socialism and collectivism, but I am not sure it will get you out of your box-thought process. As another point, simply because someone champions humanity (we are our brothers' keeper when they are sick, uneducated, terrorized, ....) does not mean they are the enemy, fools, socialist, ... hell they may JFC come back to visit earth.

As noted from my last post dogma BS whether on socialism, capitalism, or is in fact pejorative. Give fools (politicians, dictators, demigods, ...) a label and box (dogma) and they automatically start trying to fit the whole human heard in to an space most cannot fit. This attitude on dogma (religious, political, economic, ...) does not make me a nihilist/anarchist, lets leave everyone outside these BS dogma-boxes. I (like many others) know there must be much better ways for humanity to go forward. The current dogma-boxes are little better then those used by Rome 2K or Egypt 4K years ago. The dogma-boxes are slightly adjusted in attempts to cope with changes in technology and population, seldom or never to improve the human species condition and promote evolution.

The marketplace already significantly rewards "profit-performance" and lies, greed, immorality, ... Enron, Global Crossings, .... Yes, it's true. The general public sees as "profit-performance", lies, greed, immorality, ... I see the same. Maybe you should look again.

Software MS-Win or Linux, the jury is still out. Currently, I support the EFF and non-profit OSDs. I cannot program but I can make small yearly donations to support their humanitarian mission. What the profit motivated OSDs (SCO, MS, ...) do is of no interest to me (I have none of their stock in my portfolio.

Oldhawk777

Reality is a self-induced hallucination.

Re:Europeans, mod this up right now!!

[merdark]

Of sorry if this offends you. But there really is a LOT of anti-american feelings in the rest of the world. It doesn't take a genious to figure this out. Just watch some non-american news stations, or talk to some non-americans, or better yet, go travel.

The may be off topic, but it is in no way a troll. Neither was my last comment. It's simply the truth. It's times like these when the US centricity of slashdot become painfully apparent.

But it'd be funny if they tried...

[natron8080]

Well, I would argue that you can't steal GPL code, because it's free. The only way you could steal it was if you took that right away from others.

I still say, let them (M$, others) try! The only way it could detriment the computing world is if the companies say, "it's not our fault the code is buggy, we stole it from open source authors..." which only helps our cause by illuminating the proprietary firms failings.

Wouldn't you love lightweight IPC, universal interconnectivity, powerful scripting, and strong security on windows? I wouldn't mind if they pasted their GUI right on top of Linux 2.6! So long as they don't take away my freedoms to use GPL code.

Imitation is, after all, the highest form of praise.

Re:But it'd be funny if they tried...

[The_DOD_player]

I do follow your point, but I think its naive.
In general: If you release code under GPL, you, the coder, states that you want it to be Free. Rather like a political view. Then it doesnt matter wether it would benefit more people, cure cancer, save the whales, or what ever. This is not what that author wants, and since its still his/her copyright this has to respected.

The only way you could steal it was if you took that right away from others.
If MS were to implement GPL'ed code in the new Microsoft Visual Studio.NET Sharp# XP Professional 2004 Suite for Workgroups(tm) (r) (c), they would do just that: take away rights, rights for the GPL'ed code inside the M$ defileware.

Wouldn't you love lightweight IPC, universal interconnectivity, powerful scripting, and strong security on windows?
NO! I do not intend doing business with M$ ever again. Anyways.. many of the tools you must be thinking of, are already under a non-GPL license, that would allow Micro$oft to use them, but they dont, makes you wonder...

I wouldn't mind if they pasted their GUI right on top of Linux 2.6!
Be careful what you wish for, you might get it. I do think its not unlikely that Micro$oft will attempt to create a desktop environment for Linux, in order to stay in control of the worlds desktop.