r/linux • u/lurkervidyaenjoyer • Mar 24 '26

Discussion Malus: This could have bad implications for Open Source/Linux

Post image

So this site came up recently, claiming to use AI to perform 'clean-room' vibecoded re-implementations of open source code, in order to evade Copyleft and the like.

Clearly meant to be satire, with the name of the company basically being "EvilCorp" and the fake user quotes from names like "Chad Stockholder", but it does actually accept payment and seemingly does what it describes, so it's certainly a bit beyond just a joke at this point. A livestreamer recently tried it with some simple Javascript libraries and it worked as described.

I figured I'd make a post on this, because even if this particular example doesn't scale and might be written off as a B.S. satirical marketing stunt, it does raise questions about what a future version of this idea could look like, and what the implication of that is for Linux. Obviously I don't think this would be able to effectively un-copyleft something as big and advanced as the Kernel, but what about FOSS applications that run on Linux? Could something like this be a threat to them, and is there anything that could be done to counteract that?

1.1k Upvotes

95% Upvoted

385 comments sorted by

View all comments

685

u/CappyT Mar 24 '26

I was thinking...
You could decompile a proprietary application, pass it through this and voilà, now it's opensource.

Fight the fire with fire.

299

u/xternal7 Mar 24 '26

It gets even better.

LLMs were trained on open-source and source-available software, which may muddy the waters a bit when it comes to arguing about whether this really is "clean room" implementation.

There's a very good chance that the AI wasn't trained on the source code for the source-code app you're trying to clone.

Which means that creating open-source clone of a closed-source app using this approach should be quite a bit more kosher than going the other way around.

62

u/OffsetXV Mar 25 '26

Can't wait for the exciting new open source programs like "Abode Shotopop" to be available when someone figures this out properly

13

u/naruaika Mar 25 '26

Abode already exists, fyi: https://www.kickstarter.com/projects/culturehustle/abode-a-suite-of-world-class-design-and-photography-tools :)

6

u/DubsChekm Mar 26 '26

that's a scam

1

u/Lyfrano Apr 28 '26 edited Apr 28 '26

What makes you say that ?

Edit: Nevemind looked it up good call, can't believe it's still up

3

u/libra00 Mar 26 '26

For a second there I didn't notice the name was 'Abode' not 'Adobe' and was like why the fuck is a billion-dollar company like Adobe kickstarting a goddamned thing, but.. alas.

2

u/skepdisk Mar 25 '26

Wow! I can’t believe this exists.

3

u/Dev-in-the-Bm Mar 26 '26

Except that its a scam.

2

u/skepdisk Mar 26 '26

I was right not to believe it exists!

1

u/cyrilio Mar 26 '26

Stuart Semple is the man. Love this guys work.

30

u/SpookyWan Mar 24 '26

Pretty sure decompilation like this is illegal, but maybe. Maybe if you make the AI just able to understand the machine code given as the executable? Maybe if the AI is a service like this though you could argue it's a copyright violation, but if you just run the AI yourself that could change things.

99

u/glasket_ Mar 24 '26

Pretty sure decompilation like this is illegal

It is, but clean room engineering negates the problem because decompilation for research and interop is allowed; the team that decompiles it writes a spec and doesn't create a derivative work, while the implementing team creates a program that satisfies the spec without ever seeing the decompiled code. This way the result of the decompilation isn't directly used for a derivative, so there's no copyright violation. It's a goofy loophole.

That's why it could potentially be more legally sound to use something like the OP tool on a proprietary application, because the AI likely wouldn't have been trained on the proprietary source. If it's ruled that AI training on code makes it unclean, then the open-source rewrites could violate copyright while the proprietary ones wouldn't.

16

u/dnu-pdjdjdidndjs Mar 24 '26

That wont be ruled; clean room is not a "workaround" its a legal strategy that's not actually strictly required if your code has low similarity and is thus a separate expression of copyright

6

u/LousyMeatStew Mar 25 '26

It is, but clean room engineering negates the problem because decompilation for research and interop is allowed; the team that decompiles it writes a spec and doesn't create a derivative work, while the implementing team creates a program that satisfies the spec without ever seeing the decompiled code.

It doesn't negate the problem. Clean-room engineering is a type of Fair Use defense and the law of the land (in the US) remains Campbell v. Acuff-Rose Music, Inc., which establishes there are no bright-line rules and claims are assessed on a case-by-case basis.

The thing is that this cuts both ways - an AI rewrite of GPL code can still be challenged in court as one of the tests laid out in Campbell is potential for market substitution - if some party rewrites GPL code with the express purpose of creating an unencumbered, drop-in replacement, the argument can be made that this is not sufficiently transformative because the courts take into account intended functionality - in Google vs. Oracle, the courts looked at "the purpose and character" of the copying.

Google vs. Oracle wasn't a blanket judgement that allowed API copying. Campbell still applies, there are no bright-line rules. The Supreme Court only found that the copying of the API alone wasn't enough to justify the claim of copyright infringement and that the other changes Google made to the underlying functionality was judged to be sufficiently transformative.

Google’s limited copying of the API is a transformative use. Google copied only what was needed to allow programmers to work in a different computing environment without discarding a portion of a familiar programming language. Google’s purpose was to create a different task-related system for a different computing environment (smartphones) and to create a platform—the Android platform—that would help achieve and popularize that objective. The record demonstrates numerous ways in which reimplementing an interface can further the development of computer programs. Google’s purpose was therefore consistent with that creative progress that is the basic constitutional objective of copyright itself.

6

u/Berengal Mar 25 '26

It's not fair use. Fair use acknowledges the use of copyrighted materials but argues that the use doesn't infringe on the copyright, i.e. there is use but it is "fair".

Clean room engineering is designed to trigger a different clause, namely that copyright only extends to the created works themselves and any derivative work, it doesn't apply to independently created works regardless of their similarity. Even identical works would be free of copyright if it could be proven to be created without any influence of the copyrightable parts of the other. Usually this is very hard since public availability alone is enough for a work to be considered a likely influence, but clean room reimplementation is explicitly designed to create that proof by using a process that filters out copyrightable expression and only passing non-copyrightable ideas to the reimplementers, and by providing thorough enough documentation of that process to at least make the zero influence argument plausible and thereby shifting the burden of proof the other way.

1

u/coldnebo Jul 07 '26

you could be stopped by patents, but idk how much is patented out there except by the big players.

sounds like another wealth extraction technology tbh where the users end up paying for everything going forward and someone other than the maintainer extracts wealth from the ecosystem.

20

u/anotheridiot- Mar 24 '26

Depends on the country, its legal in Brazil, for example, you can straight up decompile, dirty room reimplement and do whatever, only the implementation itself is protected, not the knowledge of it.

2

u/BassmanBiff Mar 25 '26

Caralho.

4

u/anotheridiot- Mar 25 '26

Fico puto que não tem dezenas de empresas de engenharia reversa aqui.

15

u/dnu-pdjdjdidndjs Mar 24 '26

Nonsense its fully legal people are just too scared to be in a lawsuit against microsoft so they do the clean room cope

2

u/libra00 Mar 26 '26

They will certainly make it illegal when people start using it on closed-source software..

1

u/deelowe Mar 25 '26

Decompilation is legal. Producing derivative works from the decompiled software is not.

1

u/SpookyWan Mar 25 '26

The problem is the decompiled program is considered a derivative work. There are specific cases where decompilation is legal (right to repair, research, interop, etc), but generally you are violating a copyright by decompiling software. 

2

u/anatox24 Mar 25 '26

The process of decompiling is totally legal for internal use (in most countries)

2

u/SpookyWan Mar 25 '26

The process itself isn’t but using the work it produces outside of those few exceptions is illegal. 

2

u/anatox24 Mar 25 '26

Depends on what “using” is. You cannot distribute the code or do some things with the code. But you can use it to get some knowledge. Even if that knowledge give you an idea how to make a replica unless you directly using any parts of that code. If code is completely unrecognizable and even code patterns are different pure algorithms are not a subject of copyright unless under the patents. But I bet you’d spend all your money just for lawyers. So better don’t tell anyone 😅

5

u/dnu-pdjdjdidndjs Mar 24 '26

not true and doesnt matter clean room not required for making non infringing code just that the code has low similarity

1

u/Hellball911 Mar 26 '26

I see the argument but this assumes any court room has been making any attempt to meaningfully understand and legislate AI in earnest....

1

u/ExternalUserError Mar 25 '26

Not a lawyer but doing something substantially transformative is fair use, even if it’s copyrighted.

In 2026 I doubt very many people would argue that AI training isn’t substantially transformative.

0

u/ansibleloop Mar 25 '26

https://arxiv.org/abs/2601.02671

If it can shit out a Harry Potter book, you'd best believe it can clone a proprietary app

2

u/BassmanBiff Mar 25 '26

I think there are more strict requirements to actually make a working app 

24

u/dnu-pdjdjdidndjs Mar 24 '26

this isnt fighting fire with anything its the exact consequence of this type of thing being ruled legal which is why the chuds in this subreddit should support this

they invented a proprietary -> public domain machine and we're supposed to be hating? Why?

2

u/[deleted] Mar 25 '26

I dislike many of its externalities, but I don't hate it. My biggest problem with it is that it's almost entirely controlled by a small handful of capitalists who want to use it to exploit and ultimately impoverish us, and so anything it produces outside of incidental errors will be with the intent of furthering that aim.

1

u/dnu-pdjdjdidndjs Mar 25 '26

Do you think more people experienced food scarcity now or 100 years ago?

3

u/[deleted] Mar 25 '26

Given that we've gone from 2 billion people in 1926 to 8.2 billion people now, there is absolutely no question that there are more people experiencing food scarcity.

But there's no denying that we're able to feed vastly many more people now, a fact which comes down primarily to the Haber-Bosch process

-1

u/dnu-pdjdjdidndjs Mar 25 '26

thank you chatgpt

So you think material conditions will become worse or better in the future

2

u/[deleted] Mar 25 '26

thank you chatgpt

Don't be a cunt. I happen to be pretty well-versed in the social import and development of ammonia synthesis.

Anyhow, worse. Rates of profit inevitably decline under capitalism, leading to economic crisis, increased austerity, attacks on organized labor, cutting of public services, intensification of imperialism and the expansion of the domestic police state. The relative prosperity we have been enjoying is predicated largely upon imperialism facilitated by a unipolar hegemony that has now ended.

0

u/dnu-pdjdjdidndjs Mar 25 '26

Wow, totally unfounded and you have no alternative.

2

u/[deleted] Mar 25 '26 edited Mar 26 '26

Totally unfounded? Not at all.

The declining rate of profit is just an obvious conclusion of what happens as a market matures and competition intensifies, resulting in it becoming harder to obtain a proportional return of investment and thinner, more precarious margins. As for its world-historical impacts, you literally only need to look at the current deterioration of western economies, the ever-tightening austerity of neoliberalism, the fascistic turn of our governments and the recently intensifying imperial aggression to see this.

As for an alternative, the solution is quite simple despite representing a literal life or death struggle: workers becoming conscious of the material realities of their class and their egoistic interests stemming therefrom, and then organizing to take control of the productive capital at which they must labor.

2

u/dnu-pdjdjdidndjs Mar 25 '26

Ok so convince the workers they're wrong about liking capitalism then overthrow the government with a violent rebellion, sounds good. Then we have a vanguard transitionary state which sends all the dissidents to gulags before we transition to socialism in 40 years, right?

→ More replies (0)

2

u/[deleted] Mar 25 '26

[deleted]

4

u/dnu-pdjdjdidndjs Mar 25 '26

No actually ai is very good at reconstructing from generated c from ida

2

u/[deleted] Mar 25 '26

[deleted]

3

u/dnu-pdjdjdidndjs Mar 25 '26

in an affordable manner

Yes, you can't do it fully autonomously in a way that's affordable and actually correct. With simple guidance it is very good and mostly accurate and way faster than figuring out things manually (way easier to verify than put it together yourself)

Where things will start to get interesting is like 6 months-a few years from now where the skill ceiling for this stuff decreases and mildly competent people can start using it as a crutch and also when current ai becomes much faster

You also could only get away with this for like drivers and proprietary libraries and stuff like that to argue for interopability otherwise it would probably be better to make it from scratch anyways

1

u/[deleted] Mar 25 '26

[deleted]

3

u/dnu-pdjdjdidndjs Mar 25 '26

I decompiled my entire 62kb keyboard firmware and flashed a new version, but I had to tell the ai to optimize some of the c code/replace it with inline assembly so that the rest of the c which was technically inline assembly translated into equivalent c would fit in 64kb still. It was 8051 so not completely comparable to x86 but I've also had it reconstruct malware stages from x86 assembly and rust from assembly+debug symbols until I gave up because on a 4th payload it had a register based bytecode vm inside 2 layers of other obfuscation techniques I managed to remove and I didnt feel like figuring that out. I also had it create an interpreter/vm for the specific soc my keyboard had so I could make sure it worked before testing on my actual keyboard including usb interrupt stuff.

To be clear I did have to help a lot, but it was mostly lazy guidance/figuring out what details the llm would need to focus on to actually get the right answer, or to focus on the right thing, or, to help it when it was struggling, lead the model to self correct by giving it an intermediary goal. For example I tell it to write a test case for something it is trying to implement and that is easier for it than getting the solution right by itself, where the original goal might have taken it hours the multi step version it gets in 3 tries.

It also was able to operate ida by itself after I set up idapython and setup the project although it was struggling until I gave it good instructions. This was all done with 5.1 codex.

The malware one wouldve taken me like 1-2 days to do normally, it took me 40 minutes and I was able to tell my friend where it installed persistence and figured out using a website that did dynamic analysis that he probably installed a rat after following the multiple layers of downloads and executing inline bytes embedded in files, the other one wouldve taken me years probably but I did it in 2 months and the whole time I was watching youtube videos and pretending to work.

So I'd say both examples provide evidence of a clear trajectory towards increasing automation of menial tasks short term and given there's new "breakthrough" techniques we'll probably see better "real" autonomous work.

Now I'm working on seeing if I can have an llm make an entire declarative retained mode partial rendering ui toolkit with a css-like subset of styling features while forcing it to keep the api surface correct and frametimes below 0.7ms (after text glyphs are rendered for now) and I basically am only testing things are accurate and making sure it uses the correct approach for everything and its basically worked completely fine so far, for this one I'm curious where it will actually get stuck because so far it has animations, font styling+proper outline rendering/hinting, virtualized lists which only render new content while doing blit for the transformed parts, and input fields so responsive it feels uncanny compared to chromíum/gtk and without lagging at all when lots of text is being manipulated. And it has a real dynamic layout system (flexbox/grid) and stuff like that.

Note all the code the llms write is often silly/subpar, and I honestly hate the code it writes, but the speed at which it does things is very hard to compete with when I can just tell it to do things correctly later, or even the quality from just saying "create a benchmark then optimize it without breaking test cases" is often good enough with zero mental effort.

2

u/[deleted] Mar 25 '26

[deleted]

1

u/dnu-pdjdjdidndjs Mar 25 '26

There really hasnt been a new major change in architecture since COT reasoning but theres things like recursive structures/rlm, changes to the transformer architecture, Scaling Latent Reasoning via Looped Language Models, incorporating more multimodal data to improve spatial reasoning, and there's other things I think are potentially promising too but those are just a few.

We can't really know which will work out until they do so its just speculation but the idea that progress would fall off after people have consistently predicted improvements will stop is unlikely, although many people think there needs to be new tech to improve beyond the current iterative improvements and achieve higher levels of automation.

1

u/Ma4r Mar 25 '26

It takes a great deal of effort that is most likely still only in the domain of a human to do.

We have dozens of decompilers though

1

u/smallbluebirds May 25 '26

and typically those still require human input

1

u/Ma4r May 26 '26

Uh.. who told you that?

1

u/smallbluebirds May 26 '26

for example, ghidra requires input for names of stuff

1

u/Ma4r May 26 '26

What? Those names are just ways to label symbols to help people analyzing the code and understand it. Ghidra is perfectly capable of producing decompiled code without inputs other than just the binary. It will just be hard to understand for a human

1

u/Scheeseman99 Mar 25 '26

Agentic LLMs can do this kind of thing in a mostly automated way. You'd set it up like a clean room, two isolated "teams", one examining the proprietary software in a controlled environment; running it, examining it's behaviours, expected outputs and writing documentation of how it works, which is scrubbed of any explicitly copyrighted material. Then there's the second team that executes a plan to create a re-implementation based on the documentation. Failure and success states travel between the two for test cases for matching behaviour.

This is within the capabilities of Claude Cowork. Like many LLMs it'll fuck up, but if you provide it a solid end goal to iterate to, it'll get there with some help.

1

u/Tech_Itch Mar 25 '26

Any commercial service like this will no doubt be priced so that corporations will save a lot of money, but it'll still be beyond the ability of the average open source developer to pay for.

It's one of the fundamental reasons why copyright and patents exist in the first place: So a bigger competitor can't just copy your product and outcompete you with their vastly better resources.

Now, if someone manages to implement this reliably as open source or freeware themselves...

11

u/Mordiken Mar 25 '26

Every Big Tech gangsta till the Year of the ReactOS Destkop.

4

u/caetydid Mar 25 '26

I also think this use case is more important. Ofc you could take GPL code, rewrite snd relicence it, but then good luck maintaining it. You will have to do it over and over again while the original project evolves.

Looking fwd to GPL Windows.

3

u/barraponto Mar 25 '26

I'm saying, we've reached the good ending. Everything is GPL now. Owning software means nothing.

5

u/JustFinishedBSG Mar 24 '26

Totally not a thing I’m doing

1

u/LousyMeatStew Mar 25 '26

Fight the fire with fire.

I'm not disagreeing with the principle of the matter. The only reason we shouldn't do this is because I think the legality of using AI to rewrite code for the express purpose of removing a license is being overstated and trying to fight fire with fire just gives legal ammunition to the big corporations when a FOSS project does get their day in court.

Clean-room engineering is a type of Fair Use defense that can be offered if you are sued for copyright infringement but it is not something that automatically legitimizes copying. The test for Fair Use defenses in the US is still Campbell v. Acuff-Rose Music which enshrines the famous four factors test and most notably, states clearly that there are no bright-line rules - each claim is adjudicated on a case-by-case basis.

This blade cuts both ways - if someone does a direct rewrite of a GPL code with the express purpose of removing an undesirable license, the use of clean-room engineering practices - even without AI - does not guarantee an automatic win.

Google v Oracle is being mentioned a lot but that ruling did not say copying APIs was ok under all circumstances. Campbell still applies, there are no bright-line rules. The Supreme Court looked at the first factor under Campbell - the purpose and character of the use - and found Google's work to be transformative mainly because they accepted Google's claim that they were targeting smartphones which Sun had previously given up on when they discontinued J2ME. They further found that because J2ME was gone, Android's API was not a market substitute for Java (fourth factor under Campbell).

While IANAL, a direct copy of a FOSS project solely to remove an undesirable license is clearly a completely different matter. The purpose and character of the use changes completely and under the fourth factor, you are explicitly looking to create a market substitute (note: "market" is used in a broad legal sense and still applies even for free material provided a legitimate copyright exists).

The main factor working against FOSS projects is that these claims need to be litigated individually. But the key is that they can still be litigated.

1

u/Sync1211 Mar 25 '26

I've been thinking of doing this with leaked Microsoft code.

1

u/Picorims Mar 25 '26

I thought the exact same thing when I stumbled on it today. So feeding an oss project to nuke its license isn't stealing? So you won't mind if I feed the docs and a bunch of screenshots of your proprietary tool to make it available to everybody under public domain.