VIA Releases Source To Custom WASTE Client

daten writes "VIA has released the source code to their Padlock SL product, based on the Nullsoft WASTE code previously pulled by AOL. Padlock SL offers encrypted chat, instant messaging and file sharing over a private peer-to-peer network. Unlike WASTE, which is still under active development, the VIA client offers a graphical interface for both Windows and Linux users and simpler configuration."

Comments

passive

[netkgb]

"Unlike WASTE, which is still under active development..." More like passive development on sourceforge

Just a quick hint...

[Anonymous Coward]

You don't need to sign your AC posts

Is this legal?

[Newtonian_p]

Doesn't Nullsoft's page on WASTE say " An unauthorized copy of Nullsoft's copyrighted software was briefly posted on this website ... Any reproduction, distribution, display or other use of the Software by you is unauthorized and an infringement of Nullsoft's copyright" ?

Re:Is this legal?

[sangreal66]

Yes it can, if the person who released it wasn't authorized to. I can release the windows source under the GPL, but that doesn't mean its valid.

Re:Is this legal?

[Quixote]

WASTE files contain the following license at the top:

/*
WASTE - main.h (a bunch of global declarations and definitions)
Copyright (C) 2003 Nullsoft, Inc.

WASTE is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.

.....

How can it be "unlicensed" if it has GPL license on each file?

On a related note: VIA is releasing their "PadLock SL" under GPL too.

Re:Is this legal?

[vegetablespork]

They say it, but that doesn't make it true. An agent of the company posted the software under the GPL. AOL/Nullsoft's dispute is with Justin Frankel if they contend the release was unauthorized. But released it was, and it is under the GPL.

Re:Is this legal?

[alienw]

If some Microsoft employee posts the Windows code under the GPL, that will not make the code GPL. If Frankel had no power to approve the release under the GPL, then it was unauthorized and the GPL does not apply.

Re:Is this legal?

[SubtleNuance]

AOL/Nullsoft's dispute is with Justin Frankel if they contend the release was unauthorized. But released it was, and it is under the GPL.


IANAL.

If *we*, the persons dealing with the company 'reasonably believe' that the Agent (Frankel) has the authority to enter into the agreement (GPL license) with us, then it is so. The company is responsible to uphold its agreement (where Frankel was the agent).

Posting this nonsense on the web doesnt undo Agent Frankel's agreement with us.

I just got an image of Frankel as Agent Smith in Matrix... hm, nevermind.

Re:Is this legal?

[drinkypoo]

We went over this in the story when WASTE was pulled in the first place. Basically the counter-argument (no idea who will win in court since IANAL but anyway) is that Frankel was an officer of Nullsoft, and the copyright is held by Nullsoft which is owned by AOL. As an officer of Nullsoft he had the right to release it since typically that's how he behaved when he released something.

There is a separate issue between him and AOL, discussing whether he had the authority to make the release. However, once an officer of a company releases something, it's going to be hard to say he didn't have the authority to do so.

Re:Is this legal?

[Peter La Casse]

If some Microsoft employee posts the Windows code under the GPL, that will not make the code GPL. If Frankel had no power to approve the release under the GPL, then it was unauthorized and the GPL does not apply.

Since Frankel had the power to release software under the GPL, and it was only after the software was released that his employers thought to limit his power to release the software, it is ok for us to continue to distribute the software.

Re:Is this legal?

[Didion Sprague]

... because Frankel was an idiot and sold his sole to them ...

Look, if AOL is dumb enough to buy fish from someone like Frankel, they deserve what they get.

Microsoft bought my halibut, and I, for one, am happy as a clam.

Direct Download Links

[InShadows]

for those that don't want to fill out the questionnaire

Windows XP Version

Red Hat Verion 9.0

Installation Guide

User Guide

Re:Direct Download Links

[Raleel]

the redhat 9 link is slightly wrong. look at the others for what the hostname should be

Re:Is this legal? - this text

[nighty5]

NOTICE OF UNAUTHORIZED SOFTWARE

An unauthorized copy of Nullsoft's copyrighted software was briefly posted on this website on or about Wednesday May 28, 2003. The software was identified as "WASTE" (the "Software") and includes the files "waste-setup.exe", "waste-source.zip", "waste-source.tar.gz" and any additional files contained in these files.

Nullsoft is the exclusive owner of all right, title and interest in the Software. The posting of the Software on this website was not authorized by Nullsoft.

If you downloaded or otherwise obtained a copy of the Software, you acquired no lawful rights to the Software and must destroy any and all copies of the Software, including by deleting it from your computer. Any license that you may believe you acquired with the Software is void, revoked and terminated.

Any reproduction, distribution, display or other use of the Software by you is unauthorized and an infringement of Nullsoft's copyright in the Software as well as a potential violation of other laws.

Thank you.

Nullsoft

Re:how private?

[ewithrow]

If I recall correctly the data sent over the network was encrypted using a very long key generated by asking you to move the mouse randomly for a period of time. Doing this for a minute or so ensures that you get a unique key.

VIA's system requires hardware

[dbaigrie]

Via's system requires their hardware security implementations to work.

As the first step in working towards this objective, VIA was the first company in the world to introduce hardware-based security features in an x86 processor, as part of the VIA PadLock Hardware Security Suite, first with the implementation of the VIA PadLock RNG (Random Number Generator) in the initial Nehemiah core followed by the addition of a second RNG and the VIA PadLock ACE (Advanced Cryptography Engine) supporting AES encryption standards in the latest C5P Nehemiah core

From the description this is a sample application using their "Padlock" hardware

The VIA PadLock SL Utility is a sample secure messaging and information dissemination application with an advanced public key model and AES encryption for ultra-secure communication pathways between users.

Re:VIA's system requires hardware

[arkanes]

The released source also uses Qt, so you'll need a Qt license if you want to compile this yourself on Windows.

Re:VIA's system requires hardware

[grondu]

Via's system requires their hardware security implementations to work.

From the user's guide:

PadLockSL utilizes hardware AES algorithm and random number generator provided in VIA C5P processor. The special characteristics PadLockSL has are outlined as below:
1.2.1 Support running on C5P system and non-C5P system
1.2.2 Automatically detect whether C5P ACE is available or not
If C5P ACE is available, use hardware AES in C5P ACE; otherwise, use software implemented AES when performing AES encryption/decryption
1.2.3 Automatically detect whether C5P RNG is available or not
If C5P RNG is available, use it as entropy source in random number generation routine; otherwise, use the random number generation device provided by linux.

Re:how private?

[los furtive]

I can't vouche for Padlock, but I've used WASTE and yes, you need a key, and I believe all transmissions are encrypted. Pretty nice really, has an IRC like client and several other little features. I've tried to convince my friends to stop using my ftp and use WASTE instead (its ideal for groups of 50 people) but they've been slow to follow suite. Maybe I can convince them with this software instead.

Messaging

[pubjames]

I used to work programming software that basically transmitted information between banks. I learnt one very simple thing that I think could be really helpful for the OSS community: Separate the message from the method of delivery.

Banks are obviously really paranoid about security. They also really need messages to get through, quickly. In the software that I worked on, you would basically configure it with a priorty list of methods that it could use to transmit the message. So the most secure and failsafe method would be the one it tried first. If that didn't work it would try other methods, gradually going down the list, which usually ended with Fax being the most primitive method.

So how is this relevant to the OSS community? Well, we all know email is pretty much broken. Businesses want message delivery that is 1) secure and 2) reliable. Email is neither. With OSS email clients, we should change our mentality a bit and treat them instead as messaging clients, with email being just one of the methods it might use to send the message. The first thing it might try would be a secure, peer-to-peer connection with the recipient of the message. If all OSS email clients followed the same standard - perhaps based on this WASTE code? - soon most messages might be sent by a better manner than email.

One day very soon, Microsoft is going to come out with a "better email". The OSS community will bitch about it, and then if it takes off they will try to copy it. I'd much prefer we did the innovating and MS had to copy... Come on guys!

Re:Messaging

[pubjames]

Email does have reliable delivery. however it's only reliable to the MX host. After that, it's out of your hands.

It is either reliable or it isn't. It isn't.

Unfortunately non-static IPs for most users and AUPs prohibiting long-running network servers put the damper on that little plan.

You don't seem to get what I'm saying. It would try the best method (secure, reliable), if that didn't work, it would try the next best method (email?). So the message goes by the best available method. That's the whole point of what I'm saying.

Re:Open Source?

[karevoll]

Never mind. Stupid little me found the link _on the front page_ at last.. PadLockSL.src.zip[viaarena.com]...

Interoperability?

[Hobbex]

Does anybody know if this can interoperate with Waste networks? I tried to get it into our waste network, and after changing the key header I got the keys to import into the waste clients, but connections still failed.

Anybody had more luck? Waste runs under wine, but there are a lot of annoying issues, and the port seems dead in the water.

Re:Interoperability?

[cthulhubob]

This is just a guess, but I bet the "22609" is the process ID of the padlocksl script. Sounds like a syntax error or something on line 3 is causing it to abort execution.

Re:Interoperability?

[blixel]

Waste runs under wine, but there are a lot of annoying issues, and the port seems dead in the water.

I bought Win4Lin ... and WASTE was one of my motivating reasons for buying it. If WASTE is important enough to you, I'd recommend Win4Lin. And you get the addeded benefit of being able to do other Windows things. (Kaaza [though giFT works well enough for me most of the time], and whatever other Windows things you need.) The only "problem" with Win4Lin is that at this point in time it's Win95/98/98SE/ME only. However - if your programs will operate under Win98SE (WASTE will), then it's actually an advantage due to lower resource requirements.

I downloaded this PadLockSL but I'm not really impressed with it. The GUI looks "broken" in several places. Text doesn't line up correctly over the buttons and things of that nature. And it doesn't connect with our WASTE network anyway.

Re:Via?

[Milican]

Checkout VIA PadLock Hardware Security Suite. Their procs have built in AES encryption as well as a very high bitrate Random Number Generator. This allows their 1GHz procs to do encryption an order of magnitude faster than a 2.4GHz P4. So this software just takes advantage of and promotes their hardware.

JOhn

Re:Via?

[bhtooefr]

VIA makes CPUs (C3), motherboards (EPIA), and graphics cards (S3 UniChrome integrated and DeltaChrome) too! BTW, PadLock is definitely a reference to the encryption engine in their C3 Nehemiah and newer - it means that their 1GHz C3 can murder a x.xxGHz Pentium 4 on encryption, all while barely taking any power. However, as soon as you go to standard integer or floating point, it SUCKS ASS. Integer performance is in the 300-600MHz Celery range, and FP performance is in the sub-300MHz Celery range.

Re:Who cares?

[Will Fisher]

I think your missing the point of WASTE.

WASTE is designed for secure communications (IM, chat and file transfer) between small groups of trusted users.

Bittorrent, Kazaa etc are designed for the mass distribution of files amongst people you don't know.

The only similarities are that neither use a central server, and they can be used to transfer files. But how many protocols can't transfer files?

Re:how private?

[pe1rxq]

I think revoking their ftp access will convince them to stop using it very fast..... Or just throttle the ftp connections down using some scheduling filters :)

Jeroen

Re:Who cares?

[110010001000]

POS systems aren't *fun* to develop. We only work on things that are fun for us. After all, we are doing this for fun - in our spare time.

Re:Who cares?

[Neophytus]

BitTorrent, FTP, HTTP and KaZaa all are used for very different applications. WASTE is used for creating a private, enclosed and secure P2P network. Which of the above apps does that?

Winamp Unlimited Has The Full Story

[lotsofno]

Winamp Unlimited covered the complete story yesterday, for those of you who are interested. There are some links/information on there that haven't been mentioned with this discussion.

Source Code

[Human_USB]

You can get the source code here....
http://www.viaarena.com/?PageID=401
Have fun!

Is this illegal?

[Anonymous Coward]

They say it, but that doesn't make it true. An agent of the company posted the software under the GPL. AOL/Nullsoft's dispute is with Justin Frankel if they contend the release was unauthorized. But released it was, and it is under the GPL.

It doesn't necessarily make it false, either. The GPL's legality and enforceability have yet to be tested in court. Also, Frankel may have been bound by prior contracts which nullify any attempt to GPL any code created while employed. You can't take code someone else legally owns and release it validly under a license of your choosing.

Re:Who cares?

[scrytch]

> how about a usable Point of Sale system?

Fine, if you retailers want OSS to play ball and write them a POS system, then how about you get on the same field and publish a detailed requirements document publically, so that the community can get a start? The proprietary software community does have an advantage in that the client pays to have developers gather the requirements and perform production tests and so forth, but if there's an OSS solution out there, then all that you need is an integrator. But if all you say is "give me a POS system", you're going to get nothing useful back. And if you throw the requirements document over the wall and never come back with feedback, expect nothing after the initial attempt.

Hardware's another issue ... don't expect a lot of cash drawer, manager key, or card reader support without open hardware specs. If you really want an open POS system, you the retailer are going to have to lean on the register manufacturers -- the folks you're giving your money to -- to produce open specs. Otherwise don't expect people to write free software for a platform they cannot freely support.

Just compile Padlock on Mandrake

[G�tz]

It's really easy to compile Padlock on Mandrake 9.2. First install libqt3-devel, the QT deveoper package. Then, call /usr/lib/qt3/bin/qmake and make, that's all.

Justin Frankel's Reaction

[lotsofno]

Forgot to put this in the parent. Justin briefly posted his thoughts on the release, on his 04-21-04 .plan. From what I understand, he was quite surprised about the whole thing when he first heard about it.

Wow, I could swear I've written something like this before...
Wonder what will happen with that...

passive, because flawed?

[Dirus]

IIRC, it's impossible to remove someone from your network once they are in. For corporate use this makes firing people more trouble. Rebuild the network when firing someone? For personal use this presents a problem too, it's easy to add a trouble user to your network (just one person need exchange keys with them), but hard (impossible?) to remove them. I wonder if VIA has addressed this with Padlock SL. I have yet to see anything that would suggest it, but then again I haven't taken a look at the source yet.

Also, off topic but amusing, when I was browsing around their site for more information I found this: http://www.viaarena.com/?PageID=306

Re:passive, because flawed?

[HexRei]

Not true. You should be able to remove them simply by having members of the network remove that users' public key, then make sure all clients are NOT set to auto-accept broadcasted public keys.
Admittedly, I've never had a need to do this, but In theory it should work.

Re:passive, because flawed?

[gid]

You can also snoop in on other people's "encrypted" messages, as long as you're part of the collective. Makes me wonder how encrypted other stuff is as well. But ya, the main problem is key management.

Another problem is this: Say Jane, Joe, and Pete are on the same network, but Jane hates Pete because he didn't call the next morning, so Jane deletes Pete's key. Pete is still allowed on the network through his long time buddy Joe, and Pete can even route through Jane. We tried some tests, and this actually works.

Re:passive, because flawed?

[llefler]

I don't see the problem, all you have to do is call the next morning.

Use WebDAV

[mi]

WebDAV -- a standard part of Apache 2 -- is the replacement for FTP. It only uses one TCP connection (HTTP extension), goes anywhere HTTP goes, can be used over HTTPS and thus be as secure as you like.

On the client side, it is already supported by KDE (use URLs like webdavs://server/dir/file.txt), GNOME, and MS Windows. There are also a few command-line clients, such as neon.

CVS

[mcc]

So it's a P2P version of "Hotline". That's neat! It really is.

However, what I would like to see done with this project is someone tack some kind of version control system onto it. Once you do that, this could be the perfect "floating development board" system for projects such as PlayFair which cannot find shelter elsewhere due to legal problems and/or harassment.

Then all you have to do is move the transport layer from being straight P2P to the data being stored on FreeNet, and you've got a way to have totally public yet totally anonymous development of an "illegal" software application...

At the least, it could be interesting.

Re:CVS

[burns210]

Nope. Freenet is too slow at retrieving data and has too high a failure rate to be used for anything practically. Straight WASTE would be easier, and more practical.

Hardware Random number

[Bender Unit 22]

At least the c3 has a hardware random number generator for better encryption. Sadly you need stepping 03 of the Nehemiah core, as I discovered when I got my motherboard and got Linux compiled to use it. I had a 01 stepping so it was no-go. Felt kinda cheated.
(as well as the low-noise really isn't all that lown noise)

Congress?!?

[abulafia]

Why on earth do you think asking Congress to provide either a spam fix or a "secure and verifiable form of email" is a good idea?

We have seen the results of CAN-SPAM act. That should clue you in on the first point.

Next, you want a government specified secure mail protocol? I hate to be rude, but that is like asking for government specified quality literature. Any attempt at that would come out of committee dripping with pork fat, backdoored by every TLA in the country, overseen by a new agency that would tax it, and likely incapable of functioning in the real world.

Please step away from the crack pipe.

I asked FSF, and FSF said...

[turnstyle]

I asked FSF, and FSF said:

"If WASTE's release was unauthorized, you have no rights to do anything with the software. I am not certain what you could be required to do, by law, should you be found to possess a copy."

"Unfortunately, there is no good way to determine whether or not the release was authorized or not. We are currently presuming that it was unauthorized, until we see convincing evidence otherwise."

(reposted) I asked FSF, and FSF said:

[turnstyle]

I personally asked FSF their opinion of the legal status of WASTE, and here's their reply:

"If WASTE's release was unauthorized, you have no rights to do anything with the software. I am not certain what you could be required to do, by law, should you be found to possess a copy."

"Unfortunately, there is no good way to determine whether or not the release was authorized or not. We are currently presuming that it was unauthorized, until we see convincing evidence otherwise."

But the thing is, I doubt anybody even cares. The logic in the P2P debate is always "I believe whatever supports my position, and I don't believe anything that speaks against my position."

In this case the FSF themselves say that they are presuming it to be unauthorized, and that therefore others have rights to do anything with the software.

But who cares what the FSF says, right?

Re:(reposted) I asked FSF, and FSF said:

[drinkypoo]

This isn't about P2P. While waste is a P2P program, it's really not useful in the same way that Kazaa or similar is. It only allows you to share files with others on a small trusted network. (The way the network is designed, you must trust all users the same, which is stupid, but presumably it would have seen greater development inside nullsoft had there been a chance.)

The FSF saying it presumes it was an unauthorized release is prudent but equivalent to an assumption of guilt. Frankel had traditionally released software apparently at will, with nary a peep from AOL, but Waste drew fire. Given that precedent points to him being allowed to release the code, in order to prove that it was unauthorized someone is likely going to have to show that someone higher up the food chain than Frankel explicitly told him not to release Waste.

The FSF is not saying that they think it was an unauthorized release. They're saying that they have no idea, and that if you get busted the FSF's reaction will be "I told you so."

But as you say, who cares what the FSF has to say about it? They're not even involved. The GPL is covered by copyright law, not FSF law, which doesn't exist, so the FSF is irrelevant. The question is not whether the GPL applies in this situation, because clearly if he did not have the right to put the GPL on the code, then the code is not really GPL. (If you don't hold the copyright, you can't reassign it.) If he DID have the right to make the release, then the GPL certainly applies.

If you want to get a useful opinion from someone on this issue, talk to the EFF, because they're the only cavalry you can expect (hope) will come to the rescue if you are sued for doing something with the WASTE sources. Or at this point, possibly VIA, if you are a VIA customer using their release, though I sincerely doubt that they'd step in on your behalf.

Still violates GPL

[harlows_monkeys]

The WASTE code in Sourceforge still violates GPL. It still includes a bunch of RSA code that isn't GPL'ed. Some of it is explicitly under a license that is imcompatible with GPL, and the rest simply gives an RSA copyright notice and says nothing about licensing.

FYI Stallman comments on sf waste page

[Lanae]

By: Hollywood at monkeysvsrobots.com - zonk3r
RE: Nullsoft: NOTICE OF UNAUTHORIZED SOFTWARE
2003-07-23 12:22
so, here's the deal. i've been thinking about this thread a lot and figured it would be good to get an authoritative repsonse from someone 'in the know' about the gpl and law. so i decided to write rms himself and see what his take is on the matter. here's my email to him (7/21):

mr. stallman,

i've got a question for you regarding a certain application of the gpl. first i want to give a little background story to catch you up if you weren't aware of the situation...

you may be aware of an application that was released by nullsoft (www.nullsoft.com), a subsidiary of aol, called waste. justin frankel, author of waste and ceo of nullsoft, released it several weeks ago with its source code licensed under the gpl. however, it seems he didn't have the necessary privilege to do so, and aol forced nullsoft to remove the software and post this notice later in the same day it was released (http://www.nullsoft.com/free/waste/):

NOTICE OF UNAUTHORIZED SOFTWARE

An unauthorized copy of Nullsoft's copyrighted software was briefly posted on this website on or about Wednesday May 28, 2003. The software was identified as "WASTE" (the "Software") and includes the files "waste-setup.exe", "waste-source.zip", "waste-source.tar.gz" and any additional files contained in these files.

Nullsoft is the exclusive owner of all right, title and interest in the Software. The posting of the Software on this website was not authorized by Nullsoft.

If you downloaded or otherwise obtained a copy of the Software, you acquired no lawful rights to the Software and must destroy any and all copies of the Software, including by deleting it from your computer. Any license that you may believe you acquired with the Software is void, revoked and terminated.

Any reproduction, distribution, display or other use of the Software by you is unauthorized and an infringement of Nullsoft's copyright in the Software as well as a potential violation of other laws.

Thank you.

Nullsoft

shortly after the release of the source, several projects started popping up trying to pick up where waste fell short. the one in particular that i have a question about, is this one: http://sourceforge.net/projects/waste/ . in the discussion groups a thread has arisen as to the legality of continuing the project since nullsoft and aol have 'voided, revoked and terminated' any such license it was released under. many people in this thread seem to believe that once a piece of code is released under the gpl, it can not be revoked no matter what. however, in this case the software was released illegally and the gpl was applied to it. it is my opinion that the gpl can't protect someone from this. you can't license something you don't own in the first place. it doesn't matter who the person was that licensed and released it even if they were ceo, if they didn't have the authority to do so (which frankel's contract apparently doesn't give him), then the license is null and void and any further development would be as well. the argument for the opposition is that the licensor can not retract the license (http://www.gnu.org/licenses/gpl-faq.html#CanDevel operThirdParty). in a court case, i don't think that the folks who want to develop on the source would have a leg to stand on since the originator stated, in essence, that the code was leaked and a license was applied to the leaked code which they had no authority to license in the first place.

please take a look at the discussion thread: http://sourceforge.net/forum/forum.php?thread_id=8 96863&forum_id=281189 my posts are under the screen-name 'zonk3r'.

i suppose i feel it is rather naive of them to assume that they can hide behind the gpl and everything will be okay. that enti