Hacker News Reader

Comment by woodruffw | Hacker News Reader

I won't downvote this, even though I disagree with many of the particulars.

One of note: the "criminals" in this context are, at best, homebrew developers and users who'd like to unlock the full potential of the hardware they bought. At worst, they're "pirates" (the industry term, not mine) and game cheats. Nobody likes a cheater in a video game, but I don't know if I'd go as far as to make ethical prescriptions about it.

Sony feels comfortable paying a pittance for these vulnerabilities because the market for them is relatively soft. But that doesn't mean that the underlying asset actually lacks value; it means that Sony has successfully criminalized applications of the asset, artificially lowering their salability.

View on HN

Replying, to avoid edit confusion: you're the CEO of a financial services company that seems to employ reverse engineering to figure out private banking APIs. In the (not-very-distant) past, that was potentially criminal under both DMCA and ECPA.

Your position affords you a unique opportunity to have some perspective here.

Thanks for noticing. I do have a unique perspective indeed, and that is exactly the activity we engage in. It was never criminal. Reverse engineering for interoperability has always been permitted by law.

> Reverse engineering for interoperability has always been permitted by law.

It's not that straightforward (even if I wish it was).

First, it requires a judge and jury who understand "interoperability" to include "connecting to a server you don't own and sending it payloads that it isn't expecting."

Second, it requires a lenient interpretation of EULAs under the DMCA: the DMCA promotes otherwise legal reverse engineering activities into illegal activities by allowing companies to establish "acceptable use," which can include prohibiting reverse engineering activities that circumvent restrictions on copyrighted or other controlled material. A bank may plausibly (in the eyes of attorneys) claim that third-party uses of its APIs compromise the bank's ability to comply with federal regulations, since no law requires that compliance and operation be integral operations.

What? That is just clearly untrue, even though I agree it ought to be the law. DMCA 1201 made no exemptions to circumvention of technical protection measures (for research, interoperability, fair use etc). Assuming any kind of security measure was employed here the interpretations of violating that have been quite broad.

ianal etc.

Reverse engineering does not necessarily imply circumvention of technical countermeasures, e.g. removal of DRM.

Reverse engineering would also be a copyright infringement issue, which does have a carve out for reverse engineering.

Reply on news.ycombinator.com