ReactOS has always taken a "we will rebuild anything from complete ignorance of the source" approach, precisely because of the legal liabilities. They are so good at it though, that people at Microsoft have actually claimed that the developers must have source code access.

I had windows source code access (read) about 2005 but because of that I am not allowed to contribute to ReactOS even today.

You only can't contribute code to modules you saw, you can still do anything else, like analysis part, not sure if they still do it.

Two words: plausible deniability.

Incidentally, this is also why you should separate your work and personal life.

It isn't plausible deniability when it can very easily be verified

Is anyone who’s worked for MS barred?

Is that part of your NDA?

No, this is something ReactOS does themselves: https://reactos.org/project-news/reset-reboot-restart-legal-...

Contribute anonymously

>that people at Microsoft have actually claimed that the developers must have source code access.

Source?

Arent decompilers and disassemblers pretty good today anyway?

Legally they can't even use those, React does a totally blackbox reimplementation

You don't have to use a clean room methodology. Decompiling the code and reimplementing the functionality is a perfectly valid approach in any jurisdiction that permits reverse engineering.

Wait, pardon my ignorance, but isn't a decompiler required for the kind of work they do at react?

Person A's Job:

- Decompile shit.

- Then write down the names of the functions with (1) input, (2) output, (3) a description of what person a think the code is doing (4) any side effect / preconditions / post conditions they can deduce.

Person B's Job:

- Take the spec created by person A and write code.

while(missingFunctionality.hasNext): goto Person A's Job

It is and the split between person A doing the first part and person B doing the second part is important in a "clean room" reimplementation in the US.

A lot of stuff is based or observing the Windows functionality in a debugger, or Microsoft's API documentation.

decompiler vs. disassembler is an important distinction here

The source I heard this in was this video at 4:40 — https://www.youtube.com/watch?v=2D9ExVc0G10

A source: https://news.ycombinator.com/item?id=20341022

Same as Wine: none, since they are required to be 100% black-box reimplementations. No one who contributes to Wine is allowed to even look at the original Microsoft source code.

Curious, how do they enforce this? Or is it just assumed in good faith?

While I haven't seen such a case, I can imagine a mailing list 'leaking' with posts like "like the trick Windows did for fast_malloc()" and such, then being summoned.

Don't you mean black-box reimplementations? White box would mean they have access to and use the source code. Black box means they don't.

Thanks; fixed the original post.

Most informed people have correctly guessed that the ReactOS devs have used the old windows research kernel leak in their development.

Honestly it would be dumb not to. ReactOS is basically a toy, why take what they're doing so seriously?