12 ms·

Quoting from the linked torrentfreak article: > If you commit or post content to this repository that violates our Terms of Service, we will delete that conten

Quoting from the linked torrentfreak article: > If you commit or post content to this repository that violates our Terms of Service, we will delete that content and may suspend access to your account as well My reading of this is that github wants to stem the flood of garbage pull requests to their [dmca](https://github.com/github/dmca/pulls?q=is%3Apr+is%3Aclosed https://github.com/github/dmca/pulls?q=is%3Apr+is%3Aclosed) repo, which I guess is probably reasonable. I don't quite see where github is banning certain commit hashes or tree hashes on sight. I certainly respect the authors desire to not publish their repos to github (and indeed one of the nice things about git is how easy it is to self host). And I can understand not wanting others to fork the repos to github (due to objections about the company itself), but I'm not sure how I feel about adding deliberate boobytraps to repos that seems to be purely punitive.

joeyh 6y ago
It's currently posssible to make a PR to the github dmca repo that merges youtube-dl, and so violate their TOS. When you make that PR, you do not transfer any of youtube-dl to github. Their repo already has those objects. So all you have done is pushed a repo containing a specific hash, which is now a TOS violation, in that specific case at least. I wrote "Certain commit hashes are rapidly heading toward being illegal" because of that specificity.
- eminence32 6y ago
  Thanks for clarifying. I do understand that these specific hashes are effectively forbidden in the dmca repo. Are you aware of any specific instances where the presence of youtube-dl hashes in other repos have been found by github and used as the grounds for disciplinary action? That would be noteworthy indeed.
- nine_k 6y ago
  So, in addition to illegal primes, we are getting a collection of illegal random numbers? (I wonder when illegal transcendental numbers will become a thing.)
  - bathtub365 6y ago
    What are the random numbers? Commit hashes are deterministic and based on the commit contents
    - __david__ 6y ago
      I believe they were using "random" to mean "assorted" (which is perfectly cromulent).
    - jaytaylor 6y ago
      edit- thanks commenters for the correction! Git commit hashes are indeed deterministic, though it depends on the inputs. From StackOverflow [0]: Git uses the following information to generate the sha-1: * The source tree of the commit (which unravels to all the subtrees and blobs) * The parent commit sha1 * The author info (with timestamp) * The committer info (right, those are different!, also with timestamp) * The commit message [0] https://stackoverflow.com/a/34764586/293064 https://stackoverflow.com/a/34764586/293064
      - wldlyinaccurate 6y ago
        Git commit hashes _are_ deterministic. Run `git cat-file -p <hash>` on your two hashes. The timestamp in the committer field will be different. That is why the hash changed.
      - klodolph 6y ago
        It's deterministic, you've just changed the inputs. The "committer date" is usually excluded from logs so you don't see it, but it's the only missing input. Here is a demo: $ git rev-parse HEAD 78d66a4f169fec9cb9b3252f7a22bb020e967cd2 $ git log HEAD commit 78d66a4f169fec9cb9b3252f7a22bb020e967cd2 (HEAD -> master) Author: XXXX Date: Mon Nov 2 20:44:04 2020 -0500 temp2 $ git reset --soft HEAD\^ $ GIT_COMMITTER_DATE='Mon Nov 2 20:44:04 2020 -0500' GIT_AUTHOR_DATE='Mon Nov 2 20:44:04 2020 -0500' git commit -m temp2 [master 78d66a4] temp2 1 file changed, 0 insertions(+), 0 deletions(-) create mode 100644 b $ git rev-parse HEAD 78d66a4f169fec9cb9b3252f7a22bb020e967cd2
d3nj4l 6y ago
> I'm not sure how I feel about adding deliberate boobytraps to repos that seems to be purely punitive. It also feels like it would violate the license of the repository. I see that one of the author's repos is LGPL [1], which allows redistribution of the source. Restricting how that source is distributed seems to me like a violation of that license, if not in letter at least in spirit. (Of course, it goes without saying that I'm not a lawyer, which is why I said it feels like a violation.) 1: https://git.joeyh.name/index.cgi/haskell-mountpoints.git/tree/LICENSE https://git.joeyh.name/index.cgi/haskell-mountpoints.git/tre...
- NullPrefix 6y ago
  Would you please kindly delete your comment before corporate lawyers get any funny ideas.
  - judge2020 6y ago
    Can’t delete a HN comment if there is a reply to it :)
- tedunangst 6y ago
  You can't force somebody else to host your GPL code if they are not a party to the license.
- geofft 6y ago
  He's not restricting GitHub from hosting it, he's just using an artifact of GitHub's implementation (or, well, a hypothetical GitHub implementation - I'm not sure GitHub actually blocks submodules that reference the relevant commit hash?) that happens to make GitHub refuse to host it. GitHub is free to change their minds about the implementation and start accepting those commits again. That is, you, as a recipient of the code, are free to ask GitHub to host it, and to offer them a license under the terms of the GPL; GitHub is free to accept or to decline, same as if you sent me the code, I am free to host it on my personal website but I'm also free to not host it. (It would feel more like violating the spirit if it, say, prevented you from uploading it to a GitLab instance you self-host... but since you self-host it, you could just patch out any suppression code, so that case can't come up.)
jimmaswell 6y ago
I'd find it incredibly childish and needlessly divisive to make your repo impossible to host on a given provider just because you don't like the provider. This does nothing but make the tech community worse for everyone and less accessible. Newcomers shouldn't have to navigate petty politics to get started with tech and people already here shouldn't have to have their time wasted with it when they're just trying to be productive.
- ponker 6y ago
  Would you say the same about code that, for example, is designed to fail when used in a missile? E.g. navigation code that deliberately pilots into the ocean if onboard something going faster than Mach 3?
  - hyko 6y ago
    That would be outrageously unethical code to write, tantamount to criminal negligence.
    - sgtnoodle 6y ago
      I think the poster meant navigation code that was not intended to be used in a missile, being used in a missile. Consumer grade GPS units do exactly that; they intentionally stop working above a certain speed or altitude, so that they can't be used to build missiles.
      - hyko 6y ago
        There’s a big difference doing that in a consumer grade device and an open source project you publish for the world to use; i.e. when someone decides to use it in a hypersonic passenger jet
        ric2b 6y ago
        What is the difference? I don't see it, besides one having a warranty and the other explicitly stating that it offers no guarantees or support.
sillysaurusx 6y ago
I find those pull requests absolutely hilarious, but my sense of humor is lowbrow childish. https://github.com/github/dmca/pull/8210 https://github.com/github/dmca/pull/8210 https://github.com/github/dmca/pull/8207 https://github.com/github/dmca/pull/8207 https://github.com/github/dmca/pull/8203 https://github.com/github/dmca/pull/8203 https://github.com/github/dmca/pull/8202 https://github.com/github/dmca/pull/8202 DMCAs would be much better served OwO'ified.
- read_if_gay_ 6y ago
  https://github.com/github/dmca/pull/8214/commits/65ec4b0dc45d415c60df06a8d655ed598524b026 https://github.com/github/dmca/pull/8214/commits/65ec4b0dc45...
- coldpie 6y ago
  It is wonderful to see GitHub being a victim of their own refusal to implement a feature to disable pull requests on a repo.
WhyNotHugo 6y ago
It's a way of proving a point. "Hey, GitHub has stupid practices which are just terribly harmful for the community. Also, here's my source code." Someone comes along and pushes that same repo to GitHub. GitHub bans them. This is exactly what you'd been warned of!

joeyh 6y ago

It's currently posssible to make a PR to the github dmca repo that merges youtube-dl, and so violate their TOS. When you make that PR, you do not transfer any of youtube-dl to github. Their repo already has those objects. So all you have done is pushed a repo containing a specific hash, which is now a TOS violation, in that specific case at least. I wrote "Certain commit hashes are rapidly heading toward being illegal" because of that specificity.

eminence32 6y ago
Thanks for clarifying. I do understand that these specific hashes are effectively forbidden in the dmca repo. Are you aware of any specific instances where the presence of youtube-dl hashes in other repos have been found by github and used as the grounds for disciplinary action? That would be noteworthy indeed.
nine_k 6y ago
So, in addition to illegal primes, we are getting a collection of illegal random numbers? (I wonder when illegal transcendental numbers will become a thing.)
- bathtub365 6y ago
  What are the random numbers? Commit hashes are deterministic and based on the commit contents
  - __david__ 6y ago
    I believe they were using "random" to mean "assorted" (which is perfectly cromulent).
  - jaytaylor 6y ago
    edit- thanks commenters for the correction! Git commit hashes are indeed deterministic, though it depends on the inputs. From StackOverflow [0]: Git uses the following information to generate the sha-1: * The source tree of the commit (which unravels to all the subtrees and blobs) * The parent commit sha1 * The author info (with timestamp) * The committer info (right, those are different!, also with timestamp) * The commit message [0] https://stackoverflow.com/a/34764586/293064 https://stackoverflow.com/a/34764586/293064
    - wldlyinaccurate 6y ago
      Git commit hashes _are_ deterministic. Run `git cat-file -p <hash>` on your two hashes. The timestamp in the committer field will be different. That is why the hash changed.
    - klodolph 6y ago
      It's deterministic, you've just changed the inputs. The "committer date" is usually excluded from logs so you don't see it, but it's the only missing input. Here is a demo: $ git rev-parse HEAD 78d66a4f169fec9cb9b3252f7a22bb020e967cd2 $ git log HEAD commit 78d66a4f169fec9cb9b3252f7a22bb020e967cd2 (HEAD -> master) Author: XXXX Date: Mon Nov 2 20:44:04 2020 -0500 temp2 $ git reset --soft HEAD\^ $ GIT_COMMITTER_DATE='Mon Nov 2 20:44:04 2020 -0500' GIT_AUTHOR_DATE='Mon Nov 2 20:44:04 2020 -0500' git commit -m temp2 [master 78d66a4] temp2 1 file changed, 0 insertions(+), 0 deletions(-) create mode 100644 b $ git rev-parse HEAD 78d66a4f169fec9cb9b3252f7a22bb020e967cd2

d3nj4l 6y ago

> I'm not sure how I feel about adding deliberate boobytraps to repos that seems to be purely punitive. It also feels like it would violate the license of the repository. I see that one of the author's repos is LGPL [1], which allows redistribution of the source. Restricting how that source is distributed seems to me like a violation of that license, if not in letter at least in spirit. (Of course, it goes without saying that I'm not a lawyer, which is why I said it feels like a violation.) 1: https://git.joeyh.name/index.cgi/haskell-mountpoints.git/tree/LICENSE https://git.joeyh.name/index.cgi/haskell-mountpoints.git/tre...

NullPrefix 6y ago
Would you please kindly delete your comment before corporate lawyers get any funny ideas.
- judge2020 6y ago
  Can’t delete a HN comment if there is a reply to it :)
tedunangst 6y ago
You can't force somebody else to host your GPL code if they are not a party to the license.
geofft 6y ago
He's not restricting GitHub from hosting it, he's just using an artifact of GitHub's implementation (or, well, a hypothetical GitHub implementation - I'm not sure GitHub actually blocks submodules that reference the relevant commit hash?) that happens to make GitHub refuse to host it. GitHub is free to change their minds about the implementation and start accepting those commits again. That is, you, as a recipient of the code, are free to ask GitHub to host it, and to offer them a license under the terms of the GPL; GitHub is free to accept or to decline, same as if you sent me the code, I am free to host it on my personal website but I'm also free to not host it. (It would feel more like violating the spirit if it, say, prevented you from uploading it to a GitLab instance you self-host... but since you self-host it, you could just patch out any suppression code, so that case can't come up.)

jimmaswell 6y ago

I'd find it incredibly childish and needlessly divisive to make your repo impossible to host on a given provider just because you don't like the provider. This does nothing but make the tech community worse for everyone and less accessible. Newcomers shouldn't have to navigate petty politics to get started with tech and people already here shouldn't have to have their time wasted with it when they're just trying to be productive.

ponker 6y ago
Would you say the same about code that, for example, is designed to fail when used in a missile? E.g. navigation code that deliberately pilots into the ocean if onboard something going faster than Mach 3?
- hyko 6y ago
  That would be outrageously unethical code to write, tantamount to criminal negligence.
  - sgtnoodle 6y ago
    I think the poster meant navigation code that was not intended to be used in a missile, being used in a missile. Consumer grade GPS units do exactly that; they intentionally stop working above a certain speed or altitude, so that they can't be used to build missiles.
    - hyko 6y ago
      There’s a big difference doing that in a consumer grade device and an open source project you publish for the world to use; i.e. when someone decides to use it in a hypersonic passenger jet
      - ric2b 6y ago
        What is the difference? I don't see it, besides one having a warranty and the other explicitly stating that it offers no guarantees or support.

sillysaurusx 6y ago

I find those pull requests absolutely hilarious, but my sense of humor is lowbrow childish. https://github.com/github/dmca/pull/8210 https://github.com/github/dmca/pull/8210 https://github.com/github/dmca/pull/8207 https://github.com/github/dmca/pull/8207 https://github.com/github/dmca/pull/8203 https://github.com/github/dmca/pull/8203 https://github.com/github/dmca/pull/8202 https://github.com/github/dmca/pull/8202 DMCAs would be much better served OwO'ified.

read_if_gay_ 6y ago
https://github.com/github/dmca/pull/8214/commits/65ec4b0dc45d415c60df06a8d655ed598524b026 https://github.com/github/dmca/pull/8214/commits/65ec4b0dc45...
coldpie 6y ago
It is wonderful to see GitHub being a victim of their own refusal to implement a feature to disable pull requests on a repo.

WhyNotHugo 6y ago

It's a way of proving a point. "Hey, GitHub has stupid practices which are just terribly harmful for the community. Also, here's my source code." Someone comes along and pushes that same repo to GitHub. GitHub bans them. This is exactly what you'd been warned of!