46 ms·

GitHub Warns Users Reposting YouTube-DL They Could Be Banned

321 points by caution 6y ago

dusted 6y ago
Hardly surprising or "evil" of them. They've been ordered to take it down, anyone posting it again knows that.
- jbotz 6y ago
  They haven't been "ordered" anything by anyone who has the authority to issue an order. They have been requested to take it down, but this request arguably has no force under the DMCA because the RIAA is not the copyright holder of the material requested to be take down. Even if youtube-dl could be considered "circumvention technology" the DMCA safe harbour provision does not apply to that. It may not be surprising or even "evil", but at best it is excessively cautious for a company who profess to serve the open source community and want/need the goodwill thereof. Clearly this is the corporate owner (Microsoft) behind Github showing its hand. Time to move to other platforms.
  - marvion 6y ago
    > Clearly this is corporate owner (Microsoft) behind Github showing its hand. You should check out the history of the DCMA repo.
    - dannyw 6y ago
      The history isn't super relevant because a takedown of something like youtube-dl is really unprecedented.
  - Rochus 6y ago
    Absolutely right; RIAA was only successful with this questionable action thanks to support from Github.
  - bitwize 6y ago
    > Even if youtube-dl could be considered "circumvention technology" the DCMA safe harbour provision does not apply to that. Yes, which means it's straight up a crime to use or distribute youtube-dl, and GitHub does not want to be criminally liable. GitLab and similar sites will follow suit -- or face federal charges.
    - db48x 6y ago
      There's nothing to circumvent. It's not illegal.
      - sbarre 6y ago
        The problem with the DMCA is that the anti-circumvention clauses are vague at best, and unfortunately it's easy for well-funded corporations to make claims against it. There is nothing in the law that talks about the effectiveness of the anti-circumvention tech, so even if the tech is trivial to bypass, if that bypass is done via "unintended usage" (according to the rights holder, not you) then they can claim you are doing something illegal. It's a shitty law.
      - bitwize 6y ago
        Wrong. YouTube obfuscates the URL of the video stream for videos which have been identified as containing copyrighted material and are licensed for streaming only through the YouTube Web player or app. The copyright owner has made the material available under a license which permits ONLY that. Youtube-dl contains code to decrypt the URL of the video stream in order to download and save the copyrighted material, in violation of the license. Now let's look at some definitions from the DMCA: (A) to “circumvent protection afforded by a technological measure” means avoiding, bypassing, removing, deactivating, or otherwise impairing a technological measure; and (B) a technological measure “effectively protects a right of a copyright owner under this title” if the measure, in the ordinary course of its operation, prevents, restricts, or otherwise limits the exercise of a right of a copyright owner under this title. We have to ask ourselves two questions. First, is the URL obfuscation scheme a "technological measure" that “effectively protects a right of a copyright owner under this title”? Yes, it is. In the normal course of its operation, it prevents the user from accessing the work except to stream it through YouTube's Web player or its app. The bar set by the law for "effective" protection is very low. If your "DRM" is a simple XOR cipher whose key is "hello world", then it "effectively protects a right of the copyright owner under this title", provided that it does its job of restricting access to anyone who doesn't know the key. Secondly, does youtube-dl circumvent protection afforded by the technological measure? Yes, it does. The technological measure enforces certain policies by means of its decryption algorithm; youtube-dl reimplements the algorithm, but does not enforce the policies, allowing people to get around restrictions demanded by rightsholders like the RIAA and implemented by Google. Does youtube-dl have limited use other than to circumvent protections afforded by the technical measure? Yes, it does. If the URLs were not obfuscated, a simple HTTP client might suffice to download the video data. The primary use of youtube-dl is to get around the measures Google had put in place to restrict access to YouTube content (the same for other video sites). Therefore... youtube-dl is a circumvention device prohibited under the DMCA, and is therefore ILLEGAL. Distributing it is a felony under federal law, punishable by up to five years in prison. Go ahead. Ask any copyright lawyer. I'm sure they'll tell you the same.
  - viraptor 6y ago
    It's not up to github to analyse the DMCA validity beyond "does it match the format and include required information". Youtube-dl owner can do it and request an instant revert if they're happy to take the responsibility. No service provider is going to fight a specific case of DMCA for a third-party.
    - gruez 6y ago
      >No service provider is going to fight a specific case of DMCA for a third-party. How far do you think I'll get if I tried to file a bogus DMCA request for a Microsoft repo?
      - sbarre 6y ago
        Not far because _Microsoft_ - the owner of the repo - will fight you on it. It happens that they own Github, but s/Microsoft/Oracle/ and you'll probably get the same result. The automated systems will take down the repo for a bit, then the owner of the repo will kick your ass in court. It just happens that youtube-dl doesn't have a large corporate owner, and the RIAA _is_ a large corporate entity, and so this is how it happens. Your anger is misdirected here....
        gruez 6y ago
        >The automated systems will take down the repo for a bit That seems unlikely, considering that would be a massive DDoS vector.
        sbarre 6y ago
        Fair enough, I was making an assumption there.. but you are probably correct.
    - jchw 6y ago
      As someone who once filed a DMCA request against something, I can tell you that they requested additional verification that I was the copyright holder. Whether that was wise of them or not, it was not to a small company at all.
amelius 6y ago
Time for a (truly) decentralized version control system?
- eloisius 6y ago
  They’re out there. ssb-git is git over the scuttlebutt protocol.
- donmcronald 6y ago
  Yeah, like Git or something!
- oever 6y ago
  ForgeFed is a decentralized version control system under development. https://forgefed.peers.community/ https://forgefed.peers.community/
  - djeiasbsbo 6y ago
    This is what we need (recently learned about it). I wish this had more traction and progressed more quickly. Though of course it is a good thing not to rush the specification.
  - saurik 6y ago
    This is just a federation protocol, so it doesn't really solve the problem: federated systems are just a way to make it easier to interoperate between a number of separate instances, but every individual "thing" (in this case, a repository) is still going to be hosted on an instance that can be taken down (and sure, it could be put on another one, but then you didn't solve the problem); what you want is a "truly decentralized" (the word "truly" in parentheses was a critical part of the comment you were replying to) and really hopefully "distributed" revision control alternative, not merely a mechanism to "enable interoperability" (the phrasing from their website) between existing services (which should make the issue clear: if no existing service could host the repository in question, then interoperating between existing services doesn't suddenly cause stable hosting to appear).
Rochus 6y ago
People should move their youbube-dl repositories to servers hosted in Switzerland, where people are not criminalized when downloading content and making copies for personal use (even when copy protected).
- m-p-3 6y ago
  Is there a major git host located in Switzerland? I guess one could rent a VPS there if not.
  - Rochus 6y ago
    Nothing like the Github or Gitlab services I know of, but there are a couple of hosters where you can rent a (virtual) server.
- Mindwipe 6y ago
  I hate to break it to you but distribution of tools related to bypassing DRM/technical protection measures (which is what the RIAA takedown letter actually cited) is illegal in Switzerland and has been since 2006. Indeed, you can be sent to prison for it with a maximum tariff of a year in prison. https://www.admin.ch/opc/en/classified-compilation/19920251/index.html#a69a https://www.admin.ch/opc/en/classified-compilation/19920251/...
  - arghwhat 6y ago
    youtube-dl does not circumvent any protection measures, so hosting it should not be illegal in any country, including Switzerland. The only problem here is the absurdity of how the DMCA and similar works in the US, which allows companies to easily spam invalid claims and require content removed unless the victim puts in the work to prove the claim invalid. And, of course, that legal cases tend to be settled not moral and innocence, but by the lawyers paychecks.
    - eznzt 6y ago
      >youtube-dl does not circumvent any protection measures It does.
donmcronald 6y ago
This is an area where GitLab could have a huge advantage. If they had really good support for mirroring projects between instances then running your own private instance for control while mirroring to GitLab.com for scale / convenience would make a lot of sense. Of course I’m sure that would go into the super mega platinum “we’re only charging 1/5 of the real value” BS tier or whatever they’re pushing these days.
- Rochus 6y ago
  Gitlab is apparently a US based company. Unlikely that they would be more courages than Github.
  - donmcronald 6y ago
    Yes, but having a complete copy of all my projects in a matching self-hosted environment mitigates a huge amount of risk because it would still be there if I got banned from GitLab.com. I could still use the workflow and tooling I'm used to. Contrast that with GitHub where losing your account means losing the workflow and tooling you depend on. I'm not talking about trying to re-host a controversial project though. I'm more interested in the risk to the average small developer where getting banned would ruin your life, but wouldn't make the news.
    - Rochus 6y ago
      My statement didn't imply you should use Github, but that there is no reason to feel more save with Gitlab.
  - delfinom 6y ago
    The only way GitLab would escape DMCA would be to host in China or Russia (which also would get it banned by many of their customers). The US has many IP agreements with European countries and even some Asian countries, good luck escaping from it.
    - Rochus 6y ago
mrtksn 6y ago
Technologists once again shocked that a policy issue cannot be solved by Technology. Tech solutions that are not aligned with the policy only work until lawyers and politicians catch up.
- chmod775 6y ago
  Then again pretty much any policy can be made unenforceable if a sufficient number of people decide to make it so. Technologists with their ability to automate are at a distinct advantage here again. I'm just waiting for youtube-dl to move development to Tor or i2p or another censorship resistant network - and ship with a built-in client to update from there.
  - mrtksn 6y ago
    Probably the lawyers will move on when the thing becomes hard enough to use and gets contained to few techies showing off to their few friends and calling it a victory. The issue is that anything that scales needs an infrastructure and infrastructures can be extralegal only if they are not worth the time of the guys with the guns.
    - pharke 6y ago
      If only there were a decentralized file sharing protocol that anyone can use to distribute source code and binaries...
      - mrtksn 6y ago
        decentralization doesn’t work without a centralized tool. Torrents are nothing more than a clever idea without The Pirate Bay & similar, Bitcoin is worth nothing without the exchanges.
        chmod775 6y ago
        You can create your own TPB by just crawling the DHT network for torrents and downloading the torrent metadata from active peers. In fact I did this once as a fun weekend project. Also you pretty much gave a counterexample to your own argument by bringing up TPB. The "people with guns" would love nothing more than for it to go away, yet here we are - 17 years and counting.
timdaub 6y ago
Hopefully they won't ban mine! https://github.com/TimDaub/youtube-dl https://github.com/TimDaub/youtube-dl
- levitate 6y ago
  Cloned it, thanks :)
- sivakon 6y ago
  Just want to understand, if I change the repo name to something else but does the same job, will that trigger RIAA?
  - gamblor956 6y ago
    It can, yes.
- crtasm 6y ago
  Very kind of you to share the DJ Raspberry remix of 'Baby', been after a copy for months.
  - timdaub 6y ago
    Glad you like it, I worked countless hours on it!
brobdingnagians 6y ago
The nice thing about fossil is that you could have the website / documentation as part of the repository, then simply clone the repository and run `fossil server` over and over to decentralize the entire network with the built-in http server. Some kind of solution that makes it _easy_ for people to decentralize makes it more likely that it will be decentralized when needed.
crazypython 6y ago
What if we got big, important accounts to repost it, creating a "hostage situation" for GitHub?
- elmo2you 6y ago
  Interesting thought. It would definitely call bluff on these bully tactics by GitHub. GitHub's deplorable behavior might very well be illegal, but fat chance of anyone dragging the company to court over it, considering how much that would cost and the amount of lawyers that Microsoft would put on such a case. Yet again a tech company making up their own laws and (so far) getting away with it. One might wonder, if anything ever substantially changed in the Wild West.
  - colejohnson66 6y ago
    Or they just don’t want to lose their safe harbor protections afforded by the DMCA. And to avoid that, they have to do things like this. They’re also not breaking any laws by removing user content that their TOS say they have the right to remove.
- xtracto 6y ago
  Remember that now we are talking about Microsoft, Github belongs to Microsoft.
jasode 6y ago
Some example comments in this thread: >"People should move their youbube-dl repositories to servers hosted in Switzerland, " >"Time for a decentralized version control system?" >"The nice thing about fossil" ... those well-meaning suggestions are missing the true difficulty: The community wants a (1) Schelling Point[0] for workflow/issues/discussions/PRs that's also (2) censorship resistant. So far, (1) and (2) contradict each other's goals. Nobody has come up with a technology solution that satisfies both goals. Yes, Fossil has has discussions built into the repo, but fossil is not a Schelling Point. Yes, one can run Gitlab on a self-hosted Raspberry Pi from a home internet connection but that's also not a stable Schelling Point because ISP like Comcast can shut that IP down for DMCA violation.[1] And SMTP mailing lists also ultimately depend on a server that holds the discussion archive and a well-known address for new users to send a "add my email" request. Thus, the existence of a well-known server becomes a specific target for RIAA/DMCA takedown. As for other "uncensorable" technology ideas such as IPFS, Freenet, blockchain, etc. I haven't seen any proof-of-concept from other projects that demonstrates similar easy-to-use collaboration of Github. Remember, it's not about the raw git repo... it's about the Focal Point for the collaboration workflow. [0] https://en.wikipedia.org/wiki/Focal_point_(game_theory) https://en.wikipedia.org/wiki/Focal_point_(game_theory) [1] https://www.xfinity.com/support/articles/comcast-dmca-compliance-policy https://www.xfinity.com/support/articles/comcast-dmca-compli...
- feanaro 6y ago
  The hosting for the server is irrelevant if it is relatively stable (does not get compromised every few days) and you have alternatives to move to if it gets taken down. The true single point of failure is the domain name, but sites like sci-hub seem to be able to manage that rather easily too. The domain name sometimes has to change but people still seem to be able to find it easily.
- swiley 6y ago
  You could always use a newsgroup for patches/issues/discussion. Those are notoriously hard to sensor and usually can be posted to/read by normal mail clients.
  - 6y ago
ikeboy 6y ago
Great. I posted two forks, if GitHub takes action then I've got standing to sue RIAA (under the declaratory judgement act), which I'd love to do pro se. Btw, if anyone is associated with any fork that did go down and is interested in bringing a pro se case, feel free to contact me. I'm not a lawyer and can't give legal advice but I can help point you at some helpful laws and cases. I've been fighting false infringement claims in court for over a year on other issues. Also take a look at the complaint in https://torrentfreak.com/riaa-sued-by-youtube-ripping-site-over-dmca-anti-circumvention-notices-201027/ https://torrentfreak.com/riaa-sued-by-youtube-ripping-site-o..., although it has some issues I noted at https://news.ycombinator.com/item?id=24902619 https://news.ycombinator.com/item?id=24902619.
- varispeed 6y ago
  Why would you have a stand to sue RIAA if GitHub would have blocked your account? I think you may only have a claim against GH, but I have not read T&C well enough, but I can imagine they would have an entry enabling them to block anyone for any reason. I don't think you could do anything about it.
  - ikeboy 6y ago
    RIAA made a claim that some content violates their rights under DMCA, which in this hypothetical causes my account to be blocked. I can bring a case under the declaratory judgement act against RIAA, asking a court to decide whether the content is actually infringing. See https://en.wikipedia.org/wiki/Declaratory_judgment https://en.wikipedia.org/wiki/Declaratory_judgment I may also have a tortious interference claim, although damages are likely negligible so it's probably not worth bringing any claims other than that declaratory judgement one.
    - toomuchtodo 6y ago
      Be the squeaky wheel. Thanks for your efforts.
    - Mindwipe 6y ago
      Well, I would strongly suggest you speak to a lawyer on it, but I would note this strategy only really gives you an American judgement, and the RIAA takedown would still apply in any other territory. I don't know if Github would host content where they felt there were issues in some countries and not others. Would they geofilter it as they do with Iranian contributors due to US sanctions?
squarefoot 6y ago
When men were men, every single GH user would host YT-dl in protest, then good luck to MS alienating their entire userbase. (ps. I don't have a GH account)
- vaccinator 6y ago
  Here, create an account and for this: https://github.com/l1ving/youtube-dl https://github.com/l1ving/youtube-dl
  - vaccinator 6y ago
    Err: fork....
- Minor49er 6y ago
  Alternatively, just spin up your own Gitea instance, set the access restrictions as loose or as tight as you want, and call it a day
mkl95 6y ago
I think some people are missing a major point about youtube-dl's takedown. The purpose of this DMCA claim wasn't just to prevent people from downloading videos, it was to set a legal precedent for the RIAA and similar organizations to troll Github and anyone hosting public repositories with it, by linking them to "illegal downloads". By agreeing to this without any public opposition, Github has become similar to Youtube itself, in that it will be expected to immediately comply with à la carte takedown requests by RIAA and other copyright trolls from now on. It doesn't matter that the actual reason to take down your large repository is political or it simply bothers certain company for miscellaneous reasons, since all it takes is some "illegal content".
- reflectiv 6y ago
  I am sorry...but what would the RIAA troll Github for exactly?
  - mkl95 6y ago
    Sorry if it was a bit tongue-in-cheek. The RIAA can now call Github out whenever they have an argument for them enabling downloads of copyrighted content through their repositories. And Github is expected to fix it for them.
    - apocalyptic0n3 6y ago
      I'm not sure how this is any different than how it's been for years now. GitHub has been complying with DMCA takedown requests since 2011[1]. What precedent needed to be set here? The RIAA could always do this and GitHub has been complying with it (because they legally have to). 1: https://github.com/github/dmca/ https://github.com/github/dmca/
      - mkl95 6y ago
        A lot of the things listed on the DMCA repo (if not most of them) are not software that could be used to download content, but the literal content you could obtain using them, such as textbooks, proprietary fonts, and so on. By taking down youtube-dl, Github has opened a window for copyright trolls to speculate about what a repository is used for, and take it down if one of its use cases involves downloading copyrighted content. I can see how it's legitimate to take down a repository with the sole, explicit goal of downloading copyrighted content, but youtube-dl is widely used by journalists to preserve uncopyrighted content.
cliffwarden 6y ago
Jesus, this is DeCSS all over again. Here are some creative options - https://yro.slashdot.org/story/01/02/25/1631259/the-decss-haiku https://yro.slashdot.org/story/01/02/25/1631259/the-decss-ha... - https://news.slashdot.org/story/00/09/10/2225214/decss-source-mass-posted-to-usenet https://news.slashdot.org/story/00/09/10/2225214/decss-sourc... - https://news.ycombinator.com/item?id=2098470 https://news.ycombinator.com/item?id=2098470
nbzso 6y ago
Is it not the right time to decentralise those type of services? I think it is. Isn't this site owned by Microsoft? So if it is, this is normal big corporation behaviour. They embrace open-source community to gain advantage. Is there a way to host code without being dependent on big corporation? I am really interested in the answer of this question. Public programming code must be treated like public utility. For example like water, it must be ensured that water is drinkable and properly managed, but in public domain. Is anyone remember Nestle attempt to privatise water? (https://www.insidehook.com/daily_brief/news-opinion/nestle-bottled-water-american-freshwater-supply https://www.insidehook.com/daily_brief/news-opinion/nestle-b...).
- TheCraiggers 6y ago
  Github is not the only player, and there are plenty of other options. Git itself is decentralized, so that's half the issue solved. Gitlab, Gerrit, and a bevvy of other web front ends for git exist, some open source, some closed. Github is still the biggest, but Gitlab is probably a close second.
- delfinom 6y ago
  >They embrace open-source community to gain advantage. Is there a way to host code without being dependent on big corporation? No. This is you and others being completely oblivious to law. DMCA is US law AND the US has trade agreements with other countries to similarly enforce US IP law. It does not matter if it's Microsoft or a small startup. Either they comply with DMCA or the RIAA (and others) can sue for millions in damages. Take issue with the law and push your elected officials to change them.
- BlueTemplar 6y ago
  Also YouTube. It's harder, but software like PeerTube works surprisingly well !
motohagiography 6y ago
Why would some brunching lawyer know what yt-dl even was unless someone who hired them was making a political play against it? Given youtube-dl is not copyrighted material the RIAA would have in its mandate, that it replicates functionality that every browser already has, and GitHub is a property of MSFT - this is basically a legal harassment play that implies we're going to need more than decentralized repositories. I'm thinking something like Kali Linux but one that tags certain code repositories as politically exposed and then mirrors them into a distribution via torrents.
- th3l3mons 6y ago
  Below is a link to Leonard French, a practicing copyright attorney, talking about the situation. According to him, the problem is whether or not yt-dl was designed and marketed to bypass copyright protections. Still a shit situation (re:browsers and screencaps) but it seems like this is more or less how the law is written. IANAL. https://youtu.be/wZITscblMBA https://youtu.be/wZITscblMBA
piyushpr134 6y ago
Linus gave us git to get rid of centralized repos and we web devs invented github to centralize it all. Sometimes I feel we web devs behave worse than fashion industry when it comes to blindly following random trends, making it all religious instead of logical and messing up all innovation
Chris2048 6y ago
I'm fine with this. It reminds everyone that Github is a potentially malicious layer-on-top of git that can bite you, even if they seem to be on your side. Sure, slap a clone on GH for a bit of extra traffic - but keep your main activities somewhere under your control.
optimuspaul 6y ago
am I the only one that doesn't support YouTube-dl? Are there use cases for it that are not downloading content that is not your own?
- colejohnson66 6y ago
  Valid question! On first thought, you would think the only reason to use it would be for media you don’t own (if you own it, you’d already have a copy). And you are probably correct. However there are valid reasons for doing so: many people have posted here that they use it for journalism (fair use) among other things. I do remember years back, LinusTechTips admitted that their video archives were just on hard drives scattered around the building. So if they needed a clip from a previous video, they’d just download the video from YouTube and “crop” down to the clip they needed.[a] [a]: They mentioned this in a video where there were building their “Vault” server that eventually turned into “Petabyte Project.”
- wing-_-nuts 6y ago
  There are all sorts of legit uses. There are some videos I've uploaded that I've long ago lost the original source to. Also, if I wanted to go home and see my parents, it's probably better if I download the ted talks, youtube videos etc that I might like to watch on my personal connection than theirs.
  - optimuspaul 6y ago
    Downloading my own videos doesn't require something like YouTube-DL. Offline personal use of others videos does make sense.
- BlueTemplar 6y ago
  In the case that you were more concerned about the legality than the morality of it, you have to remember that downloading freely available videos on YouTube is perfectly legal. (Of course sharing the downloaded files is not, unless you have a copyright on them, or if they are in the public domain)
chokeartist 6y ago
Sounds like an excellent reason to migrate the git + tracker to Tor. But I imagine they will just shift to going after the lead contributors on a personal level. Such a lame use of resources on RIAA's behalf.
heavyset_go 6y ago
I kind of worried that some of the value of GitHub's data is derived from knowing which developers browsed/pulled/forked/contributed to different projects, and whether or not they or their employers could be sued for breaking licenses, infringing copyright or patents, etc. For example, Microsoft might want to know which of their former developers contributed to say WINE or ReactOS. A patent troll might want to know who pulled code that allegedly infringes their patents, so they can audit and sue their employers. The RIAA might want to know which businesses use YTDL, even if they're using it under fair use, and so on.
phendrenad2 6y ago
The actual DMCA takedown was just an excuse. I'm sure Microsoft's top brass would love to give the gift of killing youtube-dl to their friends at Google. Sort of a "you scratch my back I'll scratch yours". Maybe YouTube will stop begging users to switch from Edge to Chrome.
pippy 6y ago
The original DMCA request stated that they violated copyright by suggesting songs in their source code. While this is a dubious copyright claim, surely the easy solution is to uphold the claim by simply replacing the songs with open source items such as big buck bunny in the source?

321 points by caution 6y ago

dusted 6y ago

Hardly surprising or "evil" of them. They've been ordered to take it down, anyone posting it again knows that.

jbotz 6y ago
They haven't been "ordered" anything by anyone who has the authority to issue an order. They have been requested to take it down, but this request arguably has no force under the DMCA because the RIAA is not the copyright holder of the material requested to be take down. Even if youtube-dl could be considered "circumvention technology" the DMCA safe harbour provision does not apply to that. It may not be surprising or even "evil", but at best it is excessively cautious for a company who profess to serve the open source community and want/need the goodwill thereof. Clearly this is the corporate owner (Microsoft) behind Github showing its hand. Time to move to other platforms.
- marvion 6y ago
  > Clearly this is corporate owner (Microsoft) behind Github showing its hand. You should check out the history of the DCMA repo.
  - dannyw 6y ago
    The history isn't super relevant because a takedown of something like youtube-dl is really unprecedented.
- Rochus 6y ago
  Absolutely right; RIAA was only successful with this questionable action thanks to support from Github.
- bitwize 6y ago
  > Even if youtube-dl could be considered "circumvention technology" the DCMA safe harbour provision does not apply to that. Yes, which means it's straight up a crime to use or distribute youtube-dl, and GitHub does not want to be criminally liable. GitLab and similar sites will follow suit -- or face federal charges.
  - db48x 6y ago
    There's nothing to circumvent. It's not illegal.
    - sbarre 6y ago
      The problem with the DMCA is that the anti-circumvention clauses are vague at best, and unfortunately it's easy for well-funded corporations to make claims against it. There is nothing in the law that talks about the effectiveness of the anti-circumvention tech, so even if the tech is trivial to bypass, if that bypass is done via "unintended usage" (according to the rights holder, not you) then they can claim you are doing something illegal. It's a shitty law.
    - bitwize 6y ago
      Wrong. YouTube obfuscates the URL of the video stream for videos which have been identified as containing copyrighted material and are licensed for streaming only through the YouTube Web player or app. The copyright owner has made the material available under a license which permits ONLY that. Youtube-dl contains code to decrypt the URL of the video stream in order to download and save the copyrighted material, in violation of the license. Now let's look at some definitions from the DMCA: (A) to “circumvent protection afforded by a technological measure” means avoiding, bypassing, removing, deactivating, or otherwise impairing a technological measure; and (B) a technological measure “effectively protects a right of a copyright owner under this title” if the measure, in the ordinary course of its operation, prevents, restricts, or otherwise limits the exercise of a right of a copyright owner under this title. We have to ask ourselves two questions. First, is the URL obfuscation scheme a "technological measure" that “effectively protects a right of a copyright owner under this title”? Yes, it is. In the normal course of its operation, it prevents the user from accessing the work except to stream it through YouTube's Web player or its app. The bar set by the law for "effective" protection is very low. If your "DRM" is a simple XOR cipher whose key is "hello world", then it "effectively protects a right of the copyright owner under this title", provided that it does its job of restricting access to anyone who doesn't know the key. Secondly, does youtube-dl circumvent protection afforded by the technological measure? Yes, it does. The technological measure enforces certain policies by means of its decryption algorithm; youtube-dl reimplements the algorithm, but does not enforce the policies, allowing people to get around restrictions demanded by rightsholders like the RIAA and implemented by Google. Does youtube-dl have limited use other than to circumvent protections afforded by the technical measure? Yes, it does. If the URLs were not obfuscated, a simple HTTP client might suffice to download the video data. The primary use of youtube-dl is to get around the measures Google had put in place to restrict access to YouTube content (the same for other video sites). Therefore... youtube-dl is a circumvention device prohibited under the DMCA, and is therefore ILLEGAL. Distributing it is a felony under federal law, punishable by up to five years in prison. Go ahead. Ask any copyright lawyer. I'm sure they'll tell you the same.
- viraptor 6y ago
  It's not up to github to analyse the DMCA validity beyond "does it match the format and include required information". Youtube-dl owner can do it and request an instant revert if they're happy to take the responsibility. No service provider is going to fight a specific case of DMCA for a third-party.
  - gruez 6y ago
    >No service provider is going to fight a specific case of DMCA for a third-party. How far do you think I'll get if I tried to file a bogus DMCA request for a Microsoft repo?
    - sbarre 6y ago
      Not far because _Microsoft_ - the owner of the repo - will fight you on it. It happens that they own Github, but s/Microsoft/Oracle/ and you'll probably get the same result. The automated systems will take down the repo for a bit, then the owner of the repo will kick your ass in court. It just happens that youtube-dl doesn't have a large corporate owner, and the RIAA _is_ a large corporate entity, and so this is how it happens. Your anger is misdirected here....
      - gruez 6y ago
        >The automated systems will take down the repo for a bit That seems unlikely, considering that would be a massive DDoS vector.
        sbarre 6y ago
        Fair enough, I was making an assumption there.. but you are probably correct.
  - jchw 6y ago
    As someone who once filed a DMCA request against something, I can tell you that they requested additional verification that I was the copyright holder. Whether that was wise of them or not, it was not to a small company at all.

amelius 6y ago

Time for a (truly) decentralized version control system?

eloisius 6y ago
They’re out there. ssb-git is git over the scuttlebutt protocol.
donmcronald 6y ago
Yeah, like Git or something!
oever 6y ago
ForgeFed is a decentralized version control system under development. https://forgefed.peers.community/ https://forgefed.peers.community/
- djeiasbsbo 6y ago
  This is what we need (recently learned about it). I wish this had more traction and progressed more quickly. Though of course it is a good thing not to rush the specification.
- saurik 6y ago
  This is just a federation protocol, so it doesn't really solve the problem: federated systems are just a way to make it easier to interoperate between a number of separate instances, but every individual "thing" (in this case, a repository) is still going to be hosted on an instance that can be taken down (and sure, it could be put on another one, but then you didn't solve the problem); what you want is a "truly decentralized" (the word "truly" in parentheses was a critical part of the comment you were replying to) and really hopefully "distributed" revision control alternative, not merely a mechanism to "enable interoperability" (the phrasing from their website) between existing services (which should make the issue clear: if no existing service could host the repository in question, then interoperating between existing services doesn't suddenly cause stable hosting to appear).

Rochus 6y ago

People should move their youbube-dl repositories to servers hosted in Switzerland, where people are not criminalized when downloading content and making copies for personal use (even when copy protected).

m-p-3 6y ago
Is there a major git host located in Switzerland? I guess one could rent a VPS there if not.
- Rochus 6y ago
  Nothing like the Github or Gitlab services I know of, but there are a couple of hosters where you can rent a (virtual) server.
Mindwipe 6y ago
I hate to break it to you but distribution of tools related to bypassing DRM/technical protection measures (which is what the RIAA takedown letter actually cited) is illegal in Switzerland and has been since 2006. Indeed, you can be sent to prison for it with a maximum tariff of a year in prison. https://www.admin.ch/opc/en/classified-compilation/19920251/index.html#a69a https://www.admin.ch/opc/en/classified-compilation/19920251/...
- arghwhat 6y ago
  youtube-dl does not circumvent any protection measures, so hosting it should not be illegal in any country, including Switzerland. The only problem here is the absurdity of how the DMCA and similar works in the US, which allows companies to easily spam invalid claims and require content removed unless the victim puts in the work to prove the claim invalid. And, of course, that legal cases tend to be settled not moral and innocence, but by the lawyers paychecks.
  - eznzt 6y ago
    >youtube-dl does not circumvent any protection measures It does.

donmcronald 6y ago

This is an area where GitLab could have a huge advantage. If they had really good support for mirroring projects between instances then running your own private instance for control while mirroring to GitLab.com for scale / convenience would make a lot of sense. Of course I’m sure that would go into the super mega platinum “we’re only charging 1/5 of the real value” BS tier or whatever they’re pushing these days.

Rochus 6y ago
Gitlab is apparently a US based company. Unlikely that they would be more courages than Github.
- donmcronald 6y ago
  Yes, but having a complete copy of all my projects in a matching self-hosted environment mitigates a huge amount of risk because it would still be there if I got banned from GitLab.com. I could still use the workflow and tooling I'm used to. Contrast that with GitHub where losing your account means losing the workflow and tooling you depend on. I'm not talking about trying to re-host a controversial project though. I'm more interested in the risk to the average small developer where getting banned would ruin your life, but wouldn't make the news.
  - Rochus 6y ago
    My statement didn't imply you should use Github, but that there is no reason to feel more save with Gitlab.
- delfinom 6y ago
  The only way GitLab would escape DMCA would be to host in China or Russia (which also would get it banned by many of their customers). The US has many IP agreements with European countries and even some Asian countries, good luck escaping from it.
  - Rochus 6y ago

mrtksn 6y ago

Technologists once again shocked that a policy issue cannot be solved by Technology. Tech solutions that are not aligned with the policy only work until lawyers and politicians catch up.

chmod775 6y ago
Then again pretty much any policy can be made unenforceable if a sufficient number of people decide to make it so. Technologists with their ability to automate are at a distinct advantage here again. I'm just waiting for youtube-dl to move development to Tor or i2p or another censorship resistant network - and ship with a built-in client to update from there.
- mrtksn 6y ago
  Probably the lawyers will move on when the thing becomes hard enough to use and gets contained to few techies showing off to their few friends and calling it a victory. The issue is that anything that scales needs an infrastructure and infrastructures can be extralegal only if they are not worth the time of the guys with the guns.
  - pharke 6y ago
    If only there were a decentralized file sharing protocol that anyone can use to distribute source code and binaries...
    - mrtksn 6y ago
      decentralization doesn’t work without a centralized tool. Torrents are nothing more than a clever idea without The Pirate Bay & similar, Bitcoin is worth nothing without the exchanges.
      - chmod775 6y ago
        You can create your own TPB by just crawling the DHT network for torrents and downloading the torrent metadata from active peers. In fact I did this once as a fun weekend project. Also you pretty much gave a counterexample to your own argument by bringing up TPB. The "people with guns" would love nothing more than for it to go away, yet here we are - 17 years and counting.

timdaub 6y ago

Hopefully they won't ban mine! https://github.com/TimDaub/youtube-dl https://github.com/TimDaub/youtube-dl

levitate 6y ago
Cloned it, thanks :)
sivakon 6y ago
Just want to understand, if I change the repo name to something else but does the same job, will that trigger RIAA?
- gamblor956 6y ago
  It can, yes.
crtasm 6y ago
Very kind of you to share the DJ Raspberry remix of 'Baby', been after a copy for months.
- timdaub 6y ago
  Glad you like it, I worked countless hours on it!

brobdingnagians 6y ago

The nice thing about fossil is that you could have the website / documentation as part of the repository, then simply clone the repository and run `fossil server` over and over to decentralize the entire network with the built-in http server. Some kind of solution that makes it _easy_ for people to decentralize makes it more likely that it will be decentralized when needed.

crazypython 6y ago

What if we got big, important accounts to repost it, creating a "hostage situation" for GitHub?

elmo2you 6y ago
Interesting thought. It would definitely call bluff on these bully tactics by GitHub. GitHub's deplorable behavior might very well be illegal, but fat chance of anyone dragging the company to court over it, considering how much that would cost and the amount of lawyers that Microsoft would put on such a case. Yet again a tech company making up their own laws and (so far) getting away with it. One might wonder, if anything ever substantially changed in the Wild West.
- colejohnson66 6y ago
  Or they just don’t want to lose their safe harbor protections afforded by the DMCA. And to avoid that, they have to do things like this. They’re also not breaking any laws by removing user content that their TOS say they have the right to remove.
xtracto 6y ago
Remember that now we are talking about Microsoft, Github belongs to Microsoft.

jasode 6y ago

Some example comments in this thread: >"People should move their youbube-dl repositories to servers hosted in Switzerland, " >"Time for a decentralized version control system?" >"The nice thing about fossil" ... those well-meaning suggestions are missing the true difficulty: The community wants a (1) Schelling Point[0] for workflow/issues/discussions/PRs that's also (2) censorship resistant. So far, (1) and (2) contradict each other's goals. Nobody has come up with a technology solution that satisfies both goals. Yes, Fossil has has discussions built into the repo, but fossil is not a Schelling Point. Yes, one can run Gitlab on a self-hosted Raspberry Pi from a home internet connection but that's also not a stable Schelling Point because ISP like Comcast can shut that IP down for DMCA violation.[1] And SMTP mailing lists also ultimately depend on a server that holds the discussion archive and a well-known address for new users to send a "add my email" request. Thus, the existence of a well-known server becomes a specific target for RIAA/DMCA takedown. As for other "uncensorable" technology ideas such as IPFS, Freenet, blockchain, etc. I haven't seen any proof-of-concept from other projects that demonstrates similar easy-to-use collaboration of Github. Remember, it's not about the raw git repo... it's about the Focal Point for the collaboration workflow. [0] https://en.wikipedia.org/wiki/Focal_point_(game_theory) https://en.wikipedia.org/wiki/Focal_point_(game_theory) [1] https://www.xfinity.com/support/articles/comcast-dmca-compliance-policy https://www.xfinity.com/support/articles/comcast-dmca-compli...

feanaro 6y ago
The hosting for the server is irrelevant if it is relatively stable (does not get compromised every few days) and you have alternatives to move to if it gets taken down. The true single point of failure is the domain name, but sites like sci-hub seem to be able to manage that rather easily too. The domain name sometimes has to change but people still seem to be able to find it easily.
swiley 6y ago
You could always use a newsgroup for patches/issues/discussion. Those are notoriously hard to sensor and usually can be posted to/read by normal mail clients.
- 6y ago

ikeboy 6y ago

Great. I posted two forks, if GitHub takes action then I've got standing to sue RIAA (under the declaratory judgement act), which I'd love to do pro se. Btw, if anyone is associated with any fork that did go down and is interested in bringing a pro se case, feel free to contact me. I'm not a lawyer and can't give legal advice but I can help point you at some helpful laws and cases. I've been fighting false infringement claims in court for over a year on other issues. Also take a look at the complaint in https://torrentfreak.com/riaa-sued-by-youtube-ripping-site-over-dmca-anti-circumvention-notices-201027/ https://torrentfreak.com/riaa-sued-by-youtube-ripping-site-o..., although it has some issues I noted at https://news.ycombinator.com/item?id=24902619 https://news.ycombinator.com/item?id=24902619.

varispeed 6y ago
Why would you have a stand to sue RIAA if GitHub would have blocked your account? I think you may only have a claim against GH, but I have not read T&C well enough, but I can imagine they would have an entry enabling them to block anyone for any reason. I don't think you could do anything about it.
- ikeboy 6y ago
  RIAA made a claim that some content violates their rights under DMCA, which in this hypothetical causes my account to be blocked. I can bring a case under the declaratory judgement act against RIAA, asking a court to decide whether the content is actually infringing. See https://en.wikipedia.org/wiki/Declaratory_judgment https://en.wikipedia.org/wiki/Declaratory_judgment I may also have a tortious interference claim, although damages are likely negligible so it's probably not worth bringing any claims other than that declaratory judgement one.
  - toomuchtodo 6y ago
    Be the squeaky wheel. Thanks for your efforts.
  - Mindwipe 6y ago
    Well, I would strongly suggest you speak to a lawyer on it, but I would note this strategy only really gives you an American judgement, and the RIAA takedown would still apply in any other territory. I don't know if Github would host content where they felt there were issues in some countries and not others. Would they geofilter it as they do with Iranian contributors due to US sanctions?

squarefoot 6y ago

When men were men, every single GH user would host YT-dl in protest, then good luck to MS alienating their entire userbase. (ps. I don't have a GH account)

vaccinator 6y ago
Here, create an account and for this: https://github.com/l1ving/youtube-dl https://github.com/l1ving/youtube-dl
- vaccinator 6y ago
  Err: fork....
Minor49er 6y ago
Alternatively, just spin up your own Gitea instance, set the access restrictions as loose or as tight as you want, and call it a day

mkl95 6y ago

I think some people are missing a major point about youtube-dl's takedown. The purpose of this DMCA claim wasn't just to prevent people from downloading videos, it was to set a legal precedent for the RIAA and similar organizations to troll Github and anyone hosting public repositories with it, by linking them to "illegal downloads". By agreeing to this without any public opposition, Github has become similar to Youtube itself, in that it will be expected to immediately comply with à la carte takedown requests by RIAA and other copyright trolls from now on. It doesn't matter that the actual reason to take down your large repository is political or it simply bothers certain company for miscellaneous reasons, since all it takes is some "illegal content".

reflectiv 6y ago
I am sorry...but what would the RIAA troll Github for exactly?
- mkl95 6y ago
  Sorry if it was a bit tongue-in-cheek. The RIAA can now call Github out whenever they have an argument for them enabling downloads of copyrighted content through their repositories. And Github is expected to fix it for them.
  - apocalyptic0n3 6y ago
    I'm not sure how this is any different than how it's been for years now. GitHub has been complying with DMCA takedown requests since 2011[1]. What precedent needed to be set here? The RIAA could always do this and GitHub has been complying with it (because they legally have to). 1: https://github.com/github/dmca/ https://github.com/github/dmca/
    - mkl95 6y ago
      A lot of the things listed on the DMCA repo (if not most of them) are not software that could be used to download content, but the literal content you could obtain using them, such as textbooks, proprietary fonts, and so on. By taking down youtube-dl, Github has opened a window for copyright trolls to speculate about what a repository is used for, and take it down if one of its use cases involves downloading copyrighted content. I can see how it's legitimate to take down a repository with the sole, explicit goal of downloading copyrighted content, but youtube-dl is widely used by journalists to preserve uncopyrighted content.

cliffwarden 6y ago

Jesus, this is DeCSS all over again. Here are some creative options - https://yro.slashdot.org/story/01/02/25/1631259/the-decss-haiku https://yro.slashdot.org/story/01/02/25/1631259/the-decss-ha... - https://news.slashdot.org/story/00/09/10/2225214/decss-source-mass-posted-to-usenet https://news.slashdot.org/story/00/09/10/2225214/decss-sourc... - https://news.ycombinator.com/item?id=2098470 https://news.ycombinator.com/item?id=2098470

nbzso 6y ago

Is it not the right time to decentralise those type of services? I think it is. Isn't this site owned by Microsoft? So if it is, this is normal big corporation behaviour. They embrace open-source community to gain advantage. Is there a way to host code without being dependent on big corporation? I am really interested in the answer of this question. Public programming code must be treated like public utility. For example like water, it must be ensured that water is drinkable and properly managed, but in public domain. Is anyone remember Nestle attempt to privatise water? (https://www.insidehook.com/daily_brief/news-opinion/nestle-bottled-water-american-freshwater-supply https://www.insidehook.com/daily_brief/news-opinion/nestle-b...).

TheCraiggers 6y ago
Github is not the only player, and there are plenty of other options. Git itself is decentralized, so that's half the issue solved. Gitlab, Gerrit, and a bevvy of other web front ends for git exist, some open source, some closed. Github is still the biggest, but Gitlab is probably a close second.
delfinom 6y ago
>They embrace open-source community to gain advantage. Is there a way to host code without being dependent on big corporation? No. This is you and others being completely oblivious to law. DMCA is US law AND the US has trade agreements with other countries to similarly enforce US IP law. It does not matter if it's Microsoft or a small startup. Either they comply with DMCA or the RIAA (and others) can sue for millions in damages. Take issue with the law and push your elected officials to change them.
BlueTemplar 6y ago
Also YouTube. It's harder, but software like PeerTube works surprisingly well !

motohagiography 6y ago

Why would some brunching lawyer know what yt-dl even was unless someone who hired them was making a political play against it? Given youtube-dl is not copyrighted material the RIAA would have in its mandate, that it replicates functionality that every browser already has, and GitHub is a property of MSFT - this is basically a legal harassment play that implies we're going to need more than decentralized repositories. I'm thinking something like Kali Linux but one that tags certain code repositories as politically exposed and then mirrors them into a distribution via torrents.

th3l3mons 6y ago
Below is a link to Leonard French, a practicing copyright attorney, talking about the situation. According to him, the problem is whether or not yt-dl was designed and marketed to bypass copyright protections. Still a shit situation (re:browsers and screencaps) but it seems like this is more or less how the law is written. IANAL. https://youtu.be/wZITscblMBA https://youtu.be/wZITscblMBA

piyushpr134 6y ago

Linus gave us git to get rid of centralized repos and we web devs invented github to centralize it all. Sometimes I feel we web devs behave worse than fashion industry when it comes to blindly following random trends, making it all religious instead of logical and messing up all innovation

Chris2048 6y ago

I'm fine with this. It reminds everyone that Github is a potentially malicious layer-on-top of git that can bite you, even if they seem to be on your side. Sure, slap a clone on GH for a bit of extra traffic - but keep your main activities somewhere under your control.

optimuspaul 6y ago

am I the only one that doesn't support YouTube-dl? Are there use cases for it that are not downloading content that is not your own?

colejohnson66 6y ago
Valid question! On first thought, you would think the only reason to use it would be for media you don’t own (if you own it, you’d already have a copy). And you are probably correct. However there are valid reasons for doing so: many people have posted here that they use it for journalism (fair use) among other things. I do remember years back, LinusTechTips admitted that their video archives were just on hard drives scattered around the building. So if they needed a clip from a previous video, they’d just download the video from YouTube and “crop” down to the clip they needed.[a] [a]: They mentioned this in a video where there were building their “Vault” server that eventually turned into “Petabyte Project.”
wing-_-nuts 6y ago
There are all sorts of legit uses. There are some videos I've uploaded that I've long ago lost the original source to. Also, if I wanted to go home and see my parents, it's probably better if I download the ted talks, youtube videos etc that I might like to watch on my personal connection than theirs.
- optimuspaul 6y ago
  Downloading my own videos doesn't require something like YouTube-DL. Offline personal use of others videos does make sense.
BlueTemplar 6y ago
In the case that you were more concerned about the legality than the morality of it, you have to remember that downloading freely available videos on YouTube is perfectly legal. (Of course sharing the downloaded files is not, unless you have a copyright on them, or if they are in the public domain)

chokeartist 6y ago

Sounds like an excellent reason to migrate the git + tracker to Tor. But I imagine they will just shift to going after the lead contributors on a personal level. Such a lame use of resources on RIAA's behalf.

heavyset_go 6y ago

I kind of worried that some of the value of GitHub's data is derived from knowing which developers browsed/pulled/forked/contributed to different projects, and whether or not they or their employers could be sued for breaking licenses, infringing copyright or patents, etc. For example, Microsoft might want to know which of their former developers contributed to say WINE or ReactOS. A patent troll might want to know who pulled code that allegedly infringes their patents, so they can audit and sue their employers. The RIAA might want to know which businesses use YTDL, even if they're using it under fair use, and so on.

phendrenad2 6y ago

The actual DMCA takedown was just an excuse. I'm sure Microsoft's top brass would love to give the gift of killing youtube-dl to their friends at Google. Sort of a "you scratch my back I'll scratch yours". Maybe YouTube will stop begging users to switch from Edge to Chrome.

pippy 6y ago

The original DMCA request stated that they violated copyright by suggesting songs in their source code. While this is a dubious copyright claim, surely the easy solution is to uphold the claim by simply replacing the songs with open source items such as big buck bunny in the source?