Slashdot Mirror

← Back to Stories (view on slashdot.org)

The Open-Source Detector

Posted by timothy on from the lie-detection dept.

McDutchie writes "With open-source related lawsuits on the rise, a market is developing for automated tools that detect the presence of open-source code within larger application development environments. Palamida Inc. stepped in with IP Amplifier 3.0, essentially a search tool and a database that consists of more than 38 million of the most commonly used open-source files. Something Google-inspired called CodeRank is claimed to match code against the database. Hmm... maybe someone should run it on this, or even this." Of course, some open source code is perfectly welcome in commercial software, even if that software's code is not itself open; it's no secret or surprise that Microsoft, for instance, has taken advantage in some products of BSD-licensed code.

14 of 340 comments (clear)

  1. Re:DLL encryption will render this ineffective by jdmetz · · Score: 5, Insightful

    This tool is meant for commercial software companies to use, to ensure that they are not mistakenly using GPL code in their programs. It is not for open source developers to find misuses of their own code.

  2. Re:windows already has some by Bill_the_Engineer · · Score: 4, Insightful
    Why hasn't anyone gone after MS for this?

    You have confused Open Source with GPL. There is nothing wrong with using Open Source in applications as long as the license permits it.

    Why should Microsoft be singled out for it? Expecially when we had people taking GPL'ed code and selling it as closed source...

    --
    These comments are my own and do not necessarily reflect the views or opinions of my employer or colleagues...
  3. I wonder... by 0x461FAB0BD7D2 · · Score: 4, Interesting

    Could this tool be used in reverse?

    For example, one could write a bug-filled line of code, perhaps something with a buffer-overflow. This could then be matched with open-source projects and projects with buffer overflows are found. Of course, this could also be used to find vulnerabilities and so on.

    1. Re:I wonder... by FidelCatsro · · Score: 4, Insightful

      Glad to know im not the only one worrying about this.The tool has an anual use fee in the tens of thousands , now the only people using this are not going to be companys who worry that GPL code may slip in(most will have a fairly good clue if it has and not want it publicised) its going to be people who want to try and make some money with patent litegation.

      --
      The only things certain in war are Propaganda and Death. You can never be sure which is which though
    2. Re:I wonder... by McDutchie · · Score: 4, Informative
      My employer already uses an internally-developed GPL-scanner tool which is required to be run across all sources before we release a new product version. The company also requires all developers to take yearly training on the issues of OSS and GPL. We do support the ideas of OSS and GPL, and put out OSS offerings of our own, but it would be financially devastating to us if our commercial products were forced to be open-sourced.

      It's a widespread and unfortuate myth that your product automatically becomes subject to the GPL if you (accidentally or otherwise) violate the GPL by including GPL'ed code. In such a case, a copyright violation has been committed and you have to remove the code in question, and possibly pay damages -- but your product will not become open source (unless, of course, you choose to make it open source as a way of remedying the license violation).

  4. The BSD license argument by marcovje · · Score: 5, Interesting


    >Of course, some open source code is perfectly >welcome in commercial software, even if that >software's code is not itself open; it's no secret >or surprise that Microsoft, for instance, has taken >advantage in some products of BSD-licensed code.

    This example (socket code) often pops up, and is often used in GPL advocacy.

    Note however that the TCP/IP work was done under a DARPA grant, paid for by the US government, so it is not only legal, but even moral right for Microsoft to use this code.

  5. Re:No Gurantee Against reimplentation by Speare · · Score: 4, Informative
    This tool can't possibly ensure that some binary wasn't made by someone who looked at the open source version, and just reimplemented the same ideas.

    Um, last time I checked, this is a quite reasonable approach. You can paraphrase your book report in school, you can paraphrase your predecessor's speech, you can take photographs from famous vistas, and you can rewrite your own closed code inspired from Open Source algorithms.

    Source code is protected by copyright-- that is, literal or near-literal copies containing the essence of expression. Open Source code doesn't require that reverse engineering must be done in a clinical clean-room black-box methodology. That's kinda the POINT of Open Source: show people how it's done.

    --
    [ .sig file not found ]
  6. Re:DLL encryption will render this ineffective by FooBarWidget · · Score: 4, Insightful

    "Mistakenly using GPL code"? How can anyone use GPL code on accident? You downloaded a tarball, you extracted it, you opened it in a text editor, you copied and pasted the code. And then you tell your boss that you did that "on accident"?
    Can anyone explain this to me?

  7. Be careful of FUD by Anonymous Coward · · Score: 4, Insightful

    The whole advantage of open source is you are not tied to the whims of the original developer.

    This seems to be a resurrection of an old attack strategy, pretend that open source is such an burdensome onerouse license that you have to hunt open source code down like a virus.

    Its not something to be encouraged!

  8. Re:No Gurantee Against reimplentation by Anonymous Coward · · Score: 5, Insightful

    > This tool can't possibly ensure that some binary wasn't made by someone who looked at the open source version, and just reimplemented the same ideas.

    What the fuck are you talking about ?

    GPL is a based on copyright. You can't copy/paste the code.

    Re-implementing the algos is fine, and have always been.

    It is 100% FUD to pretend that code become tainted because you looked a GPL source. Don't spread this. Microsoft would LOVE people to beleive that. It would end up like this in interviews:

    - Did you contributed to an open-source project ?
    - Well, I once fixed a bug in mozilla
    - Sorry, our lawyers said we can't hire you
    - Why ?
    - You would contamine our IP

    Repeat after me. GPL is COPYRIGHT. There is no IP involved. There have NEVER been.

  9. Will probably find many blatant violators. by putko · · Score: 4, Interesting

    I worked at a ruthless company. Part of the culture was to get results as fast as possible and completely ignore things like licenses, rules and laws, if it helped to make money.

    We certainly would have violated the GPL in a second, given that one couldn't really prove damage to the other party (aging idealist hippies with beards who were naive enough to give away software with a silly "license").

    The ripoff of commercial software was driving me nuts though -- it seemed quite wrong, esp. given that we were raking in the dough and were not paying just because we could easily avoid it through technical measures.

    However, part of the "culture" was that we were so busy that we were sloppy about the misdeeds. We wouldn't have had time to cover our tracks.

    Such tools would have caught us, so I'm guessing such tools will lead to finding many similar violators.

    --
    http://www.thebricktestament.com/the_law/when_to_s tone_your_children/dt21_18a.html
  10. Re:No Gurantee Against reimplentation by MartinG · · Score: 4, Insightful

    This tool can't possibly ensure that some binary wasn't made by someone who looked at the open source version, and just reimplemented the same ideas.

    Good. So long as all they are doing is gathering ideas there is nothing wrong with that. Its like me reading harry potter and then writing a book about wizards. Of course I should be allowed to.

    Next you'll be telling us that someone could just look at an application working and then write their own implementation incorporating some of the same ideas. Should they be stopped from that as well? Oh wait, they can be. That's what software patents are often used for.

    --
    -- MartinG To mail me: echo kewyjlcxyzvjfxbqwh | tr bcefhjklqvwxyz .@adgimnoprstu
  11. Re:DLL encryption will render this ineffective by mr_z_beeblebrox · · Score: 4, Funny

    You downloaded a tarball, you extracted it, you opened it in a text editor, you copied and pasted the code. And then you tell your boss that you did that "on accident"? Can anyone explain this to me?

    Muscle memory?

  12. Re:Ouch. by GigsVT · · Score: 4, Informative

    They can demand you open-source any application that contains GPL'd code.

    No, they can't. Stop spreading this myth.

    --
    I've had enough abrasive sigs. Kittens are cute and fuzzy.