ReactOS Code Audit

reub2000 writes to tell us that in response to talk of "tainted" code within ReactOS Steven Edwards, ReactOS and Wine developer, has called for a complete audit of the entire source tree in addition to procedure and policy changes. From the article: "One final note, this audit of the code is going to take a long time. It could take years, but it will happen, this project will come out better than it was before. I don't believe anything anyone has done while working on this project was really wrong. Every decision has three possibilities, being moral, ethical and or legal. Sometimes the law in itself is unethical and immoral. If people made mistakes and there was a violation of the law, I question the justice of the law and or anyone that would try to prosecute any of the developers who just want the freedom to learn and create a more free system."

Comments

ReactOS; we hardly knew you

[RLiegh]

This audit will take YEARS, according to their statement. I think that's optimistic, myself; by the time that they clean-room implement the code they have to audit out, no one will be interested in working on it AND it will be unusable due to MS's Software Patents.

It's a shame; ReactOS came so far, and got so close (networking was almost ready) and now it's DOA.

It will be missed.

Release it from another country

[erikdalen]

Why not just release it from a country with saner ip laws that allow reverse-enigineering made by a single person? /Erik

Re:Ethical vs. Moral?

[Per Wigren]

Moral but not ethical: "You may not work on this project if you like anal sex."

(yes, this is a joke but unfortunatly most people seem to mix up "moral" with "christian/puritanian fucked up double standard bigot moral". The best thing with moral is that you can have your own. There is no Real Moral(tm).)

Never EVER look at the Windows source code

[Wizzmer]

This is another good reason why the EU shouldn't accept Microsoft's offer to share their server protocols source code with third party devs. If you look at the *specifications* and build something you are way better off than having looked at the source itself. If you look at the source you are "tainted" for life.

Re:Summary is misleading

[eclectro]

The only caveat to the point that you make is that I believe that since the DMCA copyright is a criminal offense instead of a civil one (in the vast majority of cases).

The "clean room' procedure is what enable clone pc's to exist in the first place when compaq cloned the bios with the two engineer method to make their reversing watertight, which it was.

It's nice to try and do that way, but not necessary. I think the big issue for single developers is not so much legally reverse engineering (which is still legal to the chagrin of many ignorant and selfish people) is not so much being right, as having the money to defend themselves in court.

So if you and a buddy "clean room something" that's only half the job. The other half is having money in the bank to cover future possible legal expenses.

I think the lesson we have seen often on slashdot is big corporations "bullying" some little guy who for all intense and purposes is legally right with what they are doing, but the corporation (or their hired suits who need to justify their salary) are the ones who are actually wrong.

Also, I would consider both the DMCA and CTEA immoral laws for a variety of reasons.

Re:TFA

[ciroknight]

Oh hell yes it can, it can be entirely re-compiled into C, but it may not look exactly as it did before it met the compiler.

The compiler simply is a translator that turns a human-parsable programming language into a machine parsable instruction code. That being said, a translation in the other direction is just as easy.

However, compilers these days are more advanced than the golden old days of computing, and will do crazy things to optimize code (unrolling loops, replacing ineffecient operations with more effecient ones [i = i + 1; -> i++;]). Some of these operatons can't be reliably undone (especially the case with inline functions and macros, because often the code compiler will apply the inline, and then realize there's a way to make it more effecient, thus making the code slightly different than the inline function and causing it to not be reversable), at least without a little human interaction.

And there are open source code decompilers available for a number of languages (for C, as an example, there's DCC. Just don't go decompiling Windows and copying and pasting the code back into ReactOS ;)