Here's all the source code

In 2000, I wrote a Linux device driver that “decrypted” the output of a certain device, and my company, which hosted open-source projects, agreed to host it.

The “encryption” was only a XOR, but that was enough for the maker of said device to sue my company under 17 U.S.C. § 1201 for hundreds of millions in damages.

The story got a lot of press back then because it highlighted how stupid the then-new DMCA was, and also because there was a David open-source enthusiasts vs. Goliath heartless corporation flavor to it.

Our lawyer decided to pick up the fight to generate free publicity for our fledgling company. For discovery, the maker of the device requested “a copy of any and all potentially infringing source code”. They weren’t specific and they didn’t specify the medium.

So we printed the entire Linux kernel source code including my driver in 5-pt font and sent them the boxes of printouts. Legally they had been served, so there was nothing they could do about it.

Juvyn00b,

Should have sent it xor since they already know how to decode it.

vynlwombat,

bravo, I logged in just to upvote this

BilboBargains,

It makes me happy to know people are pulling these capers. What was the divisor polynomial?

vrighter,

“only an xor” would pretty much imply any of most stream ciphers. It’s what you xor with that matters.

nomadjoanne,

Amazing! What a great story.

BeigeForce,

You’re the hero that GitHub needs.

JackbyDev,

The irony is that nowadays you could just say “well, the codes open source and all hosted on GitHub…”

TeoTwawki,
@TeoTwawki@lemmy.world avatar

Double irony is they’d also send a takedown to github claiming the code contains their IP due to being too ignorant to comprehend that none of the code contains any of thiers to do what it does

JackbyDev,

Wikipedia has XOR truth tables and contains my very secret trade secrets!

WhoRoger,
@WhoRoger@lemmy.world avatar

I was a tech journalist in the early 00’s and I remember writing about that story or one like that.

A similar thing happened with Microsoft, who either delivered or was served the full documentation of some office format printed out. It’s a pretty popular form of malicious compliance, also paying people in bags of coins.

skookumasfrig,

Was this for the CueCat? Because it sure sounds like that! Bravo!

aard,
@aard@kyu.de avatar

Did the device happen to be the CueCat?

Blackmist,

Now that’s a name I haven’t heard in a long time.

The guy who invented it sounds like a certified nutcase.

In 2016, Pulitzer appeared as a treasure hunter on The Curse of Oak Island on the History Channel. He searched for the Ark of the Covenant and working with amateur historians from the Ancient Artifact Preservation Society he claimed that a sword found in the waters off Oak Island in Nova Scotia had “magical magnetic properties” and was evidence of Roman presence in North America and contact with the Miꞌkmaq, which a historian of that people dismissed. An archaeologist and a science writer criticized Pulitzer’s claim, suggested the sword was a replica said that Pulitzer threatened to sue them.

Certainly sounds like the same guy.

slazer2au,

Legally they had been served, so there was nothing they could do about it.

Pretty sure the can go to the judge and as you to deliver the information in a more friendly format.

fmstrat,

Yea, as entertaining as this is, it sounds like they already had the source from the repo and made the request to make sure nothing was being hidden from them (standard discovery). They would have just re-requested in digital format.

Kinglink,

Legally they had been served, so there was nothing they could do about it.

Somehow I doubt this.

Maybe it’s true but legally I know in California you are required to do your briefs in 12 point font. While that’s briefs, I would imagine evidence would be under the same banner. It definitely WOULD be illegal to do it in 1 pt font or intentionally making it unreadable. I would imagine if the other side wanted to make it an issue they could back to the judge and he’s probably have it out with you.

Maybe the lawyers wisely replaced your malicious compliance with correct sized print with out telling you, maybe the other side didn’t care.

ExtremeDullard,
@ExtremeDullard@lemmy.sdf.org avatar

This was in Utah. I’m no lawyer. Maybe it wasn’t legal. What’s what our lawyer said he did.

FeliXTV27,

I don’t think the font size matters too much in this, it’s just the printing the whole source code, including a lot of not directly relevant things, and sending all of that over in a few boxes instead of sharing the project files with them that is very malicious.

rumckle,

It’s also very common in legal cases to share evidence printed out, instead of in digitally, to make sure it isn’t easy for the other side.

Repossess6855,

So fucking based

csm10495,
@csm10495@sh.itjust.works avatar

Please tell me all the newlines were removed from the source code and it was minified to save paper.

Jamie,
@Jamie@jamie.moe avatar

Oh man, if you gave a programmer minified C code with no comments, whitespace, or newlines in printed paper, they’d probably charge more than your lawyer to read that shit.

Chunk,

If it were digital you could pass it through a pretty printer.

propaganja,

You could scan it and that would easily be the fastest way to actually deal with they problem, minified or not.

Ret2libsanity,

I stare at Linux source code very often looking for vulnerabilities.

I unironically have printed pages out to sit down with.

The idea of having the whole kernel printed… is… fun. Lol. How would your organize it for reading? Different chapters that are the directories of the kernel code ?

MxM111,
@MxM111@kbin.social avatar

Why would they organize it in any way? It was not one of the requirements… so, alphabetically.

EN20,

Obviously and we are talking per line and not per file are we?

Llewellyn,
@Llewellyn@lemmy.ml avatar

Per byte

MxM111,
@MxM111@kbin.social avatar

Alphabetically, per bite. It is beautiful.

waigl,

OP said it happened around the year 2000. Linux was at maybe 2.4.something back then. The kernel was much smaller then than it is today.

uis,
@uis@lemmy.world avatar

Imagie if they included modern AMD GPU drivers.

a1studmuffin,
@a1studmuffin@aussie.zone avatar

I’d love to hear more about this - do you do it professionally (for preventative reasons), as a side hobby, or as an attacker for malicious/selfish reasons? No judgement, genuinely curious as it takes a certain personality type to do this kind of work and I find it really interesting.

Ret2libsanity,

Professionally

My title is senior vulnerability researcher. Focus on mobile devices. That’s all I can really say without doxing too much

But the Linux kernel is always a juicy target because of the coverage and exploit there gets you.

crbn,

Neat. Why is Linux kernel relevant for many mobile users? Is iPhone built off of it the same way Mac OS is?

What do you mean by coverage and exploit?

drcobaltjedi,

MacOS is based of a BSD distrobution of Unix. iOS is a fork of MacOS

crbn,

Ah ok makes sense

SwingingTheLamp,

MacOS and iOS have Darwin as their base, which is really a mutt. Apple started with the NeXTSTEP kernel, which was a mix of 4.3BSD and Mach, then folded in some FreeBSD, other open source components, and some in-house code.

It’s Android that uses the Linux kernel as its base, and the millions of phones makes it a juicy target.

crbn,

Not too surprising that iOS has linux in its DNA, but never realized Android does too. Always assumed it was more windows-based. Good to know.

kbotc,

iOS doesn’t have any Linux.

FreeBSD is not Linux. Linux is a kernel and Apple uses Mach, a different kernel. They do both share that they’re POSIX, but OS X is actual, factual, UNIX, and Linux has never paid the money to qualify.

Butters,
@Butters@lemmywinks.com avatar

How different is the FreeBSD kernel from the Linux kernel?

Like in terms of interfaces, if I were to port a device driver, am I just changing some header files and some constants/enums/ifdefs?

Or there’s like entirely different function signatures / APIs?

kbotc,

I would look at the source of LinuxKPI to get an idea of how different they are.

Butters,
@Butters@lemmywinks.com avatar

Well of course I could go look at the source code. We had to write a hello world Linux module in college. Was just being lazy and thought some expert might give a quick synopsis.

Though based on your reply, I’m guessing they are more different than I imagined.

crbn,

My bad I’m conflating bash and Unix. From my end both apple and Linux use bash so they have the same underlying base…but I realize that’s not accurate, and even unix and bash are not synonomous.

ngdev,

I think they just stare at it, hoping the vulnerabilities come to them in a moment of revelation. A Linux Joseph Smith, the kernel playing the part of the Golden Plates.

morgan_423,
@morgan_423@lemmy.world avatar

OP said this happened in Utah, so maybe so!

HamBrick,

The small overlap of my two largest hobbies, programming and making fun of Mormons. Perfect.

MyFairJulia,
@MyFairJulia@lemmy.world avatar

So you like source code? Well then! HAVE ALL THE SOURCE CODE IN THE WORLD!

Rayspekt,

Yo dawg

pastermil,

I heard

Deckname,
@Deckname@discuss.tchncs.de avatar

You like

Artinizal,

Source code

thebestaquaman,

So we

swab148,
@swab148@lemm.ee avatar

Put source code

Butters,
@Butters@lemmywinks.com avatar

In your source code

wanderingmagus,

So you can

BeigeForce,

Source code

Ryantific_theory,

While you

Butters,
@Butters@lemmywinks.com avatar

WE DID IT LEMMY

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • maliciouscompliance@lemmy.world
  • localhost
  • All magazines
    •
    Loading…
    Loading the web debug toolbar…
    Attempt #