5 ms·
This is incredible: they're suggesting that, in the same way that YouTube has content moderators, GitHub should moderate every repository that has a 9-digit seq
by btown 7y ago
This is incredible: they're suggesting that, in the same way that YouTube has content moderators, GitHub should moderate every repository that has a 9-digit sequence. They also say that GitHub "promotes hacking" without any nuance regarding modern usage of the word, and they claim that GitHub had a "duty" to put processes in place to monitor submitted content, and that by not having such processes they were in violation of their own terms of service.
I hope that this gets thrown out. If not, it could have severe consequences for any site hosting user-generated content.
- realusername 7y ago> This is incredible: they're suggesting that, in the same way that YouTube has content moderators, GitHub should moderate every repository that has a 9-digit sequence Youtube does not manually moderate content either, they just have some automated bots for their contentid and I would argue that's not working very well. I don't see how Github would imitate that, surely the companies which are not on Github don't want to send their secrets to them to check if it's there, it makes no sense.
- ma2rten 7y agoThis is not true. ContentId filters copyrighted content. YouTube also moderates content and demonetizes video with certain content. I am pretty sure at least part of that must be done manually.
- realusername 7y agoYou also have automated filters to some extent. Anything featuring 9-11 towers crash for example is automatically demonetized and hidden from the suggestions regardless of the context.
- killjoywashere 7y agoYoutube has content moderators https://www.theverge.com/2018/3/13/17117554/youtube-content-moderators-limit-four-hours-sxsw https://www.theverge.com/2018/3/13/17117554/youtube-content-... And, if anything, github is almost all text, and most of the interesting stuff is structured. That should be relatively straightforward compared to raw video and freetext on Youtube.
- realusername 7y agoI'm aware of those but realistically, what's the percentage of youtube videos really reviewed by moderators? I'd put it in the single digit percentage in the best case scenario. To me it's more a legal excuse of "we are doing something" than actually impacting videos.
- killjoywashere 7y agoWhat fraction of videos are actually problematic? What if it's one in a thousand, and they're reviewing 10x over that? I mean, they also have $120B in the bank. If they thought more reviewers would fix things, I'm pretty sure they'd get more reviewers.
- Godel_unicode 7y agoThose numbers only matter if you're very good at finding the problematic videos via some automatic means. You are vastly underestimating the size of the problem. See also: https://en.m.wikipedia.org/wiki/Base_rate_fallacy https://en.m.wikipedia.org/wiki/Base_rate_fallacy
- killjoywashere 7y agoHow do you know I'm vastly underestimating the size of the problem? Do you have a source? Random sampling from the ingest stream sounds like a good start for your base rate. Once you have some metadata about bad actors, you can also start hunting their videos and compare your random sample collection stream to the ever-improving bad-actor collection stream.
- Godel_unicode 7y agoTo be clear, "size" here refers not to the volume of undesirable content, but rather to the total volume of videos submitted to YouTube. In order to use automatic classification, one needs to examine every new video submitted. YouTube gets (last I heard) double-digit hours of video submitted per second. You have to scan an appreciable portion of the video to determine if it's objectionable. Edit: the common suggestion that you can just ban the few bad actors effectively ignores decades of research into spam detection. Accounts are too easy to create, you have to go after content.
- jimmaswell 7y agoBots being right 99.999% of the time and .0001% of cases having to be reviewed manually is much more practical than hiring an inordinate amount of manual viewers
- 314 7y agoThis assumes that you know which .0001% the bot labeled incorrectly. To do that you would need to be able to label everything correctly, i.e. you would also need a perfect bot. More realistically you would need to sample much more than 0.001% of the input to find the part that is wrong.
- jimmaswell 7y agoIncorrect results are brought to attention with an appeals process by the uploader, then reviewed manually (in some cases, else might just be black holed by google)
- umeshunni 7y agoI think the general direction we're moving in is towards a world where freemium and advertising supported services will be phased out and walled gardens are all that will remain on what was once a free web.
- IfOnlyYouKnew 7y agoNah... We're going towards a silly lawsuit being thrown out.
- gesman 7y agoIt's a typical "how much we can pull to settle" lawsuit.
- danso 7y agoTangentially, this reminds me of Github's (very useful) feature that auto-notifies you when your Gemfile contains a gem known to have security vulnerabilities. Maybe someone will someday sue Github for not forcing a repo owner to fix a vuln, thereby causing people to unwittingly clone and use the codebase in production.
- gruez 7y agoDon't most OSS licenses have a "no warranties" clause that protects the author against this? I'm sure that github also has a clause in their ToS saying they make no warranties about the code posted to their platform.
- ma2rten 7y agoThere are probably several orders of magnitude less github repos than videos on youtube (almost anyone can record a video, few people know how to use git). It's also easier to review source code/text files than videos where you'd have to watch every frame. I am not saying that github should be liable for content, but it just goes to show how hard of a problem this is.
- elliekelly 7y agoGitHub is a touch more difficult I’d think though. How can GitHub monitor for things like credit card numbers, addresses and SSN (as the complaint alleges they were obligated) when there are legitimate reasons for a repo to have completely benign seed data belonging to no one that would constantly trip those “filters.” Even if GitHub were alerted to the data they would have no way of knowing whether they’ve identified criminal activity or practice data.
- ma2rten 7y agoI don't know. I would imagine that if a github employee came across a repository with realistic-looking data from millions of people I am guessing they would probably suspend the account.
- Spivak 7y agoI wouldn't say this is a solved problem, but there is a lot of prior art in this space. They're a little more sophisticated than grepping for a nine digit number. Identity Finder, Varonis, CPUSpider, GroundLabs, StealthBITS
- mushufasa 7y agoThis is not a new battle. Essentially the same legal arguments justified the MegaVideo takedown, where the MPAA convinced US military to invade their servers/HQ in New Zealand -- a legal battle that is still ongoing. When something goes wrong, shoot the messenger. You can always claim they should have done more. But I have faith in the legal team from Microsoft. Capital One though...
- azernik 7y ago"Convinced the US military"?? They filed a request for extradition, and local police arrested him.
- ma2rten 7y agoI don't think it's exactly same. The MegaVideo case was about copyright. That is normally protected by DMCA, but they have some proof that MegaVideo employees uploaded copyrighted material themselves. This case, on the hand, is not about copyright but privacy sensitive data.
- tzs 7y agoDo you mean Megaupload? If so, it isn't essentially the same thing at all. Megaupload was deliberately hosting content without permission of the copyright holders, pretending to remove it when notified but actually just invalidating the particular URLs that the copyright holders knew about but keeping the material available at different URLs. Their business model was to be a piracy site. If you can find a copy of the original Megaupload indictment, it includes several emails between Kim Dotcom and other top Megaupload people that lay this all out.
- ben_jones 7y agoHow difficult would it be to gather all the software engineers who are Capital One customers and use Github, than have everyone cancel their account? It's not like their product is particularly unique.
- dharmab 7y agoReminds me of the time our security team tried to add a hook preventing any high-entropy strings from being pushed to git. It lasted half a day, since they forgot about public keys, UUIDs, hex codes...
- daveFNbuck 7y agoI've added a few hooks to try to improve code quality over the years. I can't imagine doing that without first running it over the whole repo to make sure it wasn't flagging good code and cleaning up any legitimate bad code that was caught.
- dharmab 7y agoOur code quality checks run as a CI make target instead of a hook. We then have our repo set up to disallow direct push- everything has to go through a PR and therefore CI.
- daveFNbuck 7y agoEither way, it's important to validate the checks on existing code before making them a blocker.
- dharmab 7y agoYes, which is why I like the make target method. You can make the target apply to new files exclusively at first, then incrementally add old files as they are touched in the course of normal work.
- zdragnar 7y agoMaybe it's because it's late and I'm tired, but I'm really struggling to come up with a plausible security reason to prevent high-entropy strings from going into version control. Do you recall what the rationale was?
- 7y ago
- gitgud 7y agoGoogle already monitors Github repositories and notify's if a Firebase configuration file was accidentally committed. The same could be done for credit cards, passwords etc, not sure it's Github's responsibility though...
- snek 7y agoActually, github monitors for that. They discuss it a bit at https://help.github.com/en/articles/about-token-scanning https://help.github.com/en/articles/about-token-scanning, although the list of companies is a bit outdated.
- gruez 7y ago>GitHub should moderate every repository that has a 9-digit sequence and this is assuming it even works, which it won't. It's a cat and mouse game. Once they start to monitor repos for 9 digit sequences, hackers would base64 encode their payload. Once github adds automatic base64 decoding, people would encrypt the payload.
- markovbot 7y agoTry explaining that to the lawyer who filed this.
- Spivak 7y ago> GitHub should moderate every repository that has a 9-digit sequence. I mean when I worked in med and edu tech this was very literally our mandate -- we had to scan every ounce of internal data looking for PII with tools of widely varying quality and scrub what we found. So I agree that it would be a burdensome and annoying requirement -- I can attest personally -- but it's not impossible. I would imagine the requirement would boil down to a question on a audit that just requires that you're taking some reasonable measures to identify, notify owners, and take down PII. Luckily for Github they already have vulnerability scanning so at least some of the infrastructure to build this is already there.
- lonelappde 7y ago> GitHub should moderate every repository that has a 9-digit sequence You'd need some kind of enterprise data loss prevention system, or at least a regular expression, and how could a little startup like Microsoft afford that? https://cloud.google.com/dlp/ https://cloud.google.com/dlp/