I then asked Fable to compare it to the open source version I'd downloaded from Mutopia, which it promptly ripped apart. No sustain, zero rubato, upside down balance.
Ok, what about the version I'd just bought?
The PianoDisc versions are mp3s encoded with the right channel carrying MIDI to be played on the piano, and the left channel containing any accompanying music to be played through attached speakers (who doesn't want the harmonica on Piano Man?)
I gave the mp3 to Fable, which promptly decoded the format, identifying the right channel carrying MIDI using a 2004.5 Hz square wave.
It then went on to analyze the nuance of pedal lift and melody relative to the chords.
Fable then asked if I wanted it to build an encoder to write my own MIDI files into the right channel of mp3s.
Sounds great, and I instructed it to write the encoder.
What it came back with was a python encoder PLUS a decoder.
In the verbose explanation, it mentioned decoy notes.
Curious, I asked it to explain the decoy notes.
Apparently PianoDisc adds obfuscation into their format which is handled properly by their decoder, but would leave naively extracted MIDI unplayable on other systems.
Fable created an encoder which adds those decoy notes, and a decoder which removes them.
Am I allowed to publish the decoder? The encoder?
If you live in Europe, this restriction may be considered "gatekeeping" and exempted by the Digital Markets Act.
Don't bring attention to yourself by asking for permission. Publish your codec, and if the company cares about this they will send a cease and desist.
If you want the world to benefit from your code but you don't want to be responsible for it, try to adapt the codec to ffmpeg. The ffmpeg project is used to dealing with these matters, and will keep your codec working for eternity.
That's not how the DMA works at all, there is no concept of gatekeeping practices. Instead, the EU Commission designates companies that act as gatekeeper for some services (current list here: https://digital-markets-act.ec.europa.eu/gatekeepers-portal_...) which then puts constraints on what they do.
> Publish your codec, and if the company cares about this they will send a cease and desist.
If there are doubts about C&D letters, don't publish code to a USA provider. Bring it to Gitee, under an anonymous author name.
[Pirate flag emoji here]
Eeh, worst case scenario you'll get sued as Microsoft will have no problem with handing over everything they have from your Windows installation information, GitHub accounts, NPM authentication and everything else they own today if the courts tell them to.
You can't just commit crimes on the open internet without really hiding IPs and what not, and expect that to not come back to haunt you eventually. Kind of poor form to suggest otherwise too.
Who said it is a crime, are you a lawyer?
I'm not saying yay/nay if this is a crime or not, but if you think it might be, and you create a new account on GitHub to "be anonymous", you're not taking opsec seriously enough for something you believe might be a crime.
By the way, generally judges or juries would be the ones to decide if something was illegal or not, it's not the lawyers who decide this, in any country I'm familiar with.
But we like to pretend that the justice system delivers justice evenhandedly I suppose.
Not sure what you're talking about, the current AI boom is entirely based on committing crimes on the open internet without really hiding IPs and what not.
So is much of big tech in general.
You could also create a text document instead of a software that details the mechanism used to fool other MIDI decoders and publish only that (for now).
Finally, familiarize yourself with the Art. 6 Software Directive (2009/24/EC) / §69e UrhG — decompilation for interoperability. It may be your ticket for a legal status in Germany/EU.
Does it matter? What's important is if it can happen or not, and how if so. We already know that MPAA is willing to basically do whatever, even contribute themselves to piracy, if it means they can put people in jail for copying stuff eventually. They themselves also gotten in trouble for copyright violations themselves in the past, so doesn't seem like they're hiding away from breaking a little bit of laws to hunt pirates.
I really hope not. My understanding is that to be "effective" it needs to at least be a form of encryption with a secret key. At least, I'm not aware of any case law that allowed anything less than that.
IMO, "dummy notes" are nothing more than a form of obfuscation. If it's obvious how to filter them out, then I don't think it comes close to meeting the bare minimum of what might count as an "effective technical measure".
Of course, who knows what way the courts will rule if it ever reached that far.
However, Section 1201(f) is designed to allow developers leeway in reverse engineering to make "independently created computer programs" talk to other "computer programs". But this usually distinguishes between talking to a binary (good) and reading a media file (bad).
My guess is the encoder is probably legal under 1201(f) because it’s reverse engineering a DMCA covered application to create new media files for it to use. But the decoder would be illegal because it reverse engineers a DMCA covered application to extract copyrighted media.
And while courts might have ruled that a CAPTCHA might count as a "technological measure" they haven't gotten as far as ruling them as "effective" yet.
But in general yes. The protection scheme doesn't need to be well designed or free of design flaws to count as "effective". But from what I can tell, it does need to be a valid attempt at some cryptographic scheme requiring a secret known only to the copyright holder.
[0] https://law.justia.com/cases/federal/appellate-courts/F3/387...
Also it was an appeal to a preliminary judgement. The lower court said: okay, you're most likely going to lose so you have to stop selling these until we find out whether you lose. The appeal court said: actually this case is almost completely bogus and you're probably going to win, so you can keep selling them.
https://www.cnn.com/2000/TECH/computing/09/08/decss.shirt.id...
Put the code on the blockchain somewhere and it will be un-deleteable.
Anti-SLAPP laws exist for a reason, and if corps can bully anyone, how is it that corps routinely lose lawsuits on either side of the docket, hmmmm?
Keep licking that corporate boot, folks. Corps send C&Ds because they cost them all of maybe $100-200 and they're so effective.
There is a long road between "got a C&D" and "am getting sued." Among other things, a judge is going to want to see that both sides attempted to negotiate. If the company sending the C&D just demands that and then tries to file suit, the judge is going to tell them to go back to step 2 and stop bothering him/her.
Folks, stop telling people that if they get a C&D they have to just fold. Good chance you never hear from them again because the cost of suing you is nowhere near the damages they will be able to prove in court.
The problem is, the one advising them whether to sue or not might not care about that at all, and might personally profit from a lawsuit. So they've got all incentive in the world to persuade their employer that they must pursue this or they will have given up priceless rights forever.
Sometimes!
"It's better to ask for forgiveness than permission", as the saying goes. ;-)
OP is essentially asking if it's legal or not, not if people will dislike it. Navigating your nations laws with the mindset of "It's better to ask for forgiveness than permission" is bound to land you in places people generally prefer to stay out of.
I agree it sucks that some things seem arbitrary restricted, especially when it's victim-less (/ the victim is a faceless for-profit corporation), but kind of feels non-ideal to recommend people to "ask for forgiveness" when it comes to potentially breaking laws.
> The dataset contains about 200 hours of paired audio and MIDI recordings from ten years of International Piano-e-Competition. The MIDI data includes key strike velocities and sustain/sostenuto/una corda pedal positions. Audio and MIDI files are aligned with ∼3 ms accuracy and sliced to individual musical pieces, which are annotated with composer, title, and year of performance. Uncompressed audio is of CD quality or higher (44.1–48 kHz 16-bit PCM stereo).
Blocking the final result is no longer a real block, when all it requires is a vague prompt to replicate it.
We've entered a strange territory.
Just release the code somewhere, anonymously, it isn't yours anyway.
The thing is, at least in Germany, lawyers are required to carry a liability insurance and in the case th advice ends up being really bad you can hold their insurance accountable.
Because truly the answer boils down to "it depends" and many people will take it many different ways and not be "wrong". Publishing anonymously is a good choice, publishing publically and complying with a removal order is a good choice, not publishing is a good choice.
"Good" here being somewhat sound in that it likely wont cause the person publishing a huge life changing issue.
"Get some small amount of bitcoin and pay a VPS hosting provider in Moldova for a year's service on a $15-per-month equivalent KVM VM and put what you know on there anonymously as static content, then publish the link here."
Not that a sufficiently dedicated nation state federal crime agency or intelligence apparatus probably couldn't trace back to you, but it raises the bar for something like random civil lawsuits from piano companies.
> jumps through a lot of inconvenient hoops to "anonymously" publish code
Something doesn't add up there.
If it matters, ask your lawyer.
If it doesn't matter, it doesn't matter.
Or to put it another way, trademarks (you've mentioned two) and copyrights (it's a crapshoot) are complex. And in some jurisdictions (notably the US) anybody can sue anyone for anything.
Your risk aversion is yours, not someone else's. Your financial and legal wherewithal is likewise yours.
That should be the case in all jurisdictions. The justice system exists so that, if I feel treated unfairly, I can go to the state to settle the question whether/how much that is true. If there are issues where I cannot go to court, what am I supposed to do? Go fight you over the issue?
What differs (a lot) is how effectively the system rejects frivolous/unjust cases, how much time/money it costs you to defend yourself against remaining claims, and what systems there are to prevent people from going to court (having affordable care will prevent people from taking some medical claims to court; obligatory car insurance means most fender bender cases get handled by insurance companies, etc(
If you do this, I can nearly guarantee they will either never respond as a best case scenario, or they will object.
There is effectively zero chance a company would give you any indication that you have their blessing. Even if they don't actually care one way or another they will make the assumption that giving you any kind of positive response is nothing but a negative for themselves in terms of future liability, etc
The phrase that it is "better to ask for forgiveness than permission" exists because of situations like the one you're in.
Just publish the repo. Don't contact them. If they C&D you, take it down if you don't want to deal with the legal repercussions.
For all the same reasons that it is easy to predict how they will react if you ask, it is easy to predict how they will react if you don't and they find the repo and object. They will send you a cease and desist letter telling you to take the repo down. You will then take the repo down and face no other legal action because it will not be worth their time to make any bigger deal of it than that.
Or sue your ass…or file a DCMA takedown with Github.
Or all of the above.
The best likely outcome is probably “no.”
Because they have lawyers and that’s what lawyers do.
If you really really want to share the information, you might write a blog post with technical details without linking to any code. Sharing the blog to the “Facebook group” will let you assess community and corporate interest and make an informed decision.
Keep in mind that they could say yes and still do all that bad stuff anyway.
It is better to ask forgiveness than permission.
- Get an apk online, you haven't accepted a EULA.
- Run jadx to get some code to work with
- Ask Claude to extract the protocol specification cleanly for a Bluetooth device with capabilities etc.
- Use Claude to implement a version as a TUI/CLI in go, rust, whatever.
I get to use a device I own with a local Bluetooth connection from my machine, maybe Home Assistant. I do not contact any online services (there are none anyway in that case).
Since it's to avoid getting locked in with proprietary OS, it's a clean room reversing through a spec and an LLM produced a non copyrightable output... Can I just release this however I want? Probably a basic MIT or CC0, whatever...
That said, I'm in Canada which has some different nuances around the same exemption and IANAL
What a cursed format!
I don't understand what the designers were thinking of... 2000 Hz square wave on right channel? Seriously? Nobody would hear something suspicious and nobody would literally see it on spectrum analyzer. Maybe it's holdover from analog days and it was on casette tape before.
Also somebody reverse engineered it before - https://www.kinura.net/mid2pianocd/
So Fable probably just igested it from documentation of this software or some very obscure forum thread somewhere.
- The MP3 file encoding a stereo signal with one being audio-rate encoded digital data makes this just the latest layer of a barely updated system.
- The two channel format inside the MP3 must itself be evolved from another audio storage medium that didn't have a way to interleave digital data and audio. Furthermore, it must have been limited to only two channels, so they had to sacrifice one channel for the MIDI data.
- An audio CD would fit the specifications, but then, a mixed audio/digital CD with a player that buffers the MIDI from the data partition and plays the audio in real time wouldn't have been hard to create. Only the memory for the MIDI data could have been a potential cost issue in the mid-80s.
- Encoding the digital data on a carrier wave, cassette tape style, is really odd as MIDI was released in 1982 and mixed audio/data CDs were standardized in 1983. PianoDisc as a company was founded in 1988, so all-digital decoding tech would have been reasonably easy to build.
The really mind-boggling part of all of this to me is that it would be extremely easy to create a modern, higher quality recording format (e.g. proprietary container with MIDI and compressed audio) and the decoding hardware would still be dirt cheap.
Now its likely soiled and I have to throw it away. Doh! I asked it about legality and it went "its almost green" but when googling, reverse-enginnering like that seems very illegal.
The weird thing is in this case, it could have pretty easily gotten the needed info from using the code as a black box, and that is apparently legal!
Could you explain why you think so?
https://en.wikipedia.org/wiki/Erik_Satie
Also, when you bought from PianoDisc, did you agree to abide by a certain jurisdiction's laws in your use of PianoDisc? And did you explicitly agree to not share any sort of decoder/encoder in any ToS?
https://store.pianodisc.com/pages/terms-of-service-and-condi...
I don't see details about them mentioning and decoder or encoder.
IANAL. But I think reverse engineering their data structure, identifying a security measure - even one as weak as obfuscation, and publishing code to circumvent it is clearly against your license.
If the security measures exist in plain sight, as they apparently do, are they allowed to be discussed?
I reckon that if OP posts the encoder/decoder software that'd be against some sort of license clause. However in the age of AI who cares about the software at this point? Anyone can prompt their own private version into existence.
Just thinking out loud here. I have not considered AIs use as personal "cheat engines".
This decoy notes scheme seems pretty unethical.
Likewise, if you're able to upload your own custom MIDI (or other) files for your piano to play, then all you'd be doing is sharing a utility that creates mixed audio/MIDI MP3s, which may or may not be used to create files which can then be legitimately uploaded to a piano.
Wow. Abuse of format like this is always funny to see.
What really reinforced this for me was that I recently vibe coded a home assistant addon that, as it turns out, there was a github project that did almost the same thing. The initial implementation that came out of the LLM was essentially the same just with just some small tell in things like the logging that came from what I prompted it.
It was a very small project (maybe 500 LOC) so there's a greater chance of coincidence but it really felt like the office junior had just ripped off someone else's work and tried to hide it (badly) and really, that's exactly what they do
Are we really still having the "LLMs can only regurgitate what was in their training data" argument? Where did the counterexample to the Jacobian conjecture come from?
The hackers of hacker news are forgetting how to hack
On a serious note: reverse engineering is legal in australia, even for DMCA violations.
I was under the impression thr prescedant was:
Data Access Corporation v Powerflex Services Pty Ltd (1999), alongside specific provisions in the Copyright Act 1968.
The australian DMCA is called the TPM, it's more aimed at Bypassing, decrypt, or circumvent a digital lock or DRM (Digital Rights Management) protecting copyrighted material.
I do not think that phantom notes are encryption or rights management.
If you do your hosting in australia for your code/software, the US companies will probably have a bad time trying to convince the australian courts that access is the same as copyright infringement.
I'm not a lawyer, but i'll be damned if the 'vibe of it' shouldn't be a legal defense.
Even if it were illegal, you could have done it by releasing anonymously (on edit, and reworking the code to remove Fable's fingerprints)... if you hadn't first blown it by publicly posted a traceable question.
If your goal is to not pay them money - which you strategically unwisely hinted at with this question - then that's not covered by that exemption, I think.
So from my understanding, adding new music and releasing the tooling for that should be fine, but IANAL.
Frankly, what is or isn't legal doesn't matter as much as your story, as you will be judged by that. It also helps if the story is actually genuine, but that is a somewhat optional requirement all things considered. At least the industry treats it as such.
__
FWIW, as these capabilities trickle down to everyone through LLMs, it is worth asking yourself whether it is worth the trouble of releasing it in the first place.
If anyone can replicate this within a reasonably short timespan, then maybe not.
___
With this stuff in particular, it's also worth considering the business model of the entity.
Does your work pose a relevant risk for their bottom line? If yes, then bad. If no, then shrug.
Is music sold their main revenue channel, or are they just also doing that because recurring revenue is nice to have?
How user-friendly would you want your work to end up as? Would it target the demographic that would otherwise just buy the music?
Truth is that this is all just an elaborate dance.
___
To close the "polish trains" gap in what I just wrote in the last section:
"Is their business model ethical? And is it considered that by the majority, common sense, and politicians?"
And because software vendors never provide a Linux version of their stuff, you kinda have to do it anyways, because you end up with a hardware piece you can’t use without.
i can say, many people do it, some get in trouble because of local laws, others dont because their regions dont have such laws.
if you look at exploitdb and such site they have many exploits also for proprietary things. i would say if you dont outright leak firmware or such IP, an exploit itself is usually not strictly illegal.
its always best to contact a vendor if they are contactable, to both help them fix it and get permission for a post..that way, you can be relatively comfortable you are safe. get it in writing, email is ok.
edit: this is a gray are where the decoder might be considered leaking an algorithm btw. its perhaps not strictly an exploit but some characteristics will be shared around how its perceived to use something not as its intended.
> Gymnopedie No 1
Eric (or as he preferred, Erik) SATIE.
Seems more like a PSA on how to do it yourself with plausible deniability.
My task to fable was to take the MIDI and encode it into some proprietary mp3 format. It's still "binary" MIDI encoded in the mp3, it's not simulating the piano and generating waveforms... yet.
If you sell your decoder or encoder the company will, eventually, kick your butt. Getting money involved raises the stakes.
If you distribute a file that is sold by the company, even if it was transformed by a decoder, the company will, eventually, kick your butt. (A recording or sample of how it sounds post-transformation for demonstration purposes would be reasonable.)
If your software requires files that must be paid for in order to function, then it’s critical that you do not bundle those files with your decoder or encoder. That would be piracy.
How your software was made matters. Did you have access to non-public information about anything involved? It seems like the answer is no, so you might be fine. It sounds like you legally obtained a copy of the file, hardware that runs it, and figured out how they work.
What terms of service did you agree to? While not everything listed may hold up in court (which gets determined BY a court IN a court so don’t think that’s an easy win), the company is surely within their rights to ban you from their online service.
If you want some relevant legal advice, check out the GameCube Dolphin emulator and how the team stays legal. I love learning about how stuff works, so I’ve followed lots of console jailbreaking and reverse engineering news for years. There is a way to do this stuff legally. HN is focused more on finance than hacking. So talk to some hackers (who aren’t trying to break the law).
I saw you ask about contacting the company. If this was a blog, I’d love a followup about what they say and do, but alas I’ll probably never see it. (I guess the worst outcome is that they spend more money on making their proprietary stuff more locked down?) Regardless of what they say, their word is not the law. Know the law, know your rights, and know when it’s safe to stick your neck out and when it’s not. I am obviously not a lawyer.
Oh, and which US state you are in and what they are based in will be relevant.
When Fable came back with the decoder, I knew something was off. The decoy notes... even more evidence of wonkiness. Mostly posted it to HN out of disbelief that Fable just hacked my piano and had I blindly pushed it to a public repo, I would likely have broken some law.
Btw, the version I like is performed by Pascal Roge back in the 1970s. The AIs don't quite match his performance, and I keep trying to figure out how to guide them. I don't think his version has a delay between the melody and the chords, while the AIs were both convinced that was desirable. They seem to be lacking some taste in that area, but overall I prefer their version to the one I bought.
But if you're worried just pop it on anon GH.
Besides the fact that this sort of protection through obfuscation is dead now anyway. If you can ask an LLM to do it so can I, or anybody else. The only downside is duplication of work/wasted tokens but eh.
AI has already started commoditising software. Hopefully we see more OS' lean into the "safe" layer that runs everything and then temporary/custom interfaces dynamically created by AI on top.
What? MIDI and MP3 are opposite formats, they are designed for orthogonal runtime readouts. MIDI is a protocol that contains a variety of meta events and note events. I suppose you could use PCM to represent MIDI, but if you have the entire audio spectrum available [in an MP3 file], there's then the very strange choice to constrict yourself to exactly one non-integer frequency value.
Or, your Fable hallucinated an interpretation and you went along with it.
Also, the composer you are referencing is not Eric Satre, it is Eric Satie, composer of the 3 famous Gymnopedie pieces for solo piano.
That's where Bypass Paywalls Free Firefox plugin lives.
Its also where a whole lot of DRM bypass tools for Netflix etm also live.
I won't enumerate those details here.
The AI provider may also have account, payment, IP and conversation records connecting the generated code to you. An unrelated GitHub account and disposable email would therefore provide only superficial pseudonymity, not meaningful anonymity.
If attribution would create a material legal risk, I would assume the project is already attributable. A civil plaintiff could potentially seek records through discovery, and law enforcement could use the appropriate legal process. Getting actual legal advice before publishing seems safer than trying to anonymize it after posting this thread.
fwiw you can reach support/dang on the email on the footer if you need help w your personal account/data/on the site
For example, remove all code from your training data, and then see if the model can code regardless.
(TBH, when people claim this, I do wish there would at least be occasionally an actual pointer to something that was copied. I understand it's probably not going to be doable in all cases, but without examples it sure feels like a weak statement. In my experience the recent models are good at doing things I'm pretty sure there is not a close reference for in the training data, though for most part I wouldn't classify them as particularly difficult tasks either)
> For example, remove all code from your training data, and then see if the model can code regardless.
Would you accept this weaker version: make up a new programming language (that's guaranteed not to be in the training set), and see if the model (which has trained on programming in existing languages) can cope?