I am not fully sure how I feel about it yet:

* https://malus.sh/
* https://malus.sh/blog

There are a ton of good points, and they're all well reasoned and all fully accurate and correct as far as I understand. I am not sure about the "solution" though. I think it's fair to say this is a brave move, while it's not mind blowing but I never thought someone would really attempt to do it. If it's not well written, I would expect this to be a joke, not something serious. Thought provoking.

MALUS - Clean Room as a Service | Liberation from Open Source Attribution

I honestly admire the honesty here. In some ways it reads like an honest theft, but it's not. It's indeed how copyright works and thus far how it should work. It is true that things have changed and the economy is much different today. Following it it's a nature evolution indeed. This can mean copyright requires some changes, too, as everyone is updating the copyright law in the era of AI. This is no different from that.

It's legal right now. It should be in the foreseen future. But how far?

Quoting the closing clause:

> [...] maintained by a generation of developers who believed that sharing code was its own reward and have been comprehensively proven right about the sharing and wrong about the reward.
>
> We owe them a debt we have no intention of repaying. But we do, at least, have the decency to say thank you.
>
> So: thank you. Truly. We'll take it from here.

@godfat I don’t like it.

However, the question is can APIs be copyrighted? What about the documentation that is the specification?

So it maybe legal, it just feels wrong.

There have to be better approaches than the one they’re talking.

@mlevison As far as I understand, APIs cannot be copyrighted, see Google vs Oracle for Java API on Android.

I am not sure about documentation that is specification. The precise words are copyright protected, but not the "idea". So technically if someone who writes it in a completely different manner, words, paragraphs, presentation, etc, that would not violate copyright.

There are a lot of gray areas for sure, like left-pad, it's too simple, which is too easy to come up with the same thing.

@godfat

Your memory of the Java API copyright case and mine are the same. If they can use the documentation to build a clean room version of a feature, then it seems legal as it currently stands. It is however immoral.

Two reasonable outcomes:
- Best: AI generated code can’t be copyrighted and so the relicensing goes away.
- Adequate: instead of using an LLM to generate against an API get it to create a functional equivalent and adapt the client code to use it.

@godfat

Patents for software were always morally wrong. Practically I wonder if LLMs kill them entirely.

@mlevison I think I'll put morality aside for now because I think it'll highly depend on the specific case.

As for AI generated code, I do recall we're heading more to those cannot be copyrighted, and thus some contributors are trying to hide the fact that their outputs are generated by AI, or try to side step from that.

This might make it not being able to relicense, but people can still use those "unlicensed" code. Maybe this drops liabilities and makes it less appealing for big corporations

@mlevison As for using slightly different APIs, I am not sure if this is solving anything. There are enough plagiarism which tried to side step copyright by slightly changing things. If this normalizes I see no difference, and if this is automated there's even less difference.

I do agree patents for software are immoral. I am mostly wondering if some ideas can be borrowed and applied with modifications to copyright though, as software does sit between creative work and invention.

@godfat

Further reflection. I don’t this person has a business model.

If they can do this with an LLM, then anyone inside a corp with a legal department that cares can do the same.

Further, I suspect the code quality approach won’t be great. See: https://agilepainrelief.com/blog/genai-code-quality-fundamental-flaws-and-how-bluffing-makes-it-worse/ and related posts

GenAI Code Quality – The Fundamental Flaws and How Bluffing Makes It Worse

AI-generated code has 1.7x more issues and the flaws are structural, not fixable by code review. Why training rewards bluffing over quality, and what to do about it

Agile Pain Relief

@mlevison I definitely think that the quality won't be there. Practically, I don't expect this can work, right now, unless it's packages like left-pad, or for projects that only need to live for a short span. I am not 100% sure going into future though, as AI matures.

As for business model, the post mentions:

@mlevison

> In the future we will provide comprehensive end to end testing of MalusCorp-0 Licensed code. We will provide automated security audits and remediation. We will provide comprehensive performance testing and remediation.

I think this can be quite appealing for companies having a legal team, because I don't expect this can be easily done by LLM. I think this will be much harder than replicating the behavior, or more specifically, how to verify that the behavior does work as expected.

@godfat agreed on the purely technical front this will be the hard part.

On the business front, assuming a key claim of the vendors correct, code is cheap. Then this isn’t a sustainable business model. (I don’t think the claim is as strong as Anthropic et al suggest)

@mlevison Could you expand a bit more on the business front? I don't think I understand and follow. Thanks

@godfat

Assumptions:
1. Code is cheap
2. LLM can analyze a companies existing use of AGPL code.
3. LLM can write test cases for company specific usage.
4. LLM generates internal version of the library in question
….

I would bet this is more reliable than the model the vendor is offering. Likely also cheaper. So this doesn’t feel like a business model. Tell me if I missed something.

@mlevison I see, that makes sense. I do think there are some values to have shared libraries though, as this is also a way to reduce cognitive load with abstraction or generalization. It's like creating open standards or specs for open source projects. Or maybe this is old school thinking and doesn't apply when everything can be customized and generated.

All that said, it looks like this is not a serious business, but a joke or satire, or some kind of prophecy. Links are fake on the site.

@godfat

The downside of operating from my phone. I missed the cues.

Good discussion. I’m trying to help Product Owners/Managers understand sustainable business models going forward.

@mlevison I didn't bother to check earlier, but after our discussions I am interested enough to figure it out, so I checked the links there. I am on iPad and that's also why checking it requires a bit more effort which I didn't bother to do earlier 😅

Yeah, this really makes me wonder about the whole software industry moving forward. I don't expect it would crash as some people seem to predict, but things are changing for sure, and it's hard to tell how it would change yet. Cool puzzles!