VIA Releases Source To Custom WASTE Client

daten writes "VIA has released the source code to their Padlock SL product, based on the Nullsoft WASTE code previously pulled by AOL. Padlock SL offers encrypted chat, instant messaging and file sharing over a private peer-to-peer network. Unlike WASTE, which is still under active development, the VIA client offers a graphical interface for both Windows and Linux users and simpler configuration."

Comments

Is this legal?

[Newtonian_p]

Doesn't Nullsoft's page on WASTE say " An unauthorized copy of Nullsoft's copyrighted software was briefly posted on this website ... Any reproduction, distribution, display or other use of the Software by you is unauthorized and an infringement of Nullsoft's copyright" ?

Re:Is this legal?

[Quixote]

WASTE files contain the following license at the top:

/*
WASTE - main.h (a bunch of global declarations and definitions)
Copyright (C) 2003 Nullsoft, Inc.

WASTE is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.

.....

How can it be "unlicensed" if it has GPL license on each file?

On a related note: VIA is releasing their "PadLock SL" under GPL too.

Re:Is this legal?

[vegetablespork]

They say it, but that doesn't make it true. An agent of the company posted the software under the GPL. AOL/Nullsoft's dispute is with Justin Frankel if they contend the release was unauthorized. But released it was, and it is under the GPL.

Re:Is this legal?

[alienw]

If some Microsoft employee posts the Windows code under the GPL, that will not make the code GPL. If Frankel had no power to approve the release under the GPL, then it was unauthorized and the GPL does not apply.

Re:Is this legal?

[drinkypoo]

We went over this in the story when WASTE was pulled in the first place. Basically the counter-argument (no idea who will win in court since IANAL but anyway) is that Frankel was an officer of Nullsoft, and the copyright is held by Nullsoft which is owned by AOL. As an officer of Nullsoft he had the right to release it since typically that's how he behaved when he released something.

There is a separate issue between him and AOL, discussing whether he had the authority to make the release. However, once an officer of a company releases something, it's going to be hard to say he didn't have the authority to do so.

Re:Is this legal?

[Peter La Casse]

If some Microsoft employee posts the Windows code under the GPL, that will not make the code GPL. If Frankel had no power to approve the release under the GPL, then it was unauthorized and the GPL does not apply.

Since Frankel had the power to release software under the GPL, and it was only after the software was released that his employers thought to limit his power to release the software, it is ok for us to continue to distribute the software.

Re:Is this legal?

[Didion Sprague]

... because Frankel was an idiot and sold his sole to them ...

Look, if AOL is dumb enough to buy fish from someone like Frankel, they deserve what they get.

Microsoft bought my halibut, and I, for one, am happy as a clam.

Direct Download Links

[InShadows]

for those that don't want to fill out the questionnaire

Windows XP Version

Red Hat Verion 9.0

Installation Guide

User Guide

Re:Is this legal? - this text

[nighty5]

NOTICE OF UNAUTHORIZED SOFTWARE

An unauthorized copy of Nullsoft's copyrighted software was briefly posted on this website on or about Wednesday May 28, 2003. The software was identified as "WASTE" (the "Software") and includes the files "waste-setup.exe", "waste-source.zip", "waste-source.tar.gz" and any additional files contained in these files.

Nullsoft is the exclusive owner of all right, title and interest in the Software. The posting of the Software on this website was not authorized by Nullsoft.

If you downloaded or otherwise obtained a copy of the Software, you acquired no lawful rights to the Software and must destroy any and all copies of the Software, including by deleting it from your computer. Any license that you may believe you acquired with the Software is void, revoked and terminated.

Any reproduction, distribution, display or other use of the Software by you is unauthorized and an infringement of Nullsoft's copyright in the Software as well as a potential violation of other laws.

Thank you.

Nullsoft

Re:how private?

[ewithrow]

If I recall correctly the data sent over the network was encrypted using a very long key generated by asking you to move the mouse randomly for a period of time. Doing this for a minute or so ensures that you get a unique key.

Re:how private?

[los furtive]

I can't vouche for Padlock, but I've used WASTE and yes, you need a key, and I believe all transmissions are encrypted. Pretty nice really, has an IRC like client and several other little features. I've tried to convince my friends to stop using my ftp and use WASTE instead (its ideal for groups of 50 people) but they've been slow to follow suite. Maybe I can convince them with this software instead.

Messaging

[pubjames]

I used to work programming software that basically transmitted information between banks. I learnt one very simple thing that I think could be really helpful for the OSS community: Separate the message from the method of delivery.

Banks are obviously really paranoid about security. They also really need messages to get through, quickly. In the software that I worked on, you would basically configure it with a priorty list of methods that it could use to transmit the message. So the most secure and failsafe method would be the one it tried first. If that didn't work it would try other methods, gradually going down the list, which usually ended with Fax being the most primitive method.

So how is this relevant to the OSS community? Well, we all know email is pretty much broken. Businesses want message delivery that is 1) secure and 2) reliable. Email is neither. With OSS email clients, we should change our mentality a bit and treat them instead as messaging clients, with email being just one of the methods it might use to send the message. The first thing it might try would be a secure, peer-to-peer connection with the recipient of the message. If all OSS email clients followed the same standard - perhaps based on this WASTE code? - soon most messages might be sent by a better manner than email.

One day very soon, Microsoft is going to come out with a "better email". The OSS community will bitch about it, and then if it takes off they will try to copy it. I'd much prefer we did the innovating and MS had to copy... Come on guys!

Re:Open Source?

[karevoll]

Never mind. Stupid little me found the link _on the front page_ at last.. PadLockSL.src.zip[viaarena.com]...

Interoperability?

[Hobbex]

Does anybody know if this can interoperate with Waste networks? I tried to get it into our waste network, and after changing the key header I got the keys to import into the waste clients, but connections still failed.

Anybody had more luck? Waste runs under wine, but there are a lot of annoying issues, and the port seems dead in the water.

Re:Via?

[Milican]

Checkout VIA PadLock Hardware Security Suite. Their procs have built in AES encryption as well as a very high bitrate Random Number Generator. This allows their 1GHz procs to do encryption an order of magnitude faster than a 2.4GHz P4. So this software just takes advantage of and promotes their hardware.

JOhn

Re:Who cares?

[Will Fisher]

I think your missing the point of WASTE.

WASTE is designed for secure communications (IM, chat and file transfer) between small groups of trusted users.

Bittorrent, Kazaa etc are designed for the mass distribution of files amongst people you don't know.

The only similarities are that neither use a central server, and they can be used to transfer files. But how many protocols can't transfer files?

Winamp Unlimited Has The Full Story

[lotsofno]

Winamp Unlimited covered the complete story yesterday, for those of you who are interested. There are some links/information on there that haven't been mentioned with this discussion.

Re:VIA's system requires hardware

[grondu]

Via's system requires their hardware security implementations to work.

From the user's guide:

PadLockSL utilizes hardware AES algorithm and random number generator provided in VIA C5P processor. The special characteristics PadLockSL has are outlined as below:
1.2.1 Support running on C5P system and non-C5P system
1.2.2 Automatically detect whether C5P ACE is available or not
If C5P ACE is available, use hardware AES in C5P ACE; otherwise, use software implemented AES when performing AES encryption/decryption
1.2.3 Automatically detect whether C5P RNG is available or not
If C5P RNG is available, use it as entropy source in random number generation routine; otherwise, use the random number generation device provided by linux.

Source Code

[Human_USB]

You can get the source code here....
http://www.viaarena.com/?PageID=401
Have fun!

Just compile Padlock on Mandrake

[G�tz]

It's really easy to compile Padlock on Mandrake 9.2. First install libqt3-devel, the QT deveoper package. Then, call /usr/lib/qt3/bin/qmake and make, that's all.

passive, because flawed?

[Dirus]

IIRC, it's impossible to remove someone from your network once they are in. For corporate use this makes firing people more trouble. Rebuild the network when firing someone? For personal use this presents a problem too, it's easy to add a trouble user to your network (just one person need exchange keys with them), but hard (impossible?) to remove them. I wonder if VIA has addressed this with Padlock SL. I have yet to see anything that would suggest it, but then again I haven't taken a look at the source yet.

Also, off topic but amusing, when I was browsing around their site for more information I found this: http://www.viaarena.com/?PageID=306

Re:passive, because flawed?

[gid]

You can also snoop in on other people's "encrypted" messages, as long as you're part of the collective. Makes me wonder how encrypted other stuff is as well. But ya, the main problem is key management.

Another problem is this: Say Jane, Joe, and Pete are on the same network, but Jane hates Pete because he didn't call the next morning, so Jane deletes Pete's key. Pete is still allowed on the network through his long time buddy Joe, and Pete can even route through Jane. We tried some tests, and this actually works.

Re:passive, because flawed?

[llefler]

I don't see the problem, all you have to do is call the next morning.

I asked FSF, and FSF said...

[turnstyle]

I asked FSF, and FSF said:

"If WASTE's release was unauthorized, you have no rights to do anything with the software. I am not certain what you could be required to do, by law, should you be found to possess a copy."

"Unfortunately, there is no good way to determine whether or not the release was authorized or not. We are currently presuming that it was unauthorized, until we see convincing evidence otherwise."