0

For my final thesis in university, I have created a dataset of third-party applications for macOS. For each version of each app, the dataset contains the original executable, the original Info.plist file containing app-specific metadata and a couple of other files summarising the app's contents (file sizes, file names, ...). Almost all apps are commercial software.

I am looking for ways to release or make available (parts) of this dataset to the public. Due to copyright law, I probably cannot just release all data. What are my options?

Here is what I've been thinking:

I suspect I could release the dataset after all binaries have been removed. However, this reduces the usefulness of the data drastically. Would I also have to strip the Info.plist files as they are copied verbatim from the application bundle? Would I be allowed to include limited parts / metadata of binaries such as linked libraries, imported symbols, functions names, strings and the like?

Another option would be to invite researchers to contact me to get access to the full dataset. Would that be appropriate?

Am I allowed to create a service à la shodan.io, that offers an API for others to work with the dataset, without providing direct access to the binaries?

1

(We're not lawyers here, and this may be off-topic, but I've had similar situations and will hazard a response).

This all comes down to the license agreement of the software you are using. The license will specify:

  • whether you can distribute it
  • whether your code is considered "derivative" (or allowed at all)
  • whether you can make the software available as a service through an API.

It sounds like you are using commercial software, so the answers to the above are likely to be in the negative. If the license agreement does not prohibit doing what you're doing, it is likely OK to publish your code and give instructions for how to acquire the proprietary software and what to do with it after it's acquired; however, it sounds like in your case, there may not be a lot left after you remove the proprietary stuff.

1

I'm assuming you're not looking for advice on what's legally ironclad. (If you want that, ask a lawyer.)

Surely you will be technically infringing copyright if you distribute the binaries (unless they're shareware). There might be a fair use defense but you probably aren't interested in litigating this in court. Your real problem is going to be whether this is going to be objectionable to the app owners. I'd take into account:

  • If it's freely available for download from the author's website, and you're not including registration keys, probably they wouldn't care unless they see some negative effect from it. (Don't show up in the top google results for the app, don't look like a place to download apps to normal users.)
  • If it's from the app store, Apple might also have some interest in not having the binaries floating around in odd places.
  • If the binary is not available until after you've paid for the app, that's probably going to be a problem.

The easiest solution to be on firm footing would be to ask for permission, but many companies might not want to give explicit permission even if they wouldn't take action against non-egregious cases.

For the metadata, I think there will be much less concern. For the Info.plist, it might not even reach the threshold of originality to count as an original work. (Again, ask a lawyer to be sure.) The API might be fine, although it might make a difference if you actually run the app vs. just examine the binary as data. As long as the users don't actually get any of the app's functionality, probably nobody will object.

Privately sharing the dataset with other researchers is unlikely to lead to trouble (except if you do it very publicly and there's a full copy of paid apps that don't use any registration key type restriction in there).

Caveat: If any of this is useful for security research and will lead to people reporting security bugs to the app authors, some of them will probably react really badly and sue you for anything they can. Definitely run this by a lawyer and be very conservative in what you do if that is the case.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.