Hacker News Reader

Comment by silisili | Hacker News Reader

I'm guessing 0Patch doesn't have access to source - does anyone know what method they're using to provide said patches?

It probably involves some level of reverse engineering. Which last I checked violates the windows license.

Regardless of my feelings on whether such reverse engineering should be legal (I think it should), this line of business seems like it is inviting a lawsuit from MS, unless they have some kind of agreement with MS (which is possible).

It’s possible reverse engineering is potentially fair use if Microsoft is no longer offering security patches, although a court case would be the ultimate test.

I’d be willing to donate a payment to the EFF for an attorney opinion on the topic to add to my citation (their FAQ) to cover the professional time expense.

https://www.eff.org/issues/coders/reverse-engineering-faq

RE has always been "fair use" since the very early days. Look at the books and other work published by Andrew Schulman, Matt Pietrek, Mark Russinovich, etc. AFAIK no one has gotten unwanted legal attention from MS from it (and look at what happened to that last person...), and it's only when you want to be a competitor, like ReactOS/WINE, that they start paying attention.

Also notable is that Ilfak Guilfanov (IDA author) published a free patch for the infamous WMF RCE before MS did.

I’m simply erring on the side of caution. Everyone has a plan until they’re punched in the face.

Ironic, because MS are now saying that anything on the Internet can be used to train AI, and their ISO's are available. Perhaps using AI in the process of making these patches will make it OK ;-)

I love it! Instant loophole-creator -- "we trained an AI on the data"!

This will sound pedantic, but it’s not intended to - you say ‘illegal’ - is that in the context of the licence or is some actual law broken outside the scope of that licence agreement?

It’s a fair question, and I didn’t find it pedantic. My understanding from earlier comments is that it required a legally binding contract that wasn’t practical to offer to individuals due to all the clerical work required basically. I may have misunderstood though.

They do in memory patching. Most folks think it’s as dicey as it sounds.

Thank you for pointing this out. I doubt that their patches always (or even frequently) fix the underlying security issue. It is a lot harder to patch something when you don't have access to the source code, and to a test team which can verify the fix.

They also say their patches use only consist of a few instructions. I hope that is enough to cover all possible system configurations.

Just whip out W32DASM like in the old days.

Ghidra is very popular now.

Reply on news.ycombinator.com