[Somehuman/Simpla-keygen-ugly] Unknown legal status (copyrighted source leak?) #172

ReportingTest commented 2020年04月26日 17:01:53 +02:00

Somehuman/Simpla-keygen-ugly appears to be key generator stolen from Simpla CMS (http://simplacommerce.com, http://simplacms.ru). This keygen is available on http://license.simplacommerce.com. It also has corrupted encoding.

Simpla CMS copyright status is unknown. It was clearly non-free software, but few days ago blog posts appeared both on Simpla website and on its author blog, saying it is dedicated in public domain or CC0 if impossible.

These posts are now gone. CMS author did not say anything on it but he closed an issue about DRM removal due to public domain dedication on GitHub. Other people say someone attacked the website and Simpla remains non-free.

I'm not sure about legal status of this keygen and Simpla CMS, but its encoding is corrupted. I have non-corrupted copy if required. There is also keygen which most likely doesn't contain original code, but keys are useless without Simpla CMS.

Should we remove this repository from Codeberg?

Somehuman/Simpla-keygen-ugly appears to be key generator stolen from Simpla CMS (http://simplacommerce.com, http://simplacms.ru). This keygen is available on http://license.simplacommerce.com. It also has corrupted encoding. Simpla CMS copyright status is unknown. It was clearly non-free software, but few days ago blog posts appeared both on Simpla website and on its author blog, saying it is dedicated in public domain or CC0 if impossible. These posts are now gone. CMS author did not say anything on it but he closed an issue about DRM removal due to public domain dedication on GitHub. Other people say someone attacked the website and Simpla remains non-free. I'm not sure about legal status of this keygen and Simpla CMS, but its encoding is corrupted. I have non-corrupted copy if required. There is also keygen which most likely doesn't contain original code, but keys are useless without Simpla CMS. Should we remove this repository from Codeberg?

hw commented 2020年04月27日 21:16:28 +02:00

user+repo deactivated for the time being.

Thank you for reporting.

user+repo deactivated for the time being. Thank you for reporting.

ReportingTest commented 2020年04月28日 17:29:04 +02:00

Looks like Simpla is WTFPL Version 2 at the moment (note version number was not changed). It is archived in Wayback Machine but link is currently broken (may work in future).

Old EULA is still present on website, but you can bypass it by using this link.

Not sure whether it is actually available under this license or website is attacked once again, but license checks are removed from this code.

English version (2.3.7) is not [yet] available under WTFPL but IIUC it is outdated version with Russian strings replaced with English ones (something is still in Russian).

It looks like both their website and author's blog are still vulnerable to attacks.

Is Simpla free or no? Will it become free in license replacement attack case?

Looks like Simpla is WTFPL Version 2 at the moment (note version number was not changed). It is archived in Wayback Machine but link is currently broken (may work in future). Old EULA is still present on website, but you can bypass it by using [this](http://simplacms.ru/downloads/simpla.zip) link. Not sure whether it is actually available under this license or website is attacked once again, but license checks are removed from this code. English version (2.3.7) is not [yet] available under WTFPL but IIUC it is outdated version with Russian strings replaced with English ones (something is still in Russian). It looks like both their website and author's blog are still vulnerable to attacks. Is Simpla free or no? Will it become free in license replacement attack case?

hw commented 2020年05月01日 16:53:15 +02:00

If the author intends to publish it we are happy to reactivate account+repo.

If the author intends to publish it we are happy to reactivate account+repo.

ReportingTest commented 2020年05月03日 13:02:57 +02:00

Looks like another attack on them. Old EULA is present again.

Most likely, this software is dead and author does not intend to publish it. There is also active plagiarized CMS with similar key generation algorithm (minor changes made).

Author's email address is pikusov@gmail.com if you wish to contact him.

Fortunately, software like OpenCart is much better than Simpla CMS.

Looks like another attack on them. Old EULA is present again. Most likely, this software is dead and author does not intend to publish it. There is also active plagiarized CMS with similar key generation algorithm (minor changes made). Author's email address is [pikusov@gmail.com](mailto:pikusov@gmail.com) if you wish to contact him. Fortunately, software like OpenCart is much better than Simpla CMS.