Full Disclosure mailing list archives
Re: Cisco's stolen code
From: Seth Alan Woolley <seth () tautology org>
Date: Wed, 26 May 2004 13:15:43 -0700
On Tue, May 25, 2004 at 04:59:20PM -0400, Valdis.Kletnieks () vt edu wrote:
On Tue, 25 May 2004 11:05:03 PDT, Seth Alan Woolley said:Copyright means the right to publish a work in its entirety. As long as they aren't republishing the whole code when they find a vulnerability, it's protected under fair use. What is illegal to republish isn't illegal to acquire. If one acquires the Cisco code outside of a licensing arrangement, they surely didn't agree to their additional restrictions preventing audit or duplication.There's a few points you need to deal with: 1) Although you can probably get away with "fair use" for a small code snippet demonstrating a problem in an advisory (the infamous "the problem is in these 15 lines" part), you will have a *very* hard time doing anything resembling a good audit while only accessing a "fair use" amount of code. How did you find the 15 problem lines without looking at an amount of code far in excess of what "fair use" authorizes?
Fair use allows limited redistribution and rather broad personal use outside of a pre-existing contract. Code auditing doesn't even require fair use rights, however.
2) The fact that you're getting a copy from somebody other than Cisco does NOT make it "clean". That is true for trade secrets, where if the cat is out of the bag already, redistributing it further is no problem (although you better make sure the cat is *out* of the bag and not merely poking its nose out). Absent some licensing agreement, you can't copy it. Period, end of discussion. Go read the GPL, the part where it says "You are not required to accept this License, since you have not signed it. However, nothing else grants you permission to modify or distribute the Program or its derivative works. These actions are prohibited by law if you do not accept this License.".
That only applies to redistribution of derivative or modified works, as I noted was illegal in substantial amounts. Auditing does not require modification or distribution. The FSF advocates that personal use should always be allowable, which is why they explicitly don't prohibit it in their language above.
A lot of very highly talented legal minds have looked at that, and they all come up with the same reading: "You make a copy without accepting the GPL terms, you're screwed".
Republish, not "make a copy". Making a copy is perfectly not enforced by the GPL unless it involves redistribution. Distributing it to others is where the problem comes in.
Re-read your first sentence. The only one that applies is redistribution. Copying for personal use and use itself are still perfectly legal outside of an explicit contract with Cisco that says otherwise, and even then, one would have to agree to it.Umm. No. It's Cisco's code, and you do *NOT* have *any* rights to it other than what (a) you're able to establish under "fair use" or (b) Cisco authorizes you to have.
I presume I'm not allowed to discuss Cisco's code, even if I've not seen it, then, since I have *no* rights to it under your logic. Copyright, I repeat, applies to redistribution and the act of copying by the copier (in modern copyright). It literally meant, "the right of redistribution", even though it may now mean "the right of copy". The sense of copy as in duplication without publishing is new to the word. Any etymologist would tell you that. Even under the modern sense of the right to control copying, obtaining something already copied is not illegal as far as I can tell in Title 17 of the USC. Why are the RIAA not going after downloaders and only after uploaders? They muddy the waters in their press releases, but when they go to the courtroom they know they don't have the law on their sides on that issue.
Although the "Betamax case" granted the "fair use" right to videotape, timeshift, and (by extension) rip your own CD's to digital: http://www.eff.org/Legal/Cases/sony_v_universal_decision.php
It wasn't granted. It always existed. The SC just upheld a previous right. Regardless, the issue isn't one of copying, it is of obtaining an already copied material covered under copyright.
there is *still* a requirement that the original copy be legally obtained,
If there's no consideration, it fails to fall under contract law. If I obtain a copy of a Beverly Cleary book, say, "Ramona the Intellectual Property Pirate", from somebody who shoplifted the book, then copied it illegally. They will be obligated to return the original book to the store, but my copy, not being made by me, despite being "pirated" by its source, is still not itself illegal, even though the "pirater" may even be instructed to destroy all copies they made by the court to prevent its redistribution. The material isn't illegal, only the action of copying or the act of redistributing a copy. Being a participant in an illegal action isn't illegal so long as you aren't breaking the law, otherwise bank tellers would fear for jail when they get robbed. Purchasing the copy might create an additional problem and null the contract of purchase, but if obtaining it is without consideration, the actual act of obtaining it is not illegal.
and there are limitations - although the court held that making a copy for your *own* use was OK, other uses weren't covered - you can't distribute copies to others, and copying things you didn't have a clear right to have the first copy is right out as well.
Of course you can't distribute copies to others, but you can still receive it. A judge may order copies in a particular case destroyed if they were duplicated illegally, however, they would have to do this for each infringing duplicator. http://www4.law.cornell.edu/uscode/17/503.html but if it were hid for five years, they would get away with it: http://www4.law.cornell.edu/uscode/17/507.html
And I'd be very wary of trying to use "He made the copy, I just took the copy he made" as a defense - you're still liable for some penalties, and if you knew or should have known the copy was infringing you're probably equally liable as the person who made the copy....
I notice a lack of citations to the USC in your post. I'll refer you to Title 17, section 106 this time, which highlights what is actually liable: http://www4.law.cornell.edu/uscode/17/106.html http://www4.law.cornell.edu/uscode/17/117.html is notwithstanding on section 106, and only makes to limit exlusive rights granted in section 106. Section 106 still makes no mention of receiving a copy already made. To get the CISCO code, they could easily receive it on paper and not actually have to copy it internally, although I would think a mv instead of cp could be interpreted as not copying it. I'm not sure what the case law is on that issue, but regardless, it's still possible to do a full audit as long as you can do it before a judge orders your specific copy impounded or destroyed. Seth -- Seth Alan Woolley [seth at positivism.org], SPAM/UCE is unauthorized Key id EF10E21A = 36AD 8A92 8499 8439 E6A8 3724 D437 AF5D EF10 E21A http://smgl.positivism.org:11371/pks/lookup?op=get&search=0xEF10E21A Security Team Leader Source Mage GNU/Linux http://www.sourcemage.org
Attachment:
_bin
Description:
Current thread:
- Cisco's stolen code, (continued)
- Cisco's stolen code B$H (May 25)
- RE: Cisco's stolen code Simon Hailstone (May 25)
- Re: Cisco's stolen code Tobias Weisserth (May 25)
- Re: Cisco's stolen code VX Dude (May 25)
- Re: Cisco's stolen code Brian Toovey (May 25)
- Re: Cisco's stolen code Tobias Weisserth (May 25)
- Re: Cisco's stolen code Nathan Bates (May 25)
- Re: Cisco's stolen code Brian Toovey (May 25)
- Re: Cisco's stolen code Seth Alan Woolley (May 25)
- Re: Cisco's stolen code Valdis . Kletnieks (May 25)
- Re: Cisco's stolen code Seth Alan Woolley (May 26)
- Re: Cisco's stolen code roman . kunz (May 26)
- Re: Cisco's stolen code Tobias Weisserth (May 26)
- Re: Cisco's stolen code Dave Horsfall (May 26)
- Cisco's stolen code B$H (May 25)
- Re: Cisco's stolen code ktabic (May 26)
- Re: Cisco's stolen code Azerail (May 27)
- Re: Cisco's stolen code Valdis . Kletnieks (May 25)
- Re: Cisco's stolen code Harlan Carvey (May 25)
- Re: Cisco's stolen code madsaxon (May 25)
- Re: Cisco's stolen code Harlan Carvey (May 25)
- Re: Cisco's stolen code VX Dude (May 25)