Comment by skissane | Hacker News Reader

Comment by skissane | Hacker News Reader

Parent Full thread

> Wouldn't MS also have to prove that the code is not a derivative of some other PC desktop solution of that era?

That would be pretty trivial. If you had the Windows 3.0 source code, you could compile it, and the binaries you'd get would be the same as the shipped binaries. (Your version of the source code might not be exactly the same version as the shipped binaries, but even if not 100% identical, a binary diff or disassembly would should great similarity.) Even if someone has modified the code a bit, there would still be immense similarities there, which would be difficult to explain as anything other than copying.

Also, GeoWorks and Windows 3.0 have quite different APIs. If you find code exposing an API which is bug-for-bug-compatible with Windows 3.0, then it almost surely is a derivative of the real Windows 3.0 source code. It could be a derivative of some compatible implementation of the Windows API, such as Wine or Sun Wabi, but neither of those would be bug-for-bug compatible; and, as jerf pointed out, a defendant which claimed that they (or someone else other than Microsoft) wrote the code from scratch would have to provide some evidence that they (or someone else) actually carried out the Herculean task of creating a bug-for-bug compatible clean room clone of the Windows API. And not just the application-level API – Windows 3.x has heaps of internal APIs, which largely weren't used by applications and which newer Windows versions don't support (for example, the legacy Windows 3.x device driver models) – any modified copy of the Windows 3.x source is going to support all that, a clean room reimplementation is unlikely to do so. Courts decide civil cases on the basis of the balance of the probabilities, and such a claim must be viewed as improbable, unless some concrete positive evidence is put forward to demonstrate it is true.

(IANAL, but you don't need to be a lawyer to know that Microsoft would win this one.)

>That would be pretty trivial. If you had the Windows 3.0 source code, you could compile it, and the binaries you'd get would be the same as the shipped binaries. //

That's not how that works AIUI. Repeatable, provable builds are I understand a recent phenomenon. Use a different compiler, or different flags, and you get different binaries.

You're right on BoP, but the burden of proof still lies with the alleged copyright holder of a work, who certified in their internal processes, does not exist anymore.

> Repeatable, provable builds are I understand a recent phenomenon. Use a different compiler, or different flags, and you get different binaries.

You are right that I overstated my case somewhat. You are not guaranteed to get the exact same binary even with the exact same build system, and reproducing the exact same build system decades later may not be easy.

However, using the same version of the same compiler with the same flags, you'll get very close to the same binary even without repeatable builds. Not exactly the same – some binaries embed compilation timestamps, sometimes compilers have a bit of non-determinism in their processing. People who want repeatable builds for security need to produce exactly the same binary. For a copyright lawsuit, you don't need the exact same binary, just a binary which is as close as possible – expert human analysis will compare the two binaries and their disassembly in order to demonstrate copying. (So, while ideally you'd have the exact same compiler version, even if you don't, it can still work – the binary doesn't have to be exactly the same, just close enough that a human expert can determine that it is more likely than not produced from the same source code). The whole point of repeatable builds is you don't need an expert forensic analysis to determine that the two binaries are compiled from the same source, you just compare the hashes.

> the burden of proof still lies with the alleged copyright holder of a work, who certified in their internal processes, does not exist anymore.

Microsoft will pay an expert witness a lot of money to perform a forensic analysis of the distributed source code and compare it to the surviving Windows 3.0 binaries. That expert witness will testify the copying occurred. It is up to the defendant to find their own expert witness to testify to the opposite. If they do so, it then comes down to which expert witness the judge and/or jury finds more convincing.

I think I misunderstood the original idea: I thought that the person still having the source would have released it with some possible modifications, but I didn't realize these mods would only be to hide the code origins, and keep it otherwise fully compatible.

Reply on news.ycombinator.com