6 ms·

I was going to say this isn’t a big deal but copying and uploading the libraries is actually illegal (copyright violation) and users likely can’t even consent t

I was going to say this isn’t a big deal but copying and uploading the libraries is actually illegal (copyright violation) and users likely can’t even consent to this even if it is in the Facebook ToS as many android phones contain proprietary libraries not licensed for redistribution. The creators of those various libraries should have a valid legal case against Facebook here, if they want to exercise it. I doubt any users are being harmed by this but it’s a violation of the software creator’s rights.

deleted 7y ago
[deleted]
dmitrygr 7y ago
Some older android devices running newer lineage/AICP/etc builds include a few libraries I wrote (in their entirety) for compatibility of old vendor prebuilts with new android versions - libdgv1 & libdmitry. Maybe I should C&D FB for laughs?
- number6 7y ago
  Yes please!
- B_Throwaway 7y ago
  Absolutely!
- gpm 7y ago
  Are they closed source? I.e. does facebook not have a license to make copies of them?
  - dmitrygr 7y ago
    source avail != anyone can make copies of the binary
    - gpm 7y ago
      Sure, by closed source I meant "not licensed under a typical open source license that gives you that right" rather than "I literally can't find the source via google".
    - tempay 7y ago
      Even with a “standard” open source licence the copyright notice probably isn’t being included in the upload making it a violation of most licences.
- aledalgrande 7y ago
  Go for it bud!
Wowfunhappy 7y ago
> The creators of those various libraries should have a valid legal case against Facebook here, if they want to exercise it. Perhaps, but sadly, I don't actually foresee vendors wanting to exercise that right. From a business perspective, why bother?
- Silhouette 7y ago
  From a business perspective, why bother? Maybe in jurisdictions like the US, where the copyright lobby has been very effective in getting aggressive anti-piracy legislation with huge penalties enacted, the statutory damages alone could be astronomical? Since Facebook could still afford to pay them, it might also offer to settle for a very worthwhile sum without even the risk of going to court. I'm generally not a fan of hugely disproportionate penalties for copyright infringement, but this isn't some normal person falling victim to opportunist lawyers engaging in a form of barratry, this is a huge company with its own legal team who should know better than to wilfully infringe copyright.
- dredmorbius 7y ago
  The owner of a specific library might or might not. They could potentially have ... friends ... who would have an interest in seeing a case brought, though. (And since Bollea, barratry seems acceptable.)
deleted 7y ago
[deleted]
deleted 7y ago
[deleted]
thermonot 7y ago
> copying and uploading the libraries is actually illegal Is it through? If I'm uploading a library to virustotal to check if it's a known piece of malware, am I breaking the law if it was clean?
- Splognosticus 7y ago
  I seem to remember a case where files were being uploaded to a server where they were only retained in memory and that qualified as a copyright violation, but I'm having trouble actually finding it.
  - javagram 7y ago
    There’s a good discussion of the legality of RAM copies here http://digital-law-online.info/lpdi1.0/treatise20.html http://digital-law-online.info/lpdi1.0/treatise20.html Note that there is an exception for such a copy when it’s necessary to run the program, I believe this exemption was added because otherwise running an executable on a personal computer would have been a copyright violation. https://www.copyright.gov/title17/92chap1.html https://www.copyright.gov/title17/92chap1.html > a) Making of Additional Copy or Adaptation by Owner of Copy.— Notwithstanding the provisions of section 106, it is not an infringement for the owner of a copy of a computer program to make or authorize the making of another copy or adaptation of that computer program provided: > (1) that such a new copy or adaptation is created as an essential step in the utilization of the computer program in conjunction with a machine and that it is used in no other manner, or > (2) that such new copy or adaptation is for archival purposes only and that all archival copies are destroyed in the event that continued possession of the computer program should cease to be rightful.
    - Splognosticus 7y ago
      That must be what I was thinking of, thanks!
- cjhveal 7y ago
  In the US there is a legal doctrine called fair use, which limits the extent of copyright. There are a number of factors but one of the most relevant here is the purpose and character of the use. If you're using the work to create an analysis of it, that's often covered under fair use as it is not a simple reproduction of the original. (not legal advice).
nerdponx 7y ago
Looks like it's only uploading the name and a hash.
- pbalau 7y ago
  Read down the twitter thread, looks like they can/are uploading the contents of the files too.
deleted 7y ago
[deleted]
dspillett 7y ago
Edit: CANCEL MY KNEE-JERK REACTION TO A KNEE-JERK REACTION! A few tweets down (good [deity] twitter is a terrible way to transmit information, this is why I don't generally bother with it) she does say the full library is sent. -------------------- > copying and uploading the libraries is actually illegal (copyright violation) That isn't what is happening here - the headline is misleading. Further into the tweet (FFS, it is a tweet and people aren't reading it all before reacting!) it clearly says "It periodically uploads metadata of system libraries to the server". Basically that means they are sending and storing what versions of what things you have, not the code or other data in the libraries themselves. I'm pretty sure there is no reasonably copyright on the name and version number of a library in this context. If it is being done for fingerprinting purposes then there might be an unreasonable tracking claim by the users, but not the library copyright holders. The less worrying explanation is that it is being used for problem analysis: if a new version crashes a lot but only on devices with a specific version of a specific library, that makes tracking down the bug and implementing a workaround or fix much quicker. Of course this is facebook so if it is for the issue analysis (which it almost certainly is) but can also be used for fingerprinting as well, you can bet your bottom dollar that it will be used for fingerprinting as well.
- ddlatham 7y ago
  Even further into the tweets it says: "Facebook can upload the entire files of all system libraries to their server through their Android apps" and "I found they have already collected metadata of 2233 system libraries from my phone, in which 1162 system libraries are pending to be uploaded" So they've already uploaded the metadata and are in process of uploading the whole files.
  - mruts 7y ago
    Are you sure it’s not the metadata that is pending to be uploaded?
  - Florin_Andrei 7y ago
    Or the person misspoke.
- 7y ago
15155 7y ago
Video game anti-cheat software has done this for ages.
altfredd 7y ago
It appears, that FB app indeed uploads copies of specific system files: https://twitter.com/wongmjane/status/1167463077748436993 https://twitter.com/wongmjane/status/1167463077748436993 At first glance, the amount of damage being done is close to nil — even if they reverse engineer received files to steal trade secrets therein (lol), it is hard to pinpoint specific amount of harm, dealt to the copyright owners. But actually... why are Facebook people doing that? If I were to wager a guess, Facebook needs those files to create exact copies of user systems to debug. In other words, they are trying to save up on buying real devices for their test lab! Using "pirated" copies of libraries to spin up testing VMs is most likely cheaper than owning lots of real smartphones with all available firmware versions. And also illegal. I wonder if they gauged possibility of being sued for this along with possible legal expenses and found that it is still cheaper than buying those devices themselves.

deleted 7y ago

[deleted]

dmitrygr 7y ago

Some older android devices running newer lineage/AICP/etc builds include a few libraries I wrote (in their entirety) for compatibility of old vendor prebuilts with new android versions - libdgv1 & libdmitry. Maybe I should C&D FB for laughs?

number6 7y ago
Yes please!
B_Throwaway 7y ago
Absolutely!
gpm 7y ago
Are they closed source? I.e. does facebook not have a license to make copies of them?
- dmitrygr 7y ago
  source avail != anyone can make copies of the binary
  - gpm 7y ago
    Sure, by closed source I meant "not licensed under a typical open source license that gives you that right" rather than "I literally can't find the source via google".
  - tempay 7y ago
    Even with a “standard” open source licence the copyright notice probably isn’t being included in the upload making it a violation of most licences.
aledalgrande 7y ago
Go for it bud!

Wowfunhappy 7y ago

> The creators of those various libraries should have a valid legal case against Facebook here, if they want to exercise it. Perhaps, but sadly, I don't actually foresee vendors wanting to exercise that right. From a business perspective, why bother?

Silhouette 7y ago
From a business perspective, why bother? Maybe in jurisdictions like the US, where the copyright lobby has been very effective in getting aggressive anti-piracy legislation with huge penalties enacted, the statutory damages alone could be astronomical? Since Facebook could still afford to pay them, it might also offer to settle for a very worthwhile sum without even the risk of going to court. I'm generally not a fan of hugely disproportionate penalties for copyright infringement, but this isn't some normal person falling victim to opportunist lawyers engaging in a form of barratry, this is a huge company with its own legal team who should know better than to wilfully infringe copyright.
dredmorbius 7y ago
The owner of a specific library might or might not. They could potentially have ... friends ... who would have an interest in seeing a case brought, though. (And since Bollea, barratry seems acceptable.)

deleted 7y ago

[deleted]

deleted 7y ago

[deleted]

thermonot 7y ago

> copying and uploading the libraries is actually illegal Is it through? If I'm uploading a library to virustotal to check if it's a known piece of malware, am I breaking the law if it was clean?

Splognosticus 7y ago
I seem to remember a case where files were being uploaded to a server where they were only retained in memory and that qualified as a copyright violation, but I'm having trouble actually finding it.
- javagram 7y ago
  There’s a good discussion of the legality of RAM copies here http://digital-law-online.info/lpdi1.0/treatise20.html http://digital-law-online.info/lpdi1.0/treatise20.html Note that there is an exception for such a copy when it’s necessary to run the program, I believe this exemption was added because otherwise running an executable on a personal computer would have been a copyright violation. https://www.copyright.gov/title17/92chap1.html https://www.copyright.gov/title17/92chap1.html > a) Making of Additional Copy or Adaptation by Owner of Copy.— Notwithstanding the provisions of section 106, it is not an infringement for the owner of a copy of a computer program to make or authorize the making of another copy or adaptation of that computer program provided: > (1) that such a new copy or adaptation is created as an essential step in the utilization of the computer program in conjunction with a machine and that it is used in no other manner, or > (2) that such new copy or adaptation is for archival purposes only and that all archival copies are destroyed in the event that continued possession of the computer program should cease to be rightful.
  - Splognosticus 7y ago
    That must be what I was thinking of, thanks!
cjhveal 7y ago
In the US there is a legal doctrine called fair use, which limits the extent of copyright. There are a number of factors but one of the most relevant here is the purpose and character of the use. If you're using the work to create an analysis of it, that's often covered under fair use as it is not a simple reproduction of the original. (not legal advice).

nerdponx 7y ago

Looks like it's only uploading the name and a hash.

pbalau 7y ago
Read down the twitter thread, looks like they can/are uploading the contents of the files too.

deleted 7y ago

[deleted]

dspillett 7y ago

Edit: CANCEL MY KNEE-JERK REACTION TO A KNEE-JERK REACTION! A few tweets down (good [deity] twitter is a terrible way to transmit information, this is why I don't generally bother with it) she does say the full library is sent. -------------------- > copying and uploading the libraries is actually illegal (copyright violation) That isn't what is happening here - the headline is misleading. Further into the tweet (FFS, it is a tweet and people aren't reading it all before reacting!) it clearly says "It periodically uploads metadata of system libraries to the server". Basically that means they are sending and storing what versions of what things you have, not the code or other data in the libraries themselves. I'm pretty sure there is no reasonably copyright on the name and version number of a library in this context. If it is being done for fingerprinting purposes then there might be an unreasonable tracking claim by the users, but not the library copyright holders. The less worrying explanation is that it is being used for problem analysis: if a new version crashes a lot but only on devices with a specific version of a specific library, that makes tracking down the bug and implementing a workaround or fix much quicker. Of course this is facebook so if it is for the issue analysis (which it almost certainly is) but can also be used for fingerprinting as well, you can bet your bottom dollar that it will be used for fingerprinting as well.

ddlatham 7y ago
Even further into the tweets it says: "Facebook can upload the entire files of all system libraries to their server through their Android apps" and "I found they have already collected metadata of 2233 system libraries from my phone, in which 1162 system libraries are pending to be uploaded" So they've already uploaded the metadata and are in process of uploading the whole files.
- mruts 7y ago
  Are you sure it’s not the metadata that is pending to be uploaded?
- Florin_Andrei 7y ago
  Or the person misspoke.
7y ago

15155 7y ago

Video game anti-cheat software has done this for ages.

altfredd 7y ago

It appears, that FB app indeed uploads copies of specific system files: https://twitter.com/wongmjane/status/1167463077748436993 https://twitter.com/wongmjane/status/1167463077748436993 At first glance, the amount of damage being done is close to nil — even if they reverse engineer received files to steal trade secrets therein (lol), it is hard to pinpoint specific amount of harm, dealt to the copyright owners. But actually... why are Facebook people doing that? If I were to wager a guess, Facebook needs those files to create exact copies of user systems to debug. In other words, they are trying to save up on buying real devices for their test lab! Using "pirated" copies of libraries to spin up testing VMs is most likely cheaper than owning lots of real smartphones with all available firmware versions. And also illegal. I wonder if they gauged possibility of being sued for this along with possible legal expenses and found that it is still cheaper than buying those devices themselves.