11

I work in embedded software, and for some reason, management wants to hide an Easter egg as means of IP protection. They call it a watermark, and since our software interact with the video preview feed (the image displayed on a screen before you take a photo), they want me to implement a trigger which will react to some unusual video input (a video konami code like dark - bright - dark - bright - whatever). When this trigger fires, something strange happens (which is outside of the normal behavior of the software).

The goal is to check whether our software is included in a device. Does it sound like a good idea? I have many argument against this move:

  • What if the konami code is too sensitive and user triggers it?
  • Does this kind of watermark have any legal value?
  • What if this "feature" is discovered by the client?
  • The performance penalty should be very small, since the soft run on small devices.
  • I am the one developping this trigger. If things go wrong, what is my responsibility?

What is your opinion about this method? I can't find a link, but I remember seeing an answer on this site suggesting that putting Easter eggs for protection purpose was a good idea. Has anyone tried it with good results?

Improve this question
1
  • On a similar situation, we made it so that when a specific QR code was presented to our software, it would display "Thank you for using our software! Lots of hugs from the folks at [Someplace Softworks!]". Worked pretty fine. We never actually tested devices on the wild for it, however, so creating it in the first place was kinda moot.
    – T. Sar
    Jun 6, 2022 at 13:31

4 Answers 4

Reset to default
8

There is at least one precedent, as described on the Wikipedia article on Easter eggs:

The CVAX microchip implementation of the MicroVAX cpu contained in its etchings the Russian phrase in the Cyrillic alphabet "VAX: When you care enough to steal the very best" in an effort to needle potential intellectual property-stealing clone manufacturers in the Soviet Bloc.

A little bit more detail on this, can be found on this article on CVAX (which is the reference to the above quote):

Finally, the scribe lane contained the Cyrillic motto "VAX: When you care enough to steal the very best". In 1983, an Unnamed Intelligence Agency had given me the wording, saying that they got it off a purloined VAX-11/780 that was running a Soviet SS20 missile complex. Knowing that some CVAX's would end up in the USSR, the team wanted the Russians to know that we were thinking of them.

As per your specific questions:

What if the konami code is too sensitive and user triggers it?

The Konami code is too well known, hence the possibility of a user triggering it is larger. If you go through with the Easter egg, you should choose an original (and larger) sequence. Since your Easter egg is supposed to be a protection mechanism instead of mindless fun, it'd be best if the sequence wasn't known outside of your company.

Does this kind of watermark have any legal value? I am the one developping this trigger. If things go wrong, what is my responsibility?

Consult a lawyer. It highly depends on your locale and the specifics of your contract. In any case, it'd be best to have some proof in written form that the management explicitly asked for the Easter egg. An exchange of emails where it's shown that you raised some concerns should be enough.

What if this "feature" is discovered by the client?

Depends on the client. Some might laugh, some might sue. My opinion is that since the Easter egg is included as means of IP protection, the client should be informed as for every other feature you build for him / her.

The performance penalty should be very small, since the soft run on small devices.

Yes it should, obviously. If you find out that implementing the Easter egg has a measurable performance penalty, that'd be the best reason to not do it.

I have no opinion either way. If you consult a lawyer and cover all your legal bases, go for it, it will probably be useless but you never know.

Update: The CVAX example is of course a hardware example, but I think there aren't any more relevant examples (for software and / or embedded software) that I know of. I've based the answer around it mostly to answer the Has anyone tried it part of the question. I've searched around for other examples, didn't found any and now I have something of an opinion:

It's probably not a very good idea. (not the Easter egg part, the means of IP protection part). Since the idea is neither original nor innovative (the contexts may be different but similar), if it worked there would be at least a few examples out there.

Improve this answer
3
  • Thank you for your answer. I had read about MicroVAX history, but the context is a bit different (hardware product). I agree with the necessity of informing the client.
    – Simon Bergot
    Nov 17, 2011 at 13:04
  • @Simon I thought you would have seen it, but based my answer on it to show that the most well known precedent happened a long time ago in a completely different context. If you don't manage to find more recent examples on software, that'd be something that you should consider passing on to management: It happened once a long time ago, no one else did it since then, probably because it's a bad idea. In my experience, when management comes up with such funky ideas, proving to them that their idea is neither original nor innovative may be the best excuse to not implement it.
    – yannis
    Nov 17, 2011 at 13:52
  • The difference is that it appears that the Russian motto was not a functional part of the chip, and hence didn't change behavior. I'd want to be careful with anything that could cause unpredictable (to the customer) output in an embedded device.
    – David Thornley
    Nov 17, 2011 at 14:29
0

If you were a vendor for a manufacturer, I would expect this to be disclosed as it is "outside of the normal behavior of the software".

If your client is the end user, it would depend on what the software does when the "code" is entered.

Improve this answer
1
  • We sell the software to an OEM. So we should be transparent about it.
    – Simon Bergot
    Nov 17, 2011 at 17:51
0

I see nothing wrong with an undisclosed easter egg as long as it extremely unlikely a user will run into it and if it is extremely subtle. If somebody were to stumble across it then they shouldn't view it as anything different than a subtle glitch or cosmetic trivial bug.

I have had managers argue with me for functionality that is far less ethical than an undisclosed easter egg, borderline malware stuff so I have trouble viewing this as an issue.

In one project I inherited I discovered a gigantic misleading C# class, named something to the effect, UIDataTableColumnRenderer that was over 3mb in size. I discovered an entire mini-game within that class, images and all base64 encoded into strings within the class. It was basically a shooter where the PC was a developer trying to shoot down a relentless onslaught of bugs and poorly written requirements that PM's and product owners were throwing at the software. It was kind of funny in that it kept getting harder and harder and you never win, eventually the bugs and poor requirements destroy the software and the PC loses his job.

It was by far the most stunning easter egg I have ever found.

Improve this answer
3
  • 3
    I wouldn't consider a 3mb easter egg on an embedded device harmless.
    – yannis
    Nov 17, 2011 at 14:32
  • 2
    @YannisRizos - This clearly was not on an embedded device, and if it was and had the ability to use C#, then 3MB class wasn't a huge concern.
    – Ramhound
    Nov 17, 2011 at 14:40
  • @Ramhound Yes, I know, but the question is in the context of embedded software.
    – yannis
    Nov 17, 2011 at 14:42
0

I am the one developping this trigger. If things go wrong, what is my responsibility?

They are not asking you to break the law. Your accountability is just to your employer. I would write a careful email stating any concerns you have so those are on the record. Then do you what your boss tells you or quit.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.