Ask HN: Fable hacked my piano, can I release the results?
A tinkerer's AI sidekick unravels the proprietary secrets of a self-playing piano, exposing "decoy notes" and archaic encoding. The real performance starts now: should he release the decoder and risk a legal concerto, or let the company keep its sonic lock-in? HN tunes in, offering a cacophony of legal advice and rebellious urges.
The Lowdown
A self-playing piano owner, curious about using AI to create custom music files, tasked an LLM (Fable, with Astra for critique) to analyze the proprietary music format of their PianoDisc Protigy system. What began as an exploration into nuanced musical interpretation quickly escalated into a full-blown reverse-engineering project, uncovering surprising layers of vendor lock-in.
- The user initially used Fable to generate and refine a version of Erik Satie's "Gymnopedie No. 1," which Fable then critically compared to both open-source and PianoDisc's commercial versions.
- Fable identified that PianoDisc's MP3s are a hybrid format: the right audio channel carries MIDI data (encoded with a 2004.5 Hz square wave), while the left carries accompanying music.
- Crucially, Fable discovered "decoy notes" within the MIDI stream, an obfuscation technique designed to prevent naive extraction and playback on other systems, but handled by PianoDisc's own software.
- The LLM then proceeded to build both an encoder that inserts these decoy notes and a decoder to remove them, effectively bypassing the system's proprietary protections.
The central question is whether the user is legally permitted to publish these newly created tools, highlighting the ongoing battle between consumer ownership and proprietary control, especially as AI democratizes complex reverse engineering. The legal implications of sharing such tools, particularly under acts like the DMCA, remain a contentious and fascinating area of discussion.
The Gossip
Legal Labyrinth & DMCA Dilemmas
Commenters extensively debated the legality of publishing the decoder, focusing heavily on the Digital Millennium Copyright Act (DMCA) in the US and the Digital Markets Act (DMA) in Europe. Key questions revolved around whether "decoy notes" constitute an "effective technical measure" under DMCA, making circumvention illegal. Some argued that reverse engineering for interoperability is protected in certain jurisdictions (like the EU's Software Directive), while others warned about the broad scope of US legal action and the high cost of defending against lawsuits, regardless of merit. There was also discussion about what constitutes a "security feature" in a ToS.
Forgiveness Over Formalities (or FAFO)
A dominant sentiment was the "better to ask for forgiveness than permission" adage. Many urged the original poster (OP) to simply publish the code without contacting the company, suggesting that a cease and desist (C&D) would be the likely, and often only, corporate response. There was cynicism about companies ever granting permission and practical advice on why C&D letters are often empty threats due to the cost-benefit of full litigation. Counterarguments warned that such an approach is risky when dealing with laws, not just corporate etiquette.
AI's Analytical Acumen
The role of AI (Fable) in this reverse engineering feat sparked curiosity and skepticism. Commenters questioned whether the LLM truly "figured out" the encoding and "decoy notes" from scratch or if it merely regurgitated information from its training data, given that similar reverse-engineering efforts for PianoDisc exist online. There was debate on the veracity of the "decoy notes" claim itself, with some suggesting it might be an LLM "hallucination." The broader implication of AI making complex reverse engineering trivial was also noted.
Strategic Sharing & Anonymity
Given the legal uncertainties, a significant portion of the discussion focused on practical strategies for publishing the code or methodology while minimizing personal risk. Suggestions ranged from releasing the code anonymously on GitHub, using non-US hosting providers (like Gitee), or having an AI "accidentally" publish it. Others suggested publishing only the technical methodology or prompts, not the code itself, as a way to inform the public without direct legal liability. The possibility of AI companies being subpoenaed for user data was also raised.