Hacker News Reader

Comment by fwlr | Hacker News Reader

For the people who can’t see the page - I don’t have it open anymore, but it was someone asking for help to figure out what version of certain libraries was used in the BrickLink studio software, since some flags they expected to work weren’t working. Another user replied that they did some digging into the decompiled source and found which version it was, but they also found strings from that source that matched GPL-licensed libraries (including at least one that user had written himself, because he recognized hardcoded filepaths to locations on his own machine he had used when developing the library).

View on HN

Archived copy: http://web.archive.org/web/20210301135016/https://devtalk.bl...

From comment #3 in this discussion:

> Got bored, did some digging in their binary, they built using some of our our svn libraries (I know it’s our libs since the paths embedded for some of the source files are local to my computer :slight_smile: ) which makes it easy to track down

> they ship openimageio 1.7.15 which means the code is likely from somewhere in between 2017-06-04 and 2018-08-27 which is indeed around the 2.79 time frame.

> It would have been nice if they kept the code opensource, so it could get all the improvements blender makes easily, but they seemingly chose not to go that way. which is somewhat strange since they clearly lifted the GPL licensed bf_blenlib [1] so the closed source nature of eyesight is odd to say the least.

> [1] the executable contains strings like <inline>Error! Could not get the Windows Directory - Defaulting to Blender installation Dir! , Error! Could not get the Windows Directory - Defaulting to first valid drive! Path might be invalid!</inline> and <inline>BLI_dynstr_append text too long or format error.</inline> that can only could have come from bf_blenlib

Is there precedent for that holding in court? Saying something like "I put this unusual string in my software & it is also in theirs" seems pretty useless from a legal perspective.

Don't some map makers put ghost towns or roads that don't actually exist in their own maps as a sort of fingerprinting method? Unless you actually visit that particular spot, one might not know and inadvertently copy the proprietary map data,

> kgeist 8 hours ago > Reminds me of "trap streets" on maps: https://en.m.wikipedia.org/wiki/Trap_street

On the contrary, that seems more likely to be understood by a non-technical audience than any amount of decompiler output. Doesn't replace the latter, but it certainly removes a reasonable doubt.

Yeah if the string is something like "I sidewndr46 am the copyright holder for this software", I can't really see how it would be possible for a vendor to say they just happened to put that in their own independently created product.

"Unusual string" seems a lot more innocuous than unusual string referring to the product as another copywrited work by name which contains the same unusual string.

Reminds me of "trap streets" on maps: https://en.m.wikipedia.org/wiki/Trap_street

>In cartography, a trap street is a fictitious entry in the form of a misrepresented street on a map, often outside the area the map nominally covers, for the purpose of "trapping" potential plagiarists of the map

There's a section on legal issues in the article

I thought the same thing prior to seeing your comment -- yes, these are basically the first version of watermarks... so cartographers could silently 'sign' their work and see who steals it.

Don't see why not - police rely on fingerprints to track theft right? Not much different conceptually.

I'm not sure of the actual prevalence of police using fingerprints to track down theft. It is however accepted as a piece of evidence in various criminal courts, so one would expect it to hold up in a non-criminal court as well.

The difference is I didn't choose my fingerprints nor did the police. It's also really, really hard to get rid of them OR to have someone else with the same fingerprints as mine.

It is prevalent. See https://en.wikipedia.org/wiki/Integrated_Automated_Fingerpri....

That said, faking them is easier than you might think. https://web.mit.edu/6.857/OldStuff/Fall03/ref/gummy-slides.p...

Incidentally the idea of fingerprinting really was popularized by Mark Twain: https://www.courthousenews.com/mark-twains-fingerprints/

What I meant by faking fingerprints was creating another living human being with my same fingerprints. It's obviously trivial to create fingerprint evidence.

It is not just that you can create fingerprint evidence.

It is that you can create fingerprint evidence in normal interactions with fingerprint systems in ways that leave no other evidence, and are unlikely to draw scrutiny from nearby humans.

ISTR that one of the DOS lawsuits hinged on a couple of obscure strings and Easter Eggs buried in the code.

> Saying something like "I put this unusual string in my software & it is also in theirs" seems pretty useless from a legal perspective.

What evidence do you expect would be used for copying besides shared content?

A video of them pressing ctrl+c then ctrl+v

That would be nice, but the share of successfully litigated copyright cases that have video evidence of the act of copying, or something similar, is essentially zero.

Heck, criminal jury convictions, despite the much higher standard of proof, very often don’t have “video of the act being committed” kind of evidence.

IIRC there was a Mac program that proved it was being infringed on because the knockoff software implemented the same Easter egg when a certain series of hot keys was pressed

https://en.m.wikipedia.org/wiki/Apple_Computer,_Inc._v._Fran....

Broken url. Seems to be missing a required full stop on the end:

    https://en.m.wikipedia.org/wiki/Apple_Computer,_Inc._v._Franklin_Computer_Corp.

Looks like the HN submission form is automatically removing it, unless you use a non-clickable quote. Heh. :(

“I put this unusual string in my software” may be enough to get you to discovery. During which time, you can ask for the source code.

This is the right answer. By the time anything goes to court there's going to be more investigation than looking at a forum post.

I can barely comprehend what you're saying. Of course it has legal standing in terms of likelihood of copying.

UPDATE: Additional context from Orion Pobursky[0], the LDraw.org's webmaster:

> The https://Stud.io has been historically bad with attribution of their sources. LDraw had to contact them directly to get them to acknowledge use in their about page and most average users still don't know that the Stud.io's library is back by LDraw.[1]

[0] https://wiki.ldraw.org/wiki/Meet_Orion_Pobursky

[1] https://twitter.com/billtfish/status/1636435679076057089

I think it is important to distinguish between Blender and Cycles and Eyesight, the render engine that Studio uses that is in question.

Blender is the application and Cycles is the render engine.

Studio itself is a Unity application that would almost certainly be incompatible almost in its entirety with any source code they could pull from Blender. At that point they would be porting logic.

Their Eyesight renderer is a separate application that looks to be a fork of Blender with everything but Cycles pulled out. COPYING.txt explains that Eyesight is based on Cycles using the Apache License v2.

C:\Program Files\Studio 2.0\PhotoRealisticRenderer\win\64\license if you're curious.

Not that it excuses them necessarily, but Studio was not created by LEGO. Bricklink was purchased by LEGO relatively recently and had no say in its development. It is very likely a small team built it not even thinking about legalities.

> Bricklink was purchased by LEGO relatively recently and had no say in its development. It is very likely a small team built it not even thinking about legalities.

1. being small doesn't exempt one from following the law.

2. if that is the case, someone at Lego didn't do their homework during the acquisition.

You ascribe a level of malice that is unwarranted.

1. No. But laws are rarely written in a way that people without a lawyer can understand.

Do you fully understand every EULA you agree to? Do you keep up with changes to the licenses of everything you use on a daily basis and immediately update your processes based on any changes you don't like? Do you have the expectation that everyone can do such a thing? Is there the expectation that everyone have a lawyer ready to review everything they touch?

2. They probably didn't. But Bricklink has such a footing, they likely thought it would be worth whatever hassles came up.

Lots of people didn't like the idea of Bricklink being bought by LEGO. Partly because it increases LEGO's control over the building block industry. Partly because it seemed to have come out of nowhere.

> But laws are rarely written in a way that people without a lawyer can understand.

The GPL has been around for decades (v1 is 34 years old), and it was written by a programmer. Unlike EULAs, it's a standard text that rarely ever changes (last time was almost 16 years ago). There are copious amounts of resources online, explaining in plain English what you can and cannot do with it, including all the grey areas.

GPL and LGPL are cultural cornerstones of the opensource community, so I honestly struggle to justify the ignorance, let alone defend it. Obviously shit happens (as I showed in another comment), but "we are a small team" is not an acceptable defence for abusing a license.

> Their Eyesight renderer is a separate application that looks to be a fork of Blender with everything but Cycles pulled out.

If it’s a separate application complying with the GPL is trivial — either link to blender.org and/or publish their patches.

I highly doubt they have any secret sauce in there but just needed a way to call cycles without having to write a bunch of code…which is kind of ironic because cycles used to be able to be called from the command line (might still be, dunno) so doing it this way was probably more work in the end with the added bonus of bad press.

Though, admittedly, cycles had some XML file format that was a train wreck. I tried to come up with an XSD schema for it at one point but, umm… train wreck.

People should just ask these things because it isn’t secret knowledge where you need some $megabuck$ consultant to avoid problems.

There's some source code over here: https://www.bricklink.com/help.asp?helpID=2079

The discussion this story links to is two years old; I don't know how much has changed or how it all fits together.

> There's some source code over here: https://www.bricklink.com/help.asp?helpID=2079

But they did not mentioned that they forked Blender, thus they violates GPL.

And as BrickLink Studio based on Blender code, Studio source should be licensed under GPL as well.

It's not at all clear to me it is a fork.

So a derived product

Well, that's not clear at all to me either, at least not in its current state.

Reply on news.ycombinator.com