That's the entire point of copyright -- to incentivize this work by conveying ownership to those who produce such software. Without ownership, others would be free to take it and give you nothing. The world doesn't work for free. I doubt you do, either.

That's what's referred to as a "clean room implementation" further up the thread.

However, this specific thread is about the scenario where an employee has inside knowledge and is passing that knowledge on to the implementer.

Legally speaking, a clean room implementation has much better defenses from claims of copyright violation.

The NDA doesn't apply to people who haven't signed it, but copyright law does. If you know the material you're receiving is under copyright (eg proprietary source code), and you publish work based on that copyright material, the fact that it's now widely available is not an effective defense against claims of copyright violation.

Person B in this scenario hasn't violated the NDA, but they could be sued for copyright infringement.

AIUI, in the US something that's entirely machine-generated is not eligible for copyright protection. If one could demonstrate that that machine-generated output is plagiarized human work and were rich enough to bring it to court, and able to wait five to ten years for the outcome, I have to believe that the usual copyvio rules would apply because that's not machine-generated output, it's straight-up unauthorized copying performed by a machine.

> My point is whilst it technically might be illegal and happening all the time...

If it's illegal, it's illegal. Refusal to enforce the law doesn't make the action any less illegal. Criminals who get away with their crimes are still criminals. [0]

> ... if it's unenforceable or sets a precedence that would severely break the business world, there's every chance nobody would dare bring it to a court room.

Or the highest court of the land would find a way to misinterpret "related" historical decisions to make the crime retroactively legal, yeah.

> ...I would have thought if it did, we would all know about the precedence now.

I'm not so sure. For one thing, the courts move really slowly when they're not very motivated to address something. For another, news that paints the twin VC darlings and their "industry" as villainous has a tendency to get buried by any one of a billion hype pieces or minor scandals that they have waiting in the wings.

[0] To bystanders who might wish to retort: Yes, I'm very aware that some things that are illegal should not be. I'm also aware that some things that are not illegal very much should be.

Despite the fact that the raw output of the system is incomprehensible to humans, scanning a photograph of Mickey Mouse and running it through a lossy compression system like JPEG doesn't suddenly make it not a picture of Mickey Mouse. Similarly, running the code for a system through the lossy compression system that is LLM "training" doesn't suddenly obliterate that data and make that LLM a "clean room". If one has any doubt of that, remember that they are known to reproduce their inputs, even after all these years of work to make them not do that. [0]

[0] <https://news.ycombinator.com/item?id=49727685>

It's safest to err on the side of plausible deniability, any proximity to OEM software increases liability if things go wrong.

I seem to recall DeCSS being the 'hot button' as it was RE'd in a 'non clean' way, the code released, and then a 'clean room' RE could be made from the 'public' info ??

edit: actually, at the time I think there was German law allowing RE for 'interoperablity' or some such. But that was a long time ago so my memory might be off.

There's no law saying you have to do clean room RE. It's legal for me to look at a decompiled driver and write my own driver from scratch. It's not legal for me to just copy the decompilation, and a clean room environment is solid proof that it wasn't copied, but it's not the only way to not copy it, since I could also just not copy it.

I do agree with you that the term is misused (it’s almost completely irrelevant here, anyway) and over-applied, but “not having ever been in a position to see or access the source code” is proven, especially in SAS v World, to be a pretty strong defense that’s worth pursuing in some re-implementation scenarios.

You seem confused here? "Clean Room RE" is simply a descriptive result of copyright law in the US, and is well established. In the US there is no "sweat of the brow doctrine", pure facts simply cannot be copyrighted at all, nor underlying methods/ideas (that's patents). And as a direct result of the latter, again unlike patents, if two people truly independently write the same thing, both get separate copyright.

"Clean room reverse engineering" is just applying that to make any legal fight much cheaper or discourage it from every being bothered with in the first place. You have an RE "dirty" team that goes through copyrighted software and makes a specification that is purely factual, ie, "function 1 takes (int16)X input and does equation ABC on it, function 2 takes (long)X & (long)Y inputs and does LMN" etc. A factual/math spec like that cannot be copyrighted, so it breaks any derivation chain. They then give that, and only that with no other communications, to the clean team. If someone with no other exposure to the software being RE'd uses that spec to write a new piece of software themselves, then by definition the result cannot have any copyright of the original. It's a brand new work based off a list of uncopyrightable facts & math/ideas (though worth noting it could still get tripped up by abomination that is software patents).

There are other ways to argue against copyright infringement successfully, but they're much more subjective, which legally speaking reads "expensive, uncertain". CRRE simply trades that for two clear binary questions: was the spec copyrightable, and did the people writing a new piece of software from that spec have any previous exposure to the original? If the answers to that are no, then all arguments about function names being similar or whatever are no longer relevant.

On the subject of LLMs, one curious twist is that proprietary software might have less effective protection then open source depending on how it all goes. A coding LLM almost certain trained on all open source software available on the web. So there's at least some argument it's tainted. But proprietary software is proprietary. If the LLM has never had any of the source code in its training input, then isn't it clean in terms of producing anything derivative of that? That'll be kinda interesting, and might leave some companies with a bit of a conundrum (or I guess pushing the patent side even harder, but that has a much more sane 20 year expiration date vs copyright).

It doesn't really make sense for it to be in a statute or in case law.

When you are a copyright infringement defendant the plaintiff has the burden of proving two things: (1) that they have valid and enforceable copyright rights, and (2) that you infringed those rights.

Direct proof of the later is rare, so they usually prove infringement by showing you had access to the work and that your alleged infringing work is substantially similar.

There are some defenses in the statute, such as fair use. With these defenses you are basically saying "Even if they prove everything that normally would prove they case, there is this exception that says in these circumstances I'm allowed to do that". (That's called an affirmative defense).

There are also affirmative defenses that were developed in case law. First sale doctrine was originally a case law developed affirmative defense, but was later incorporated in the statute. Copyright misuse is another case law affirmative defense. That one has not been incorporated into statute.

There are also non-affirmative defenses, often called negative defenses or failure-of-proof defenses. With these your defense it "They can't prove I did this thing that is necessary for them to win".

Clean room implementations are not technically a defense. They are a development methodology designed to provide rebuttal evidence to support a future failure-of-proof defense if you are accused of infringement.

How would you even put that in a statute? As far as case law goes all the case law you'd expect to see is around the particular evidence offered to show the implementers really did not have access to copyrighted elements of plaintiff's work, like record keeping and proof of authenticity and things like that.

An analogy would be like not having alcohol at an event you are hosting that is open to families because you want to make sure you don't violate laws against serving alcohol to minors. You aren't going to find a statute that says "Not having served alcohol to children is a defense to a charge violating the not serving alcohol to children statute". It is implicit in the not serving alcohol to children statute.

Any case law you find on this will not be about whether not serving alcohol to children is a valid way to avoid violating the not serving alcohol to children law. It will be about whether or not some kid that had alcohol got it from you or snuck it in from outside or about whether you took care to make sure your caterer adhered to you no alcohol policy or things like that.

On mobile I didn't see the full URL, and zoomed before I saw the calendar. My bad.