OSNews

part 2 of the deleted mail:

One of the first big problems which arised recently was the fact that I
"make developers leave, or not join at all". After XXXXX and I
publically asked if this was true, only two developers came forward,
when I begged and asked for -everyone- that felt that way to email me.
Their main concern was my development practice. Apparently, I spent a
great deal of time reverse engineering isntead of clean-room
implementing. I took this moderately seriously... only two of them felt
this way, and nobody else made a clear stand about it. Confused about
what to do, I went to talk to XXXXX. This was his response:[16:35] Alex_Ionescu> my point is SO many devs reverse
[16:35] Alex_Ionescu> and im the ONLY honest one stupid enough
[16:35] Alex_Ionescu to admit it once in a while
[16:35] XXXXX> yes thats the probelm
[16:35] Alex_Ionescu> and i get flamed
[16:35] Alex_Ionescu> so f--k, ill lie too!
[16:35] XXXXX> yes
[16:35] XXXXX> please do
[16:35] Alex_Ionescu> IDA? what's that?
[16:36] XXXXX> now your starting to get the idea =)
[16:36] XXXXX> Like I said I don't care who has seen the Windows code
or even learned from it
[16:36] XXXXX> its just a matter of what we publicly admit
"

So this was the guidance of my mentor, of our XXXXX. "I don't care who
has seen the Windows code or even learned from it".
"its just a matter of what we publicly admit". "Yes. Please do [lie
about reversing]."

I said to myself, well hell! The two people that complained publically
were XXXXX and XXXXX. And XXXXX just told me that he doesn't care about
reverse engineering, and that he doesn't even care about "seeing the
Windows code". So this meant the only person that still actively
actually cared was XXXXX. 1 developer is not enough to change my
development methods. I continued writing and developing code the same
way as before, with or XXXXX blessing. And why should I fear my
practice? Almost everyone else was doing it too. And of course XXXXX did
not care who saw the Windows code. He downloaded it from XXXXX (XXXXX)'s
FTP site, which had gotten it from me. Yes, that's right, both XXXXX,
XXXXX and I had access and posession of illegal, Microsoft owned IP
which could land us in jail. And none of us said or did anything against
it. Quite the contrary, XXXXX even pointed me to a deep hidden email
written by Raymond Chen about MSFTP bugs. Likewise, I joked with XXXXX
about funny comments in some win32 DLL source code which I knew I would
never implement. XXXXX then told me he was interested about looking at
the DCOM source code, document it, and then help WINE out with it, all
while taking a 6 month leave to do so. In the end, he realized that
doing this was wrong, and he deleted his copy. I did the same. I do not
think that nor XXXXX nor I did anything wrong: he only gleaned through
some files and quite probably did not learn anything useful, and the
only code I looked at were some libraries which I do not touch:
setupapi, ole32, and ntdetect.com. As for XXXXX, last I know he
attempted to get the NT4 source compiling, a feat which I had tried as
well. So back to our story, I thought, why worry about my reverse
engineering? Some of us have done much worse.

But is that all we've done? Nope, it doesn't stop there. Another reason
I kept reverse engineering is because others were doing it too. For a
period of time, almost every day, I would spend time teaching XXXXX how
to read optimized assembly. Things like inlined memcmp and memsets. I
sent him IDA databases for gdi32 and win32k.sys, and he directly
translated the assembly code into C functions that he would then commit.
Legally, he was acting according to XXXXX law, which allows him to do
so. ROS-legally, he was violating our policy as much as I was, and as
much as XXXXX and XXXXX were/had. He told me that to help him, XXXXX
(XXXXX) was also doing the same, and that he would share my IDA
databases with him.

But he was not the only one. A few days later, XXXXX entered the channel
and complained about how much one of XXXXX new Vista API implementations
really sucked and was completely wrong, because "it was not reversed and
just guessed". XXXXX boasted in #reactos about how he took a long
evening to look at the Vista implementation in IDA, and re-wrote the
entire function to match the Vista code. (He did a good job, btw). There
went another huge violation, this time possibly not only ROS-related. By
reverse engineering Vista code and implementing those APIs, the damage
done to ROS is much greater, since Vista is usually under NDA at the
moment, and those new functions are very well protected by Microsoft,
since they do not want other peopel to implement them or release them in
3rd party software before they release Vista. This is the whole point of
Beta NDAs: to make sure nobody takes/copyrights/patents an idea/API
first. And by reversing a Vista API, we violated that.