Hacker News Reader

Comment by 1023bytes | Hacker News Reader

I wonder what impact this will have on ReactOS

ReactOS has always taken a "we will rebuild anything from complete ignorance of the source" approach, precisely because of the legal liabilities. They are so good at it though, that people at Microsoft have actually claimed that the developers must have source code access.

I had windows source code access (read) about 2005 but because of that I am not allowed to contribute to ReactOS even today.

Contribute anonymously

Is that part of your NDA?

No, this is something ReactOS does themselves: https://reactos.org/project-news/reset-reboot-restart-legal-...

Is anyone who’s worked for MS barred?

Two words: plausible deniability.

Incidentally, this is also why you should separate your work and personal life.

It isn't plausible deniability when it can very easily be verified

You only can't contribute code to modules you saw, you can still do anything else, like analysis part, not sure if they still do it.

>that people at Microsoft have actually claimed that the developers must have source code access.

Source?

Arent decompilers and disassemblers pretty good today anyway?

Legally they can't even use those, React does a totally blackbox reimplementation

Wait, pardon my ignorance, but isn't a decompiler required for the kind of work they do at react?

Person A's Job:

- Decompile shit.

- Then write down the names of the functions with (1) input, (2) output, (3) a description of what person a think the code is doing (4) any side effect / preconditions / post conditions they can deduce.

Person B's Job:

- Take the spec created by person A and write code.

while(missingFunctionality.hasNext): goto Person A's Job

A lot of stuff is based or observing the Windows functionality in a debugger, or Microsoft's API documentation.

decompiler vs. disassembler is an important distinction here

It is and the split between person A doing the first part and person B doing the second part is important in a "clean room" reimplementation in the US.

You don't have to use a clean room methodology. Decompiling the code and reimplementing the functionality is a perfectly valid approach in any jurisdiction that permits reverse engineering.

A source: https://news.ycombinator.com/item?id=20341022

The source I heard this in was this video at 4:40 — https://www.youtube.com/watch?v=2D9ExVc0G10

Same as Wine: none, since they are required to be 100% black-box reimplementations. No one who contributes to Wine is allowed to even look at the original Microsoft source code.

Curious, how do they enforce this? Or is it just assumed in good faith?

While I haven't seen such a case, I can imagine a mailing list 'leaking' with posts like "like the trick Windows did for fast_malloc()" and such, then being summoned.

https://en.m.wikipedia.org/wiki/ReactOS#Internal_audit

Don't you mean black-box reimplementations? White box would mean they have access to and use the source code. Black box means they don't.

Thanks; fixed the original post.

Most informed people have correctly guessed that the ReactOS devs have used the old windows research kernel leak in their development.

Honestly it would be dumb not to. ReactOS is basically a toy, why take what they're doing so seriously?

Reply on news.ycombinator.com