Hacker News Reader

Comment by rayiner | Hacker News Reader

But it wasn't just based on Goldman's word:

> Then [the FBI agent] explained what he knew, or thought he knew: in April 2009, Serge had accepted a job at a new high-frequency-trading shop called Teza Technologies, but had remained at Goldman for the next six weeks, until June 5, during which time he sent himself, through a so-called “subversion repository,” 32 megabytes of source code from Goldman’s high-frequency stock-trading system.

Lewis weaves a lot of editorializing and red-herrings into the account, but here's the punchline:

> All of which was true, as far as it went...

Nobody disputes that at the time Aleynikov was arrested, the FBI had evidence that he had sent himself a bunch of source code and covered his tracks. And at trial, the prosecution proved that he had in fact done that.

So what the heck else was the FBI supposed to do?

View on HN

>... covered his tracks.

He deleted his bash history. For all you know, that may have been a standard procedure.

  user@somemachine.gs.com:~/ >svn export --username Aleynikov --password Hunter2 --non-interactive svn://subversion.ZOMG.think.of.the.children.com/espionage/exportFile
  user@somemachine.gs.com:~/ >rm .bash_history

Would you "cover your tracks" if you for some reason typed a password into the console of a machine that you don't own?

Realistically (loopholes aside) - all of the code not under GPL would be theft no? (Goldman replacing the copyrights on other open-source stuff with their own is probably illegal (as long as the license stipulates that the original copyright notice must remain), but their modifications are still proprietary.

He of course could have had proprietary source code in his repositories for work in the first place - but bundling and uploading everything does look highly suspicious - and he should have known better.

[Goldman] called the F.B.I. in haste, just two days before, and then put their agent through what amounted to a crash course on high-frequency trading and computer programming. McSwain later conceded that he didn’t seek out independent expert advice to study the code Serge Aleynikov had taken.

This is the very surprising part.

I'm not one of the people who would ever equate copying code to theft, regardless of intent. But Aleynikov admitted that he expected GS to be upset about it, mostly due to their cultural attitudes about IP (ie: everything is theirs). Note that he didn't "bundling and uploading everything" he specifically avoided uploading the trading strategies code.

On the one hand, people seem to be giving GS a pass for stripping the copyright notices from GPL'd code they used, but taking them at their word and treating it as high treason when Aleynikov makes a copy of the modified GPL code for himself.

>> "McSwain later conceded that he didn’t seek out independent expert advice to study the code Serge Aleynikov had taken."

>This is the very surprising part.

It's just the lazy careless work of a modern day Pinkerton man.

Is anyone on this thread saying that Aleynikov was wrong to copy GPL'd code? I don't see anyone saying that.

> Goldman replacing the copyrights on other open-source stuff with their own is probably illegal (as long as the license stipulates that the original copyright notice must remain)

It's only illegal if Goldman distributed it, which they didn't. It's perfectly okay to modify GPL'ed code for internal purposes without open-sourcing the changes.

>It's only illegal if Goldman distributed it, which they didn't. It's perfectly okay to modify GPL'ed code for internal purposes without open-sourcing the changes.

I'm not a lawyer but as far as I understand they were stripping the copyright notice, which is explicitly forbidden by the licenses. i.e. the MIT license:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

The stripping clause only comes into place when you distribute the code, just as the GPL's copy-left requirement only comes into play when you distribute the code.

>The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

Where is distribution mentioned? Or, do you mean that nobody would have the chance to sue unless it were distributed, because they wouldn't find out?

> The stripping clause only comes into place when you distribute the code, just as the GPL's copy-left requirement only comes into play when you distribute the code.

No, it doesn't. The stripping clause is a license condition with no limitation to distribution -- it expressly applies to all copies. Anything you need a license to do -- which is, anything that involves any of the exclusive rights tied to copyright (of which, the most prominent is copying, regardless of distribution) must follow it, barring an exception in the license or a some other provision of law that limits the applicability of the exclusive rights in copyright.

As well as the stripping clause of the MIT license, this is also true with regard to GPLv2 provisions related to copyright notices, which are required for both modification of GPL-licensed code and copying and distribution of GPL-licensed code, though the GPLv3 only applies this to copies that are "conveyed" (compare Section 2 of the GPLv2 with the combination of Sections 2, 4, & 5 of the GPLv3.)

Fair enough. Why does the FSF FAQ say you don't need to distribute source if you modify the code for internal purposes. Is it an explicit provision of the license?

> rayiner 17 minutes ago

> The stripping clause only comes into place when you distribute the code, just as the GPL's copy-left requirement only comes into play when you distribute the code.

I absolutely wish this was the case: copying internally within an organization such as a school, a church, or a business should be legal for any purposes regardless of the license something comes with... However, I'd not be very certain of support of companies like Microsoft which would argue that their copyright licenses dictate usage within the organization and not just on distribution. And no, for these purposes there is no difference between Microsoft EULA and MIT license.

I'd imagine you can argue that you can argue that you are in compliance if you distributed a git (or hg etc) repository with an older version that does include the copyright notice though.

My point is just that at what point does distribution begin? The entertainment industry wants us to believe that if I buy a CD, I am violating copyright by the audio CD to an iPod (doubly so if to a friend's iPod).

> he sent himself, through a so-called “subversion repository,” 32 megabytes of source code

One wonders whether this would have seemed less nefarious if he'd used a VCS that wasn't called "subversion." :)

Would it have? On my last day at work at Google, before I am slated to start working in the Bing group at Microsoft, I mail myself a copy of the PageRank source code. Does it matter what VCS I use?

Except the code copied by Aleynikov wasn't anything like PageRank. It was like some Go library that fetches the pages, and one that was primarily open source code to begin with.

This was some initial (mis?)-information about the case, but at least according to the Second Circuit:

> In addition to proprietary source code, Aleynikov also transferred some open source software licensed for use by the public that was mixed in with Goldman’s proprietary code. However, a substantially greater number of the uploaded files contained proprietary code than had open source software.

Were the files source code or were they some sort of transaction logs, generated records, and what have you? Or were they various forks/branches of mostly the same thing intended for testing? If you don't know then you can't assess their relative "value".

I'm referring to the fact that no matter how damning the evidence is on its own, it probably seems even more damning to a layperson who doesn't know the name "subversion" is a pun and not something subversive.

That's not the point he was getting at.

Most people have no idea what VCS is. To a lay person, "a so called 'mercurial repository'" would sound far less sinister than "a so called 'subversion repository'". The reality is that the repo probably had little to do with subverting anything, and was just a convenient way to transfer code.

I have to admit, that line made me chuckle.

Technically no. In a court description or in a press article, both addressed to people who are not technical, the name of the VCS is important.

Consider the extreme case where the VCS was called "theft-assistance" for example.

How does "He copied the code from a theft-assistance repository" would sound to a jury that doesn't know what a VCS is and that theft-assistance is just a name?

If it was something generic and inoffensive, like Git, it would be OK, but "subversion" has a ...subversive undertone.

In a previous video posted on HN, a police officer explains how they would use a concession made by a honest humble person during an interview to boost their conviction rate: "Sure, I never like the guy. But I would never do anything malicious against anyone or even animals, especially not theft or murder which is totally against my conscience." would become big uppercase red letters on a videoprojector: "I NEVER LIKE THE GUY". Be sure you nail every emotional aspect to convince a jury.

That part made me kind of angry -- "so-called" makes the writer sound like they know something we don't, like "subversion" is some cool trick that smart people know.

"so-called" here is a way of distinguishing the use of "subversion" as a name/description distinction (somewhat similar to a use/mention distinction, but not the right way of making that distinction, IMO, as correctly using "Subversion" as a proper noun would be better, though) as the common noun "subversion" has meaning, but the word "subversion" was not being used for that meaning, only as the name of a thing.

Reply on news.ycombinator.com