News for hackers. Stuff that matters.

A comment on Reverse Engineering My Home Security System: Decompiling Firmware Updates. Parent comment

Re:Reverse Engineering My Home Security System: Decompiling ... by kogepathic on Tuesday August 22, 2017 @08:24AM (#15071633)
> it's a good first step though

Not only is it a good first step, but since the product clearly runs Linux, the author should be able to download all GPL source code from Honeywell. Being able to build the device firmware yourself from source is hugely beneficial to understanding the structure of the firmware and can even help in understanding the behaviour of the device.

If Honeywell aren't providing a GPL archive for the Tuxedo with the kernel and any GPL licensed user-space programs, they are violating the GPL.

I'm not sure the author is aware that the source code for these should be freely available from Honeywell

[ Parent | on HN ]
Re:Reverse Engineering My Home Security System: Decompiling ... by enile8 on Tuesday August 22, 2017 @09:47AM (#15072300)
Honeywell does have a number of opensource projects, with tuxdeo touch being one of them http://www.security.honeywell.com/opensource/
[ Parent | on HN ]
Re:Reverse Engineering My Home Security System: Decompiling ... by anmorgan on Tuesday August 22, 2017 @08:42AM (#15071771)
Is running software/application in the Linux environment deem it a derivative work? Does Honeywell have to adhere to a GPL if they aren't modifying the Linux kernel?

It's not clear to me that they would need to follow GPL.

[ Parent | on HN ]
Re:Reverse Engineering My Home Security System: Decompiling ... by cnorthwood on Tuesday August 22, 2017 @09:03AM (#15071920)
Yes, the licensing terms are on distribution, not on modification. They have to provide the source, even if it's not been modified.
[ Parent | on HN ]
Re:Reverse Engineering My Home Security System: Decompiling ... by michaelt on Tuesday August 22, 2017 @09:07AM (#15071956)
They have to provide the source for the kernel and whatnot - but if the interesting stuff is in userspace applications which aren't derivatives of copyleft code, they don't have to provide the source for _those_
[ Parent | on HN ]
Re:Reverse Engineering My Home Security System: Decompiling ... by kogepathic on Tuesday August 22, 2017 @09:21AM (#15072071)
> but if the interesting stuff is in userspace applications which aren't derivatives of copyleft code

Of course. Honeywell can run their own proprietary applications on top of a Linux/GNU system. I didn't mean to imply that you could request the source code to every program running on the device.

However they need to provide the source code for any GPL licensed portions. IIRC they should also provide build scripts so you can create a firmware image yourself.

[ Parent | on HN ]
Re:Reverse Engineering My Home Security System: Decompiling ... by qb45 on Tuesday August 22, 2017 @10:12AM (#15072563)
GPL only requires providing build scripts for GPL software. In this case it means they can't strip kernel makefiles from the kernel source to make it harder to build independently.
[ Parent | on HN ]
Re:Reverse Engineering My Home Security System: Decompiling ... by juiyout on Tuesday August 22, 2017 @11:57AM (#15073640)
True. Though Honeywell can elect to mail you the source code printed on flash cards without any particular order.
[ Parent | on HN ]
Re:Reverse Engineering My Home Security System: Decompiling ... by nitrogen on Tuesday August 22, 2017 @12:08PM (#15073756)
I don't remember what the GPL3 says, but the GPL2 (Linux is under GPL2) says something like "a medium customarily used for software interchange" must be provided.
[ Parent | on HN ]
Re:Reverse Engineering My Home Security System: Decompiling ... by Simulacra on Tuesday August 22, 2017 @12:21PM (#15073903)
That seems a tad excessive. Does any company do this, outside of high security systems?
[ Parent | on HN ]
Re:Reverse Engineering My Home Security System: Decompiling ... by subway on Wednesday August 23, 2017 @11:01AM (#15082003)
That has nothing to do with security, and everything to do with malicious compliance.
[ Parent | on HN ]