Posted by jmpman 1 day ago
Ask HN: Fable hacked my piano, can I release the results?
I then asked Fable to compare it to the open source version I'd downloaded from Mutopia, which it promptly ripped apart. No sustain, zero rubato, upside down balance.
Ok, what about the version I'd just bought?
The PianoDisc versions are mp3s encoded with the right channel carrying MIDI to be played on the piano, and the left channel containing any accompanying music to be played through attached speakers (who doesn't want the harmonica on Piano Man?)
I gave the mp3 to Fable, which promptly decoded the format, identifying the right channel carrying MIDI using a 2004.5 Hz square wave.
It then went on to analyze the nuance of pedal lift and melody relative to the chords.
Fable then asked if I wanted it to build an encoder to write my own MIDI files into the right channel of mp3s.
Sounds great, and I instructed it to write the encoder.
What it came back with was a python encoder PLUS a decoder.
In the verbose explanation, it mentioned decoy notes.
Curious, I asked it to explain the decoy notes.
Apparently PianoDisc adds obfuscation into their format which is handled properly by their decoder, but would leave naively extracted MIDI unplayable on other systems.
Fable created an encoder which adds those decoy notes, and a decoder which removes them.
Am I allowed to publish the decoder? The encoder?
If you live in Europe, this restriction may be considered "gatekeeping" and exempted by the Digital Markets Act.
Don't bring attention to yourself by asking for permission. Publish your codec, and if the company cares about this they will send a cease and desist.
If you want the world to benefit from your code but you don't want to be responsible for it, try to adapt the codec to ffmpeg. The ffmpeg project is used to dealing with these matters, and will keep your codec working for eternity.
That's not how the DMA works at all, there is no concept of gatekeeping practices. Instead, the EU Commission designates companies that act as gatekeeper for some services (current list here: https://digital-markets-act.ec.europa.eu/gatekeepers-portal_...) which then puts constraints on what they do.
> Publish your codec, and if the company cares about this they will send a cease and desist.
If there are doubts about C&D letters, don't publish code to a USA provider. Bring it to Gitee, under an anonymous author name.
[Pirate flag emoji here]
Eeh, worst case scenario you'll get sued as Microsoft will have no problem with handing over everything they have from your Windows installation information, GitHub accounts, NPM authentication and everything else they own today if the courts tell them to.
You can't just commit crimes on the open internet without really hiding IPs and what not, and expect that to not come back to haunt you eventually. Kind of poor form to suggest otherwise too.
Who said it is a crime, are you a lawyer?
I'm not saying yay/nay if this is a crime or not, but if you think it might be, and you create a new account on GitHub to "be anonymous", you're not taking opsec seriously enough for something you believe might be a crime.
By the way, generally judges or juries would be the ones to decide if something was illegal or not, it's not the lawyers who decide this, in any country I'm familiar with.
But we like to pretend that the justice system delivers justice evenhandedly I suppose.
You could also create a text document instead of a software that details the mechanism used to fool other MIDI decoders and publish only that (for now).
Finally, familiarize yourself with the Art. 6 Software Directive (2009/24/EC) / §69e UrhG — decompilation for interoperability. It may be your ticket for a legal status in Germany/EU.
Does it matter? What's important is if it can happen or not, and how if so. We already know that MPAA is willing to basically do whatever, even contribute themselves to piracy, if it means they can put people in jail for copying stuff eventually. They themselves also gotten in trouble for copyright violations themselves in the past, so doesn't seem like they're hiding away from breaking a little bit of laws to hunt pirates.
I really hope not. My understanding is that to be "effective" it needs to at least be a form of encryption with a secret key. At least, I'm not aware of any case law that allowed anything less than that.
IMO, "dummy notes" are nothing more than a form of obfuscation. If it's obvious how to filter them out, then I don't think it comes close to meeting the bare minimum of what might count as an "effective technical measure".
Of course, who knows what way the courts will rule if it ever reached that far.
However, Section 1201(f) is designed to allow developers leeway in reverse engineering to make "independently created computer programs" talk to other "computer programs". But this usually distinguishes between talking to a binary (good) and reading a media file (bad).
My guess is the encoder is probably legal under 1201(f) because it’s reverse engineering a DMCA covered application to create new media files for it to use. But the decoder would be illegal because it reverse engineers a DMCA covered application to extract copyrighted media.
And while courts might have ruled that a CAPTCHA might count as a "technological measure" they haven't gotten as far as ruling them as "effective" yet.
But in general yes. The protection scheme doesn't need to be well designed or free of design flaws to count as "effective". But from what I can tell, it does need to be a valid attempt at some cryptographic scheme requiring a secret known only to the copyright holder.
[0] https://law.justia.com/cases/federal/appellate-courts/F3/387...
Anti-SLAPP laws exist for a reason, and if corps can bully anyone, how is it that corps routinely lose lawsuits on either side of the docket, hmmmm?
Keep licking that corporate boot, folks. Corps send C&Ds because they cost them all of maybe $100-200 and they're so effective.
There is a long road between "got a C&D" and "am getting sued." Among other things, a judge is going to want to see that both sides attempted to negotiate. If the company sending the C&D just demands that and then tries to file suit, the judge is going to tell them to go back to step 2 and stop bothering him/her.
Folks, stop telling people that if they get a C&D they have to just fold. Good chance you never hear from them again because the cost of suing you is nowhere near the damages they will be able to prove in court.
Sometimes!
"It's better to ask for forgiveness than permission", as the saying goes. ;-)
OP is essentially asking if it's legal or not, not if people will dislike it. Navigating your nations laws with the mindset of "It's better to ask for forgiveness than permission" is bound to land you in places people generally prefer to stay out of.
I agree it sucks that some things seem arbitrary restricted, especially when it's victim-less (/ the victim is a faceless for-profit corporation), but kind of feels non-ideal to recommend people to "ask for forgiveness" when it comes to potentially breaking laws.
Just release the code somewhere, anonymously, it isn't yours anyway.
The thing is, at least in Germany, lawyers are required to carry a liability insurance and in the case th advice ends up being really bad you can hold their insurance accountable.
"Get some small amount of bitcoin and pay a VPS hosting provider in Moldova for a year's service on a $15-per-month equivalent KVM VM and put what you know on there anonymously as static content, then publish the link here."
Not that a sufficiently dedicated nation state federal crime agency or intelligence apparatus probably couldn't trace back to you, but it raises the bar for something like random civil lawsuits from piano companies.
> jumps through a lot of inconvenient hoops to "anonymously" publish code
Something doesn't add up there.
> The dataset contains about 200 hours of paired audio and MIDI recordings from ten years of International Piano-e-Competition. The MIDI data includes key strike velocities and sustain/sostenuto/una corda pedal positions. Audio and MIDI files are aligned with ∼3 ms accuracy and sliced to individual musical pieces, which are annotated with composer, title, and year of performance. Uncompressed audio is of CD quality or higher (44.1–48 kHz 16-bit PCM stereo).
If it matters, ask your lawyer.
If it doesn't matter, it doesn't matter.
Or to put it another way, trademarks (you've mentioned two) and copyrights (it's a crapshoot) are complex. And in some jurisdictions (notably the US) anybody can sue anyone for anything.
Your risk aversion is yours, not someone else's. Your financial and legal wherewithal is likewise yours.
That should be the case in all jurisdictions. The justice system exists so that, if I feel treated unfairly, I can go to the state to settle the question whether/how much that is true. If there are issues where I cannot go to court, what am I supposed to do? Go fight you over the issue?
What differs (a lot) is how effectively the system rejects frivolous/unjust cases, how much time/money it costs you to defend yourself against remaining claims, and what systems there are to prevent people from going to court (having affordable care will prevent people from taking some medical claims to court; obligatory car insurance means most fender bender cases get handled by insurance companies, etc(
Or sue your ass…or file a DCMA takedown with Github.
Or all of the above.
The best likely outcome is probably “no.”
Because they have lawyers and that’s what lawyers do.
If you really really want to share the information, you might write a blog post with technical details without linking to any code. Sharing the blog to the “Facebook group” will let you assess community and corporate interest and make an informed decision.
Keep in mind that they could say yes and still do all that bad stuff anyway.
If you do this, I can nearly guarantee they will either never respond as a best case scenario, or they will object.
There is effectively zero chance a company would give you any indication that you have their blessing. Even if they don't actually care one way or another they will make the assumption that giving you any kind of positive response is nothing but a negative for themselves in terms of future liability, etc
The phrase that it is "better to ask for forgiveness than permission" exists because of situations like the one you're in.
Just publish the repo. Don't contact them. If they C&D you, take it down if you don't want to deal with the legal repercussions.
For all the same reasons that it is easy to predict how they will react if you ask, it is easy to predict how they will react if you don't and they find the repo and object. They will send you a cease and desist letter telling you to take the repo down. You will then take the repo down and face no other legal action because it will not be worth their time to make any bigger deal of it than that.
It is better to ask forgiveness than permission.