Ask HN: Fable hacked my piano, can I release the results?

Hacker News Discussion ↗

An owner of a self‑playing PianoDisc piano used an AI model to reverse‑engineer the company’s proprietary MP3/MIDI format, including its “decoy note” obfuscation, and now wants to publish an encoder/decoder. Commenters weigh potential legal risks around reverse engineering, DRM and terms of service in different jurisdictions against the practical reality that such protections are weak and easily bypassed with modern tools. Suggestions range from consulting a lawyer or limiting publication to technical write‑ups, to anonymously open‑sourcing the code and simply waiting for a cease‑and‑desist if the vendor objects.

Legal uncertainty & jurisdiction

  • OP is in the US; several comments stress that legality is highly jurisdiction-dependent and complex (copyright, DMCA, contracts).
  • Website ToS include a clause against circumventing “security features,” but some note this may govern only the website, not the hardware product.
  • Multiple people emphasize that anyone can sue over anything; the real question is risk tolerance, money, and time to defend.

DMCA, interoperability, and “effective technical measures”

  • Debate over whether “decoy notes” in the MIDI stream are an “effective technical measure” under the US DMCA:
    • One side: even weak schemes (checksums, CAPTCHAs) have sometimes been treated as effective; decoder might be risky, encoder less so.
    • Other side: dummy notes are mere obfuscation, not cryptography with a secret key; effectiveness is unclear and case law mixed.
  • EU/German concepts like interoperability exemptions and software decompilation rights are mentioned; details are considered complex and jurisdiction-specific.
  • In Australia, some argue reverse engineering for access/use is legal, but DMCA-like TPM rules and foreign hosting complicate things.

Ask permission vs. publish first

  • Many advise not contacting the company: they are unlikely to give explicit approval and may respond with refusal or legal threats.
  • Common suggested strategy: publish, wait for a cease-and-desist, and comply if you don’t want a fight.
  • Others warn this is cavalier: C&Ds, the cost of defending, and risk of escalation are non-trivial for individuals.

Anonymity, hosting, and opsec

  • Suggestions: anonymous GitHub accounts, non-US hosts, blockchain, Russian/Chinese Git for resilience.
  • Counterpoints: attribution may already be trivial due to the public HN thread, IP logs, AI provider records, and discovery/subpoenas; superficial pseudonymity is weak.
  • Some argue that if real legal risk exists, proper legal advice is safer than trying to hide.

AI’s role in reverse engineering

  • The LLM analyzed an MP3 with right-channel square-wave MIDI and inferred the encoding, including decoy notes.
  • Some think it likely reconstituted existing prior work from training data; others say modern models can extrapolate, not merely copy.
  • There’s concern that LLMs may inadvertently decompile proprietary code, “soiling” results vs. clean-room approaches.
  • Several note that with current LLMs, similar tools can be rebuilt easily from a descriptive post, reducing the value of withholding code.

Ethics, ownership, and business impact

  • Many see it as reasonable to control hardware you own and view the decoy-note scheme as unethical or pure gatekeeping.
  • Others caution that courts may interpret the project as an attempt to avoid paying for commercial content, which could matter more than technical details.
  • Some suggest evaluating how much the tool threatens the company’s main revenue and whether the fight is worth it given that LLM-based replication is now trivial.

Technical format discussion

  • The format: MP3 where the right channel is a ~2000 Hz square-wave–encoded MIDI stream driving the piano, left channel is audio accompaniment.
  • Commenters call this a “cursed” or legacy-style design and note that at least one independent encoder tool and prior reverse engineering already exist.