Posted by jmpman 1 day ago
Ask HN: Fable hacked my piano, can I release the results?
I then asked Fable to compare it to the open source version I'd downloaded from Mutopia, which it promptly ripped apart. No sustain, zero rubato, upside down balance.
Ok, what about the version I'd just bought?
The PianoDisc versions are mp3s encoded with the right channel carrying MIDI to be played on the piano, and the left channel containing any accompanying music to be played through attached speakers (who doesn't want the harmonica on Piano Man?)
I gave the mp3 to Fable, which promptly decoded the format, identifying the right channel carrying MIDI using a 2004.5 Hz square wave.
It then went on to analyze the nuance of pedal lift and melody relative to the chords.
Fable then asked if I wanted it to build an encoder to write my own MIDI files into the right channel of mp3s.
Sounds great, and I instructed it to write the encoder.
What it came back with was a python encoder PLUS a decoder.
In the verbose explanation, it mentioned decoy notes.
Curious, I asked it to explain the decoy notes.
Apparently PianoDisc adds obfuscation into their format which is handled properly by their decoder, but would leave naively extracted MIDI unplayable on other systems.
Fable created an encoder which adds those decoy notes, and a decoder which removes them.
Am I allowed to publish the decoder? The encoder?
What really reinforced this for me was that I recently vibe coded a home assistant addon that, as it turns out, there was a github project that did almost the same thing. The initial implementation that came out of the LLM was essentially the same just with just some small tell in things like the logging that came from what I prompted it.
It was a very small project (maybe 500 LOC) so there's a greater chance of coincidence but it really felt like the office junior had just ripped off someone else's work and tried to hide it (badly) and really, that's exactly what they do
If your goal is to not pay them money - which you strategically unwisely hinted at with this question - then that's not covered by that exemption, I think.
So from my understanding, adding new music and releasing the tooling for that should be fine, but IANAL.
Frankly, what is or isn't legal doesn't matter as much as your story, as you will be judged by that. It also helps if the story is actually genuine, but that is a somewhat optional requirement all things considered. At least the industry treats it as such.
__
FWIW, as these capabilities trickle down to everyone through LLMs, it is worth asking yourself whether it is worth the trouble of releasing it in the first place.
If anyone can replicate this within a reasonably short timespan, then maybe not.
___
With this stuff in particular, it's also worth considering the business model of the entity.
Does your work pose a relevant risk for their bottom line? If yes, then bad. If no, then shrug.
Is music sold their main revenue channel, or are they just also doing that because recurring revenue is nice to have?
How user-friendly would you want your work to end up as? Would it target the demographic that would otherwise just buy the music?
Truth is that this is all just an elaborate dance.
___
To close the "polish trains" gap in what I just wrote in the last section:
"Is their business model ethical? And is it considered that by the majority, common sense, and politicians?"
And because software vendors never provide a Linux version of their stuff, you kinda have to do it anyways, because you end up with a hardware piece you can’t use without.
But if you're worried just pop it on anon GH.
Besides the fact that this sort of protection through obfuscation is dead now anyway. If you can ask an LLM to do it so can I, or anybody else. The only downside is duplication of work/wasted tokens but eh.
AI has already started commoditising software. Hopefully we see more OS' lean into the "safe" layer that runs everything and then temporary/custom interfaces dynamically created by AI on top.
Also, when you bought from PianoDisc, did you agree to abide by a certain jurisdiction's laws in your use of PianoDisc? And did you explicitly agree to not share any sort of decoder/encoder in any ToS?
https://store.pianodisc.com/pages/terms-of-service-and-condi...
I don't see details about them mentioning and decoder or encoder.
IANAL. But I think reverse engineering their data structure, identifying a security measure - even one as weak as obfuscation, and publishing code to circumvent it is clearly against your license.
If the security measures exist in plain sight, as they apparently do, are they allowed to be discussed?
I reckon that if OP posts the encoder/decoder software that'd be against some sort of license clause. However in the age of AI who cares about the software at this point? Anyone can prompt their own private version into existence.
Just thinking out loud here. I have not considered AIs use as personal "cheat engines".
This decoy notes scheme seems pretty unethical.