HowToLiveWorse

CHAPTER 11 · 19 SOURCE ENTRIES

Legal Boundaries for Developers

程序员和技术人容易踩的红线

[← 回总目录](../README.md) 本节口径是人身自由与金钱，换回的是「别被关」和「别赔钱」。写代码、做技术的人，常把下面这些事当成「只是技术问题」，可它们对应的是刑法里的具体罪名，或者民事上要赔的具体一笔钱。每条都给出法条里的数字，以及最高人民检察院、最高人民法院官网公布的案例。刑法引用的是北京市公安交管局转载的「根据刑法修正案（十一）修正」整合文本。条目顺序按「技术人最容易以为没事 × 后果最重」从高到低排。第 1 条是通用的一条，讲动手前怎么判断，以及出事之后先做什么。

Open this pinned source chapter ↗
11-001
Evidence CfreedomSource-sensitive

Ask three questions before taking any action: Whose interests might be harmed? How capable is the other party of pursuing legal action? And how much evidence do I have? If legal action is taken, immediately hire a criminal defense attorney.

动手前先问一句：厂商、平台、公司会不会去报案；被追究后马上找刑事律师

Before doing anything, ask whether the vendor, platform, or company will report the incident to police. Server logs, payment records, and chat logs are all easily obtained during an investigation. If you are criminally detained, authorities must decide within 37 days whether to formally arrest you. You may hire a lawyer from the very first interrogation onward; those 37 days are the most critical window for securing effective legal representation.

Open the low-ROI detour

Move “Ask three questions before taking any action: Whose interests might be harmed? How capable is the other party of pursuing legal action? And how much evidence do I have? If legal action is taken, immediately hire a criminal defense attorney.” to Future Me's calendar

One more exception feels free because the bill arrives outside the current scene.

Today I keep a few minutes, a bit of persistence and avoid interrupting my default routine.

Read the source and trade-off
11-002
Evidence AfreedomSource-sensitive

Refraining from creating or selling game cheats and aids, including AI tools that only capture screenshots without touching memory

不做、不卖游戏外挂和辅助，包括「只读屏幕不碰内存」的 AI 辅助，也不卖给微信这类软件加功能的改版

Selling to just 20 users or earning 5,000 yuan is enough to qualify as “serious circumstances,” leading to a sentence of up to three years. In especially serious cases the penalty ranges from three to seven years. One developer who created aim‑assist and wall‑hack cheats sold them over 80,000 times in three months, netting more than 30,000 yuan; he received a one‑year suspended sentence plus a 5,000‑yuan fine. Another individual obtained the game’s server code, ran a private server, and collected over 20 million yuan in payments; he was sentenced to four years in prison and fined up to 10 million yuan.

Open the low-ROI detour

Move “Refraining from creating or selling game cheats and aids, including AI tools that only capture screenshots without touching memory” to Future Me's calendar

I can spend longer deciding whether to start than the small action would take.

Today I keep a few minutes, a bit of persistence and avoid interrupting my default routine.

Read the source and trade-off
11-003
Evidence AfreedomSource-sensitive

Do not write or sell scripts for ticket snatching, flash sales, fake orders, or coupon farming — even if they merely “automate button clicks”

不写、不卖抢票、秒杀、刷单、薅羊毛脚本，哪怕只是「自动化点按钮」

Even if a script does not modify memory or bypass security measures and merely sends requests faster than a human can, it still qualifies as illegal acquisition of computer system data. The legal threshold is either earning over 5,000 yuan or causing at least 10,000 yuan in losses. One individual bought multiple 12306 accounts and used them to snatch over 200 train tickets, netting more than 20,000 yuan; he was sentenced to 1 year and 6 months in prison, suspended for the same period, plus a fine of 5,000 yuan. Another person sold ticket‑snatching software online and was found guilty of unfair competition, ordered to pay 20,000 yuan in damages.

Open the low-ROI detour

Move “Do not write or sell scripts for ticket snatching, flash sales, fake orders, or coupon farming — even if they merely “automate button clicks”” to Future Me's calendar

The routine already works until the day the source says it may not.

Today I keep a few minutes and avoid interrupting my default routine.

Read the source and trade-off
11-004
Evidence AfreedomSource-sensitive

The crawler only accesses publicly available pages that require no login; it does not attempt to bypass anti-scraping measures or handle any personal information, and any data it collects is never sold.

爬虫只爬无需登录的公开页面，不绕反爬、不碰个人信息，爬到的数据不卖

Any data that requires a login, a token, or signature decryption to access falls under bypassing protective measures; violations are punishable by up to 3 years in prison, or 3 to 7 years in more serious cases. Collecting personal information brings even heavier penalties. Possessing 50 or more records related to personal movement, communications, credit history, or financial information is already considered a serious offense. The same applies if you collect 500 or more records on accommodation, health, or transaction details, 5000 or more records of other types, or earn 5000 yuan or more from such activities.

Open the low-ROI detour

Move “The crawler only accesses publicly available pages that require no login; it does not attempt to bypass anti-scraping measures or handle any personal information, and any data it collects is never sold.” to Future Me's calendar

There is no immediate alarm, so the sensible choice can wait for a less busy week.

Today I keep a few minutes, a bit of persistence and avoid interrupting my default routine.

Read the source and trade-off
11-005
Evidence AfreedomSource-sensitive

Refuse development orders for gambling, fraud, or adult-content apps; do not set up payment gateways or unblock accounts for such “clients”

不接赌博、诈骗、色情 App 的开发单，不替「客户」搭支付通道、解封账号

Taking on such high-paying yet poorly defined projects means you could be treated as an accomplice in gambling crimes, facing charges under the crime of operating illegal gambling dens: up to 5 years in prison, or 5–10 years for serious cases. This is not the “merely helping out, maximum 3 years” category. In one e-sports betting app case, 28 developers in Hainan were sentenced to 1–3 years and 6 months for operating illegal gambling dens. Those who unblocked QQ accounts for fraud rings received 1 year and 6 months in prison plus a 20,000-yuan fine.

Open the low-ROI detour

Move “Refuse development orders for gambling, fraud, or adult-content apps; do not set up payment gateways or unblock accounts for such “clients”” to Future Me's calendar

Future Me has a clearer calendar, more patience, and apparently the same responsibilities.

Today I keep a few minutes, a bit of persistence and avoid interrupting my default routine.

Read the source and trade-off
11-006
Evidence AfreedomSource-sensitive

Upon leaving a job, return all account access rights; do not delete databases, leave backdoors, or alter password protection systems — even if the employer owes you wages.

离职时交清账号权限，不删库、不留后门、不改密码锁系统，哪怕公司欠你钱

Account credentials are issued by the employer, but they do not remain valid after you leave the job. Logging in using those credentials constitutes illegal control of computer systems, punishable by up to 3 years in prison. Deleting data to render the system inoperable is punishable by up to 5 years in prison; more severe cases incur sentences exceeding 5 years. One example: a dismissed senior engineer logged into his former employer’s servers using his original admin credentials, deleted data and logs, resulting in over 120,000 yuan in losses. He was sentenced to 3 years in prison, suspended for 5 years, and fined 30,000 yuan.

Open the low-ROI detour

Move “Upon leaving a job, return all account access rights; do not delete databases, leave backdoors, or alter password protection systems — even if the employer owes you wages.” to Future Me's calendar

If I do not open the notes, no new task has technically appeared.

Today I keep a few minutes, a bit of persistence and avoid interrupting my default routine.

Read the source and trade-off
11-007
Evidence AfreedomSource-sensitive

Do not take source code, client lists, or technical documents upon leaving; do not upload them to personal cloud drives or reuse them at new employers

离职不带走源码、客户名单和技术文档，不上传个人网盘，不在下家复用

Even code written by you personally remains the company’s intellectual property — taking it away is essentially stealing company assets. Client lists also qualify as trade secrets. In one case, a former employee who took source code and core algorithms of a security inspection system to a new employer was sentenced to 5 years in prison and fined 500,000 yuan; the new employer was fined 4 million yuan. Another individual who exploited system vulnerabilities to download over 33,000 design files was sentenced to 1 year and 10 months in prison and fined 100,000 yuan. Beyond criminal penalties, companies can also pursue separate civil compensation claims.

Open the low-ROI detour

Move “Do not take source code, client lists, or technical documents upon leaving; do not upload them to personal cloud drives or reuse them at new employers” to Future Me's calendar

One more exception feels free because the bill arrives outside the current scene.

Today I keep a few minutes, a bit of persistence and avoid interrupting my default routine.

Read the source and trade-off
11-008
Evidence AfreedomSource-sensitive

Do not run your own programs on others’ computers, servers, or cameras; do not use company machines for mining

不在别人的电脑、服务器、摄像头上跑自己的程序，公司机器不拿来挖矿

Controlling someone else’s computer, server, or camera without permission is illegal. Operating 20 or more such devices qualifies as a serious offense, punishable by up to 3 years in prison; especially severe cases may incur 3 to 7 years. Even if it does not rise to a criminal offense, offenders can still be detained for up to 5 days and fined between 50,000 and 500,000 yuan. For tech professionals, the most damaging consequence is a lifelong ban from holding key positions in cybersecurity management and network operations after any criminal conviction.

Open the low-ROI detour

Move “Do not run your own programs on others’ computers, servers, or cameras; do not use company machines for mining” to Future Me's calendar

I can spend longer deciding whether to start than the small action would take.

Today I keep a few minutes and avoid interrupting my default routine.

Read the source and trade-off
11-009
Evidence AfreedomSource-sensitive

Testing someone else’s systems without written permission — “good intentions” and “reporting afterward” are not excuses

没有书面授权不测别人的系统，「出于好意」和「事后上报」都不是出罪理由

Whether a crime is established depends solely on whether you had permission and how much access you obtained — not on your intentions. Possessing 500 sets of ordinary account credentials, or earning 5,000 yuan while causing 10,000 yuan in losses, is enough to warrant a sentence of up to three years. Even a single attempt to export a user list to prove a vulnerability often exceeds that 500‑credential threshold. Using credentials you already possess outside their authorized scope also constitutes unauthorized access.

Open the low-ROI detour

Move “Testing someone else’s systems without written permission — “good intentions” and “reporting afterward” are not excuses” to Future Me's calendar

The routine already works until the day the source says it may not.

Today I keep a few minutes, a bit of persistence and avoid interrupting my default routine.

Read the source and trade-off
11-010
Evidence AfreedomSource-sensitive

Vulnerabilities must be reported per regulations; no details, exploit tools, or disclosure to foreign entities before patching

漏洞按规定报送，修补前不公开细节、不发利用工具、不交给境外

The “Regulations on the Management of Security Vulnerabilities in Network Products” applies not only to companies but also to individuals. There are five strict rules for vulnerability disclosure; the first two state that no details about vulnerabilities affecting active systems may be released before a vendor provides a fix. Additionally, no programs or tools specifically designed to exploit those vulnerabilities may be published, and any release must include instructions on how to remediate them. One often-overlooked rule: unreported vulnerabilities must not be shared with any foreign organizations or individuals outside the vendor.

Open the low-ROI detour

Move “Vulnerabilities must be reported per regulations; no details, exploit tools, or disclosure to foreign entities before patching” to Future Me's calendar

There is no immediate alarm, so the sensible choice can wait for a less busy week.

Today I keep a few minutes and avoid interrupting my default routine.

Read the source and trade-off
11-011
Evidence BfreedomSource-sensitive

No selling of tools for bypassing firewalls or VPN accounts, no setting up such nodes for others

不卖翻墙工具、VPN 账号，不替人搭这类节点

Any individual or entity that builds their own outbound network connections or uses international channels outside of state-provided public telecom services may be ordered by police to cease internet access, receive a warning, and face fines up to 15,000 yuan plus confiscation of any illegal earnings. Those running businesses based on such services may be charged with illegal business operations; in severe cases, imprisonment of up to five years applies. This rule specifically addresses selling or setting up such nodes. For personal use only, the maximum penalty remains limited to a warning and fine as stipulated in Article 14 of the provisional regulations.

Open the low-ROI detour

Move “No selling of tools for bypassing firewalls or VPN accounts, no setting up such nodes for others” to Future Me's calendar

Future Me has a clearer calendar, more patience, and apparently the same responsibilities.

Today I keep a few minutes and avoid interrupting my default routine.

Read the source and trade-off
11-012
Evidence AmoneySource-sensitive

After signing a non-compete agreement, if the employer fails to pay compensation monthly, send a written notice; if payment still doesn’t come after 3 months, you may terminate the agreement. Workers who never handled any trade secrets can request that the clause be declared invalid.

签了竞业协议，离职后公司不按月给补偿就书面催告，满 3 个月没给可以解除；没接触过商业秘密的岗位可请求确认条款不生效

A non-compete clause simply means you’re not allowed to work for a competitor for a certain period after leaving your job. This rule is there to protect you. The maximum duration is 2 years, and the employer must pay compensation every month. If the amount isn’t specified, it’s calculated as 30% of your average monthly wage over the previous 12 months, and it can’t be lower than the local minimum wage. If the employer fails to pay for 3 months due to its own reasons, you can ask to end the agreement. Starting in 2025, workers who never learned about or handled any trade secrets at their job can request that the non-compete clause be ruled invalid.

Open the low-ROI detour

Move “After signing a non-compete agreement, if the employer fails to pay compensation monthly, send a written notice; if payment still doesn’t come after 3 months, you may terminate the agreement. Workers who never handled any trade secrets can request that the clause be declared invalid.” to Future Me's calendar

If I do not open the notes, no new task has technically appeared.

Today I keep a few minutes and avoid interrupting my default routine.

Read the source and trade-off
11-013
Evidence AmoneySource-sensitive

Code written during work hours using company resources belongs to the company; personal open‑source projects should be done in your own time and on your own equipment, without mixing them.

上班时间、用公司资源写的代码归公司，自己的开源项目用自己的时间和设备做，不混公司代码

Work‑related creations are defined as works made in the course of your duties. Software is explicitly listed in law as “copyright belonging to the employer.” If a program is primarily produced using company hardware, internal networks, or business data — and the company assumes responsibility for it — then the copyright rests with the employer. The same applies when the contract states this. As the creator, you retain only the right to be credited. Inventions developed using company resources also belong to the company, with patent rights following the same rule. Even if you write code “after hours,” using a company computer or business data can still make it qualify as a work created mainly with employer resources.

Open the low-ROI detour

Move “Code written during work hours using company resources belongs to the company; personal open‑source projects should be done in your own time and on your own equipment, without mixing them.” to Future Me's calendar

One more exception feels free because the bill arrives outside the current scene.

Today I keep a few minutes, a bit of persistence and avoid interrupting my default routine.

Read the source and trade-off
11-014
Evidence BmoneySource-sensitive

Using open-source code such as GPL in products: Open-source it per the license or switch licenses — don’t treat this as “no one cares”

用 GPL 等开源代码做产品，按许可证要求开源或换许可证，不当「没人管」

Copyright infringement requires you to compensate the copyright holder based on their actual losses or the profits you earned from the infringement. If you commit infringement intentionally and under aggravating circumstances, you may be ordered to pay damages ranging from 1 to 5 times the original amount. One company hired a former employee of a competitor and developed software that was substantially similar to the competitor’s product. The company argued that since the competitor’s software used GPLv2, it was required to be open-source anyway. The Supreme People’s Court ruled that whether a developer complies with GPLv2 or not has no bearing on their copyright rights, and ordered the company to cease infringement and pay 500,000 yuan in damages.

Open the low-ROI detour

Move “Using open-source code such as GPL in products: Open-source it per the license or switch licenses — don’t treat this as “no one cares”” to Future Me's calendar

I can spend longer deciding whether to start than the small action would take.

Today I keep a few minutes, a bit of persistence and avoid interrupting my default routine.

Read the source and trade-off
11-015
Evidence BfreedomSource-sensitive

Only collect personal data strictly necessary for the app’s operation; consent from guardians is required for users under 14, and the privacy policy must be clearly written.

做 App 只收业务必需的个人信息，14 岁以下要监护人同意，隐私政策写清楚

Only gather information that is genuinely needed for business purposes, and obtain consent from a guardian for any user under 14. For violations, regulators first order corrections and issue warnings, and may also confiscate illegal earnings; the app can be ordered to suspend or terminate its services. If the violation persists, fines up to 1 million RMB can be imposed on the app, while individuals directly responsible may be fined between 10,000 and 100,000 RMB. In severe cases, fines can reach 50 million RMB or 5 % of the previous year’s revenue, and responsible personnel may face fines from 100,000 to 1 million RMB. The term “directly responsible personnel” can include the technical and product staff who actually implement the app.

Open the low-ROI detour

Move “Only collect personal data strictly necessary for the app’s operation; consent from guardians is required for users under 14, and the privacy policy must be clearly written.” to Future Me's calendar

The routine already works until the day the source says it may not.

Today I keep a few minutes, a bit of persistence and avoid interrupting my default routine.

Read the source and trade-off
11-016
Evidence AfreedomSource-sensitive

Before launching a website or app, complete ICP registration and retain logs for at least 6 months per classification protection requirements

网站、App 上线前先做 ICP 备案，按等级保护要求留 6 个月以上日志

ICP registration costs nothing, and the cloud provider’s process takes a few weeks. Domestic servers without registration will be shut down. Providers that claim registration is free but charge fees face fines ranging from 100,000 to 1,000,000 yuan. You must retain logs for at least 6 months; failure to comply or causing any consequences results in fines of 10,000 to 100,000 yuan.

Open the low-ROI detour

Move “Before launching a website or app, complete ICP registration and retain logs for at least 6 months per classification protection requirements” to Future Me's calendar

There is no immediate alarm, so the sensible choice can wait for a less busy week.

Today I keep a little money, a few minutes and avoid interrupting my default routine.

Read the source and trade-off
11-017
Evidence BfreedomSource-sensitive

Before offering generative AI services to the public, conduct required safety assessments and algorithm registration; mark all generated content

对公众提供生成式 AI 服务前先按规定做安全评估和算法备案，生成内容加标识

If you offer generative AI services with public influence or social mobilization potential to the general public, you must perform a safety assessment and register the algorithm per national regulations before launch. Any changes or shutdowns also require filing updates or cancellation paperwork. All generated images and videos must be clearly marked. Tools meant solely for personal use and not open to the public are exempt from these requirements. The regulation itself does not specify penalties; violations are handled under the Cybersecurity Law, Data Security Law, and Personal Information Protection Law.

Open the low-ROI detour

Move “Before offering generative AI services to the public, conduct required safety assessments and algorithm registration; mark all generated content” to Future Me's calendar

Future Me has a clearer calendar, more patience, and apparently the same responsibilities.

Today I keep a few minutes and avoid interrupting my default routine.

Read the source and trade-off
11-018
Evidence AmoneySource-sensitive

Do not build or distribute tools that skip or block another app's advertisements

不做、不发自动跳过或屏蔽别家 App 广告的工具，免费、不联网也可能被判不正当竞争

Chinese courts have treated some ad-skipping or ad-blocking tools as unfair competition, including cases involving unpaid tools and monetary damages.

Open the low-ROI detour

Move “Do not build or distribute tools that skip or block another app's advertisements” to Future Me's calendar

If I do not open the notes, no new task has technically appeared.

Today I keep a few minutes, a bit of persistence and avoid interrupting my default routine.

Read the source and trade-off
11-019
Evidence CfreedomSource-sensitive

Do not resell overseas AI model access through an unlicensed proxy service

不搭「AI 中转站」低价转卖境外大模型接口：上海已有站长被刑事拘留

The source describes a Shanghai operator detained for 37 days in connection with an AI proxy service and reports national security warnings about unlicensed services and user data.

Open the low-ROI detour

Move “Do not resell overseas AI model access through an unlicensed proxy service” to Future Me's calendar

One more exception feels free because the bill arrives outside the current scene.

Today I keep a few minutes, a bit of persistence and avoid interrupting my default routine.

Read the source and trade-off

Source snapshot: a994b6a0c90598b0fe15cb837343f438dbf7b95d. Every original stays available in Chinese alongside the English edition.