29 ms·

It seems like EFF fought for youtube-dl and GitHub used their letter as legal firepower to bring the repo back online. If GitHub were fighting for the developer

by ryanar 6y ago

It seems like EFF fought for youtube-dl and GitHub used their letter as legal firepower to bring the repo back online. If GitHub were fighting for the developer they would have funded the attorney, right? Though from their blog post it does look like they are taking steps to fund defense in the future as well as other steps to improve the situation. Reading EFFs claim is pretty interesting, they state that saving a copy of a video is only one function of youtube-dl. I think the biggest problem is the name is called "youtube download", it is sort of difficult to downplay that saving a copy is only one function when the name implies it is the main purpose of the program.

TechBro8615 6y ago
AFAIU the argument is more that youtube-dl is effectively a web browser and doesn’t do anything that a web browser doesn’t do. Further, it does not include any “secret” key for DRM circumvention like might be bundled with e.g. Chrome in the case of Widevine, where browser vendors agree to protect the secret key.
- kmeisthax 6y ago
  Right, but the law makes no mention of secret keys, it just says you can't go around anything that controls access to a copyright work; and you can't provide tools to do so. The actual legal definition of tools covers both actual technical purpose as well as marketed purpose. Rebranding, say, OBS as "Recorder for YouTube" and talking about how you can use it to get around YouTube's downloading protections by screencapping the entire video would possibly constitute a 1201 violation. There's also another question of law, though: does 1201 apply when only the intent of the DRM has been circumvented, as opposed to it's technical scope? In other words, does pointing a camera at a monitor constitute circumvention of DRM under section 1201? Most DRM can't actually validate, say, that a human is watching instead of a camcorder. (Let's ignore pesky things like Cinavia which are more akin to post-piracy frustration techniques, and easily circumvented with any kind of Free media player.) Likewise, YouTube's rolling cipher can't really validate that it's not sitting inside of an instrumented browser that will dump whatever URLs it grabs. Our hypothetical OBS rebrand wouldn't actually be a 1201 violation unless the law specifically covers things that DRM can't technically enforce but would like to.
  - mox1 6y ago
    The rebuttal to your reasoning is in the letter. Basically a federal judge has previously ruled that utilizing a publicly available password is not circumvention of a copyright protection mechanism. The code containing the "sig" (as google calls it) or "rolling cipher" (as RIAA calls it) is available to anyone by viewing the JavaScript. This sig / cipher being public means it is not a copyright protection mechanism.
    - toyg 6y ago
      > This sig / cipher being public means it is not a copyright protection mechanism. I can see this as ending up with Youtube being forced to require sign-ins. Massive expense for Google. Then Youtube-dl adds one parameter for the password, and we're back to square one.
      - jtbayly 6y ago
        You already have to sign in to view some videos, don’t you? Does YT-dL not have a way to handle those right now?
        OJFord 6y ago
        Do you? I've never tried to watch any that have required it. Maybe there's Red-only content that isn't advertised/recommended to non-subscribers?
        monokh 6y ago
        Content with a certain age threshold triggers login. The last time I looked at this, embedding these videos was still possible without logging in. So there are definitely ways in accessing the content without authentication.
        OJFord 6y ago
        Hm. If embedding works maybe my ad-blocking is sufficient; or I just haven't come across any that require it. I mostly just watch woodworkers/machinists/electronics/etc. Sort of conceivable it could be age restricted but would also be surprising.
- shbooms 6y ago
  that's how understood it as well: "youtube-dl stands in place of a Web browser and performs a similar function with respect to user-uploaded videos. Importantly, youtube-dl does not decrypt video streams that are encrypted with commercial DRM technologies, such as Widevine, that are used by subscription video sites, such as Netflix." "We presume that this “signature” code is what RIAA refers to as a “rolling cipher,” although YouTube’s JavaScript code does not contain this phrase. Regardless of what this mechanism is called, youtube-dl does not “circumvent” it as that term is defined in Section 1201(a) of the Digital Millennium Copyright Act, because YouTube provides the means of accessing these video streams to anyone who requests them. As federal appeals court recently ruled, one does not “circumvent” an access control by using a publicly available password. Circumvention is limited to actions that “descramble, decrypt, avoid, bypass, remove, deactivate or impair a technological measure,” without the authority of the copyright owner."
  - saagarjha 6y ago
    I would be curious if YouTube's code contained any phrases at all considering it gets minified.
    - raxxorrax 6y ago
      Me too and it would be interesting if such phrases would be valid if not human readable.
  - Wowfunhappy 6y ago
    I wonder where the phrase “rolling cipher” actually comes from. Did the RIAA just make it up?
    - klmr 6y ago
      The (English) phrase is used verbatim in the (German) 2017 LG Hamburg claim and verdict. It is not explained there, nor did the claimant explain where they got it from. I’m assuming that it’s based on a misunderstanding of “rolling codes” [1], an actual cryptographic technique, which isn’t applied here (the only overlap is that the “s” parameter of the YouTube video URI varies for certain videos; and, well, the key in rolling codes also varies). Interestingly that verdict also claims that URL encoding is a valid, effective encryption measure (I’m not kidding! See [2]; the German word here is “Prozentcodierung”, i.e. percent-encoding). The court in question (LG Hamburg) is infamous in Germany for its technically illiterate, consistently laughable verdicts in IT-related cases (this isn’t a recent thing — it’s been going on for about two decades). [1] https://en.wikipedia.org/wiki/Rolling_code https://en.wikipedia.org/wiki/Rolling_code [2] http://www.rechtsprechung-hamburg.de/jportal/portal/page/bsharprod.psml?doc.id=JURE180006255&st=ent&doctyp=juris-r&showdoccase=1&paramfromHL=true#rd_6 http://www.rechtsprechung-hamburg.de/jportal/portal/page/bsh...
- Aissen 6y ago
  If a program had its own implementation of widevine, why wouldn't you also be "effectively a web browser" ?
  - ldjb 6y ago
    Sure, it would be "effectively a web browser". But it would also require a secret key. If the program is not licensed to hold the key, that could be considered circumvention.
    - Aissen 6y ago
      Other browsers have the key, why would this one be different ?
      - roywiggins 6y ago
        Because they have a license.
        yellowapple 6y ago
        So if a program used a licensed browser as an intermediary to obtain Widevine-protected content, would that be circumvention?
        Aissen 6y ago
        I even sidestepped the obvious of loading widevine.so, running it, symbolic execution, etc. It's mostly a thought experiment to show how everything is stupid in the end. I'm afraid in a few months/years, we'll see the hardware security level to become mandatory for Netflix, etc. And then YouTube.
        jbay808 6y ago
        In the old days, someone who wanted to send you this kind of content would build and sell hardware for you to receive and play it (like a DVD player). Online streaming services have, in part, scaled so quickly because they run on the general-purpose computers that people already own. So they don't need to bear that hardware cost. These general purpose computers have been fertile soil to grow and nurture the seeds that software companies scatter to the winds. How interesting it would be if it comes full circle with specialized hardware being required on each PC to receive the content stream.
- feanaro 6y ago
  I called this a couple of times[1][2] so it is nice to finally see someone else make this argument. It seems obvious to me. [1]: https://news.ycombinator.com/item?id=25006577 https://news.ycombinator.com/item?id=25006577 [2]: https://news.ycombinator.com/item?id=24997072 https://news.ycombinator.com/item?id=24997072
- rzwitserloot 6y ago
  That's a DMCA argument (I'm not hacking). But it doesn't really work: If you protect your house with no lock, not even a door, but just a little rope with a sign on: "Do not jump over or duck under this ribbon, or cut it!", that's, for the DMCA, enough - so you get into fun games where you claim that, say, a long random unique key that is right there in the HTML youtube.com serves which links to the video is a 'security measure' and that 'I shall read the URLs in this <video> tag and download what I find there instead of showing it on the screen' is 'circumventing this'. How far can you stretch the meaning of 'circumventing access-control measures' before, in court, you lose your argument? I don't think anybody quite knows yet, but surely github doesn't want to be on the hook for it without microsoft's legal team and management signing off on the risk. Furthermore, separate from DMCA's hacking provisions, there is simply the concept of who is responsible for any copyright infringement caused by stuff github hosts. As per 17 USC §512 (the so-called 'safe harbor provision'), the idea of claiming 'hey I just host this stuff, I'm not responsible for this, why dont you take it up with whomever uploaded this' is codified: You can do that, but it does mean that you _MUST_ take down the content in response to a takedown notice, and if you don't, then you are now liable any infringement that content makes. The idea is that the owner of the data files a counterclaim notice, at which point the hoster (github) is free to re-host everything without opening itself up to liability, but only if, as per 17 USC §512, they do so 'no less than 10 days and no more than 14', and github did it in 1 day, so whoopsie there I guess. At that point it does turn into a fight between claimer and counterclaimer: The idea behind those 10 days is that the supposed real content owner can then go file in court against the counterclaimer; merely filing a lawsuit is enough: Show that to the hoster (github), and they can no longer re-enable the content without then being liable for infringement by doing so. You can't file a counterclaim until your content is removed. Yeah, that means an utter bozo can take your content down for at least 10 days and there is nothing you can do about this. The DMCA is not particularly well designed in this manner (it doesn't protect against trolly crud well, and getting a barratry verdict in the US is borderline impossible). But that's how it works. In github's shoes, the fact that youtube-dl doesn't infringe is relevant only insofar that they are willing to ride that notion allllll the way to the gavel in the ensuing court case, because they will be defendants if they ignore the takedown request. Presumably they weren't going to just do that without at least a close look by microsoft's legal team, and a signoff from the big wigs for the likely millions this will cost, given that US law in these matters is... well, have you ever seen one of those shows where 2 people are on a beam and trying to knock the other one off with a giant q-tip? US law is like that, except the ends of the q-tips are moneybags.
- jonplackett 6y ago
  I wonder if the RIAA will now be putting pressure on YouTube to use the same DRM as Netflix, so that when a video is downloaded they can’t use this ‘it’s just a browser guv’ defence because there would then have to be some circumvention to make it work.
globular-toast 6y ago
Whenever you watch a video you are downloading it. youtube-dl merely gives you control over where that stream goes, whether it's to a hard disk or to a media player like the regular Youtube.
- bigbubba 6y ago
  The point is that youtube-dl does more than just download videos. It can also be used for downloading metadata. I use -J to download metadata formatted as JSON.
  - boogies 6y ago
    How much of that metadata is not normally downloaded alongside the video?
    - bigbubba 6y ago
      Plenty of it? I regularly download the metadata and subtitles of entire channels or playlists so that I can search for specific words or phrases in thousands of hours of video. I know of no other way to accomplish this.
      - boogies 6y ago
        Subtitles are a perfect example of data that any normal browser downloads if you click CC, and can even be ^F'd if you click ‘Show Transcript’ on YouTube, but just happen to be orders of magnitude more useful if you control where they download to. I think you’re proving globular-toast’s point.
        bigbubba 6y ago
        Subtitles are not video, so no. And I'd like to see you visit a thousand video pages with an RIAA approved browser and ^F on each of them. Nice joke!
mschuster91 6y ago
> If GitHub were fighting for the developer they would have funded the attorney, right? By expressively taking the side of the accused (such as paying their attorney), Github could have opened themselves to being liable for whatever youtube-dl does. Having the EFF as an independent party sidesteps that issue.
kodah 6y ago
Open question to HackerNews: are there big tech firms that give lobbying money to free software lobbyists? Feel free to highlight them here. I'd rather cut this problem off at the head than sit around and establish legal defense funds if possible. I'm glad GitHub and Microsoft could help contribute to this victory though.
- kovek 6y ago
  > I'd rather cut this problem off at the head I don't understand what you mean by this! I know it's an expression or a way of saying something, but I don't understand what you mean
  - deleted 6y ago
    [deleted]
  - throwaway373438 6y ago
    They are suggesting lobbying to change the law, rather than struggling with current law in court.
    - bluGill 6y ago
      Don't lobby. go to your local caucus and change it from within. Note that I said Caucus: even in a primary state there is some form of caucus where the party decides things. You want to be in this system, this is where the party platform is decided on. This is where the people who are working behind the scene to elect someone make the plans. In turn this is where politicians go to find people who will work for them. Which in turn means this is where you can have a one-on-one meeting from the standpoint of someone important to listen to. (when you spend a few Saturdays knocking on potential voters doors for someone that someone listens to you) If both parties get anti-DRM legislation into the platform in random places you can be assured they will listen. If both parties see their big supporters as against something they will listen. Politicians do not want money, contrary to what you might think: they want a power, and in this country that means they need votes. Money (for ads) is one way to get votes, but real humans doing real work is at least as powerful.
wintorez 6y ago
EEF deserves every penny of donation they receive.
- dylan604 6y ago
  The EFF might deserve it more though
  - wintorez 6y ago
    Couldn't agree more: https://supporters.eff.org/donate/ https://supporters.eff.org/donate/
    - adtac 6y ago
      not sure if you noticed, but the parent comment was joking about your typo -- you said EEF, not EFF :)
      - wintorez 6y ago
        Oh! I see... well... my bad... ¯\_(ツ)_/¯
Rochus 6y ago
I don't believe that Github actually needed the EFF's writing for this, or that they don't have the necessary technical expertise themselves. That is probably rather a protective assertion not to lose face. But at least they seem to have learned something from it now and want to review such requests technically before they (unjustifiably) act.
- TheKarateKid 6y ago
  This. Github is acting like the knight in shining armor, but they really didn't do anything except respond to the backlash their complicit no-questions-asked removal caused.
  - TechBro8615 6y ago
    On the contrary, they’re doing a lot, including establishing a $1M legal defense fund for developers and a technical team to review the validity of anti-circumvention DMCA notices. It seems like they’re doing a lot more than just paying lip service to EFF / developer freedom, and they should be commended for it.
    - TheKarateKid 6y ago
      They’re correcting a wrong because their reputation took a big hit in the dev community. Now there’s big talk of the dangers of not self-hosting your repo and the monoculture of using GitHub. Although it probably has good intent, this is largely PR.
      - Vorh 6y ago
        Even if largely PR, that's still a million dollars.
        woofie11 6y ago
        After Nat's cynically duplicitous comments and actions, it's hard to view this as anything other than PR. A $1 million expense is not a big advertising expense for github. It was a $7.5 billion sale. Microsoft spend 0.013% of that on this PR piece. I can't imagine the fallout from this didn't wipe several times that off of github's valuation. If github had done this before the EFF letter, it would have been something else. With the EFF letter, they have zero liability to reinstating the repo, and are borderline legally required to do so.
Fumtumi 6y ago
Lets assume, for once, that what they wrote, is what they stand for. I think this is a very very good / exemplary reaction.
- remram 6y ago
  Why didn't they start with youtube-dl though? They will defend developers and err on their side "going forward" but no not that one? Surely they already had the legal manpower when the youtube-dl removal started making waves. The fact that they did nothing for over three weeks and are publishing this blog post right after the issue was fixed by someone else (EFF) makes it hard to believe their "changes".
  - JokerDan 6y ago
    In large organisations, with lots of tape actually getting the ball rolling on what is proposed with all the sign offs, funds allocated, people/resource allocated for the tasks.... It takes months, not weeks. They probably published this off the back of a signed off proposal and may start implementing off the back of it early next year.
  - Fumtumi 6y ago
    My daily work is often not adhoc or that fast; I'm not sure why this is so unrelatable to you but for me, daily business is, that things just take 1-3 weeks. Legal manpower still means, that people interrupt their current tasks, which they properly have plenty of, to reprioritize something, others might even not care about at all or never heard of. I stay with my statement and i have enough live experience, that i don't expect a 3 minute solution and answer from github.com
    - remram 6y ago
      I didn't expect any "3 minute solution", but realistically they didn't even have to get the problem fixed. They could have pledged to assist youtube-dl by now, helped them file a counter-notice sometime this week (surely they can get 1 lawyer's time for pressing PR matters), and figured out how to deal with the human resource situation over the coming months. Instead they found a million dollars (!!!), wrote a blog post with explicit commitments, but then waited on somebody else to step up. It just doesn't add up.
ponker 6y ago
When Microsoft and the RIAA square off, the letter of the law isn’t really the battlefield. The battlefield is influence with the US Senate, and the EFF, while well regarded, is a Sancho Panza compared to Microsoft.
- AsyncAwait 6y ago
  Microsoft won't square off with the RIAA since they're part of it.
  - psadauskas 6y ago
    So Microsoft sent a bogus DMCA takedown request to Microsoft, and the non-profit EFF had to respond to keep Microsoft from suing Microsoft? Microsoft also has a program for matching employee donations to non-profits, so its likely Microsoft has also given money to the EFF as well.
    - AsyncAwait 6y ago
      I guess that's one way to put it :-D 2020 sure is a strange year.
NoSalt 6y ago
To be honest, I had no idea youtube-dl did anything else other than download YouTube videos. What other functions does it have?
- seba_dos1 6y ago
  "Downloading" doesn't mean "saving a copy" (unless you count "saving a temporary copy of its chunks in RAM"...). Most of my youtube-dl usage comes from its mpv integration, so the video is simply streamed directly for playback.
- calcifer 6y ago
  It supports a lot of video sources [1], not just Youtube. [1] https://github.com/ytdl-org/youtube-dl/tree/3f1748b9445e9d9367d29221c4b7bf9b88895e4e/youtube_dl/extractor https://github.com/ytdl-org/youtube-dl/tree/3f1748b9445e9d93...
  - arbaal 6y ago
    I was suprised today that it supports downloaded videos on reddit too.
- dredmorbius 6y ago
  youtube-dl is a networked multimedia swiss army knife supporting many operations and manipulations of audio, video, metadata, and auxiliary content from many video and audio hosting sites and platforms, as well as serving as an access layer for several playback tools, including mps-youtube, mpv, and VLC.
- npteljes 6y ago
  It supports audio-only sites too. I personally sync my favourites on Mixcloud with it.
- maeln 6y ago
  It support a gigantic amount of website, including audio one. Most of the time, I use it to have an offline copy of a podcast, radio show or some video that I might need to look at wherever I am not guarantee to have an internet connexion (very useful when travelling). It also has a lot of useful option like downloading the audio only of a video, choosing the quality of the video/audio which might be hidden in the website you are trying to watch it from, download subtitle (this is just so useful), you can pass ffmpeg options also to post-process the video in one go, ... There is just so many thing you can do with it. One last example : one of my computer really struggle to watch video/stream directly from the browser (for whatever reason), but with youtube-dl I can stream directly to VLC/MPV and it use 1/10 the CPU comparing to watching the same video in the browser.
deleted 6y ago
[deleted]
duxup 6y ago
Also their examples in their docs for youtube-dl included copyrighted content ... I'll let the lawyers debate that whole thing, but IMO I think that was a bit of a mistake / bad idea. Granted, fixable, but maybe a lesson of something to avoid.
app4soft 6y ago
> It seems like EFF fought for youtube-dl and GitHub used their letter as legal firepower to bring the repo back online. I'm at least one of those who requested EFF to take a look on "The RIAA’s attack on YouTube-dl is not a DMCA 512 infringement" thread.[0,1] [0] https://twitter.com/app4soft/status/1320617082866847746 https://twitter.com/app4soft/status/1320617082866847746 [1] https://news.ycombinator.com/item?id=24888234 https://news.ycombinator.com/item?id=24888234
jjeaff 6y ago
How has youtube not sent a cease and desist for the name youtube-dl? They would most definitely have a case that the name makes it appear to be a youtube product. Would a cease and desist for the name only somehow imply that google has no issue with the functionality? Because I know not protecting your trademark can lead to dilution. And by issuing takedown notices, they are showing that they are aware of the existence of this usage of the youtube trademark.
- asperous 6y ago
  Youtube has to realize that a significant amount of content that people watch on its site is reaction, commentary, compilations, and other recycled content. I think its for this reason that they don't go after these projects very aggressively.
  - hombre_fatal 6y ago
    It's just arbitrary. There's prob even a low-sev ticket somewhere in Youtube's issue tracker to take out youtube-dl. They can do it at any time. That they haven't done it (make youtube-dl's life harder) yet just means they might do it tomorrow, not that they don't care.
sneak 6y ago
GitHub is owned by Microsoft, who is a member of the RIAA who created this legal action. For Microsoft to pay for the lawyers to take it down (via their RIAA membership payments) and also pay for the lawyers to keep it up seems... rather silly.
- mmcdermott 6y ago
  From the outside in, there are a lot of aspects of the legal system that look like this - welfare for lawyers. Unfortunately, fixing it requires changing the law and we've made of practice of sending a lot of lawyers to Capitol Hill who are very sympathetic to the needs of lawyers. It's probably the biggest self-perpetuating interest group there is.
lscotte 6y ago
Actually it seems more like the EFF had nothing to do with it at all and the unit test patch is the reason it was restored - just like Github says in the blog entry.
tubbyjr 6y ago
i have ytdl bound to some macros on my browser, so i can stream videos outside of the browser for accessibility reasons
1vuio0pswjnm7 6y ago
Add to this that the original author recently posted a story about the origins of the youtube-dl script admitting it was designed to do:- download YouTube videos and name the downloaded files appropriately. https://rg3.name/202011071352.html https://rg3.name/202011071352.html Under DMCA, neither writing a script like youtube-dl nor using it is prohibited (making an unauthorised copy of a video could be fair use).FN1 Section 1201 however prohibits distributing the script to others. Thus, the author of the script who "releases" (distributes) it is not necessarily the only one who might be violating the DMCA. Any recipient of the script who distributes it further, e.g., Microsoft, could be violating the DMCA as well. FN 1. Section 1201 prohibits distributing technology that is designed to circumvent either "access controls" and/or "copy controls". Similarly, the act of circumventing "access controls" is prohibited. However, the act of circumventing "copy controls" is not explicitly prohibited. Making unauthorised copies, e.g., downloading YouTube videos, is subject to the defense of fair use. It is arguable that youtube-dl is only designed to circumvent "copy controls". As others in the thread point out, there are generally no "access controls" on YouTube videos, e.g., password protection. There could be exceptions. If youtube-dl is designed to circumvent geographic or age restrictions, would those be considered "access controls". Aside from DMCA concerns, Google's Terms of Service for YouTube would appear to prohibit use of youtube-dl: "The following restrictions apply to your use of the Service. You are not allowed to: 1. access, reproduce, download, distribute, transmit, broadcast, display, sell, license, alter, modify or otherwise use any part of the Service or any Content except: (a) as expressly authorized by the Service; or (b) with prior written permission from YouTube and, if applicable, the respective rights holders; 2. circumvent, disable, fraudulently engage with, or otherwise interfere with any part of the Service (or attempt to do any of these things), including security-related features or features that (a) prevent or restrict the copying or other use of Content or (b) limit the use of the Service or Content; 3. access the Service using any automated means (such as robots, botnets or scrapers) except (a) in the case of public search engines, in accordance with YouTube's robots.txt file; or (b) with YouTube's prior written permission;" https://www.youtube.com/static?template=terms https://www.youtube.com/static?template=terms Would these TOS be enforceable if challenged. #1 makes no allowance for fair use. What do you think.
RoutinePlayer 6y ago
Honestly, the name is problematic. Why do some developers insist on bad names? Stop the bad names .. unpronounceable crap like xoyx-mp4, zycx10 should also be avoided .. what's wrong with vidl, or something simple like that? .. I'm half joking, but it's worth underscoring.
- Bqhatevwr 6y ago
  They literally had a test case in the repo for circumventing copy protection on youtube. I'm somewhat baffled they managed to get the repo reinstated given that's very much a violation of the DMCA.
  - dodobirdlord 6y ago
    The argument is that it doesn’t do anything that a web browser doesn’t do already, and there’s established precedent that it’s not “circumventing copyright” if it requires no secret knowledge.
joshspankit 6y ago
An important point: There are many videos on YouTube that are 100% legal to download.

by ryanar 6y ago

TechBro8615 6y ago

AFAIU the argument is more that youtube-dl is effectively a web browser and doesn’t do anything that a web browser doesn’t do. Further, it does not include any “secret” key for DRM circumvention like might be bundled with e.g. Chrome in the case of Widevine, where browser vendors agree to protect the secret key.

kmeisthax 6y ago
Right, but the law makes no mention of secret keys, it just says you can't go around anything that controls access to a copyright work; and you can't provide tools to do so. The actual legal definition of tools covers both actual technical purpose as well as marketed purpose. Rebranding, say, OBS as "Recorder for YouTube" and talking about how you can use it to get around YouTube's downloading protections by screencapping the entire video would possibly constitute a 1201 violation. There's also another question of law, though: does 1201 apply when only the intent of the DRM has been circumvented, as opposed to it's technical scope? In other words, does pointing a camera at a monitor constitute circumvention of DRM under section 1201? Most DRM can't actually validate, say, that a human is watching instead of a camcorder. (Let's ignore pesky things like Cinavia which are more akin to post-piracy frustration techniques, and easily circumvented with any kind of Free media player.) Likewise, YouTube's rolling cipher can't really validate that it's not sitting inside of an instrumented browser that will dump whatever URLs it grabs. Our hypothetical OBS rebrand wouldn't actually be a 1201 violation unless the law specifically covers things that DRM can't technically enforce but would like to.
- mox1 6y ago
  The rebuttal to your reasoning is in the letter. Basically a federal judge has previously ruled that utilizing a publicly available password is not circumvention of a copyright protection mechanism. The code containing the "sig" (as google calls it) or "rolling cipher" (as RIAA calls it) is available to anyone by viewing the JavaScript. This sig / cipher being public means it is not a copyright protection mechanism.
  - toyg 6y ago
    > This sig / cipher being public means it is not a copyright protection mechanism. I can see this as ending up with Youtube being forced to require sign-ins. Massive expense for Google. Then Youtube-dl adds one parameter for the password, and we're back to square one.
    - jtbayly 6y ago
      You already have to sign in to view some videos, don’t you? Does YT-dL not have a way to handle those right now?
      - OJFord 6y ago
        Do you? I've never tried to watch any that have required it. Maybe there's Red-only content that isn't advertised/recommended to non-subscribers?
        monokh 6y ago
        Content with a certain age threshold triggers login. The last time I looked at this, embedding these videos was still possible without logging in. So there are definitely ways in accessing the content without authentication.
        OJFord 6y ago
        Hm. If embedding works maybe my ad-blocking is sufficient; or I just haven't come across any that require it. I mostly just watch woodworkers/machinists/electronics/etc. Sort of conceivable it could be age restricted but would also be surprising.
shbooms 6y ago
that's how understood it as well: "youtube-dl stands in place of a Web browser and performs a similar function with respect to user-uploaded videos. Importantly, youtube-dl does not decrypt video streams that are encrypted with commercial DRM technologies, such as Widevine, that are used by subscription video sites, such as Netflix." "We presume that this “signature” code is what RIAA refers to as a “rolling cipher,” although YouTube’s JavaScript code does not contain this phrase. Regardless of what this mechanism is called, youtube-dl does not “circumvent” it as that term is defined in Section 1201(a) of the Digital Millennium Copyright Act, because YouTube provides the means of accessing these video streams to anyone who requests them. As federal appeals court recently ruled, one does not “circumvent” an access control by using a publicly available password. Circumvention is limited to actions that “descramble, decrypt, avoid, bypass, remove, deactivate or impair a technological measure,” without the authority of the copyright owner."
- saagarjha 6y ago
  I would be curious if YouTube's code contained any phrases at all considering it gets minified.
  - raxxorrax 6y ago
    Me too and it would be interesting if such phrases would be valid if not human readable.
- Wowfunhappy 6y ago
  I wonder where the phrase “rolling cipher” actually comes from. Did the RIAA just make it up?
  - klmr 6y ago
    The (English) phrase is used verbatim in the (German) 2017 LG Hamburg claim and verdict. It is not explained there, nor did the claimant explain where they got it from. I’m assuming that it’s based on a misunderstanding of “rolling codes” [1], an actual cryptographic technique, which isn’t applied here (the only overlap is that the “s” parameter of the YouTube video URI varies for certain videos; and, well, the key in rolling codes also varies). Interestingly that verdict also claims that URL encoding is a valid, effective encryption measure (I’m not kidding! See [2]; the German word here is “Prozentcodierung”, i.e. percent-encoding). The court in question (LG Hamburg) is infamous in Germany for its technically illiterate, consistently laughable verdicts in IT-related cases (this isn’t a recent thing — it’s been going on for about two decades). [1] https://en.wikipedia.org/wiki/Rolling_code https://en.wikipedia.org/wiki/Rolling_code [2] http://www.rechtsprechung-hamburg.de/jportal/portal/page/bsharprod.psml?doc.id=JURE180006255&st=ent&doctyp=juris-r&showdoccase=1&paramfromHL=true#rd_6 http://www.rechtsprechung-hamburg.de/jportal/portal/page/bsh...
Aissen 6y ago
If a program had its own implementation of widevine, why wouldn't you also be "effectively a web browser" ?
- ldjb 6y ago
  Sure, it would be "effectively a web browser". But it would also require a secret key. If the program is not licensed to hold the key, that could be considered circumvention.
  - Aissen 6y ago
    Other browsers have the key, why would this one be different ?
    - roywiggins 6y ago
      Because they have a license.
      - yellowapple 6y ago
        So if a program used a licensed browser as an intermediary to obtain Widevine-protected content, would that be circumvention?
        Aissen 6y ago
        I even sidestepped the obvious of loading widevine.so, running it, symbolic execution, etc. It's mostly a thought experiment to show how everything is stupid in the end. I'm afraid in a few months/years, we'll see the hardware security level to become mandatory for Netflix, etc. And then YouTube.
        jbay808 6y ago
        In the old days, someone who wanted to send you this kind of content would build and sell hardware for you to receive and play it (like a DVD player). Online streaming services have, in part, scaled so quickly because they run on the general-purpose computers that people already own. So they don't need to bear that hardware cost. These general purpose computers have been fertile soil to grow and nurture the seeds that software companies scatter to the winds. How interesting it would be if it comes full circle with specialized hardware being required on each PC to receive the content stream.
feanaro 6y ago
I called this a couple of times[1][2] so it is nice to finally see someone else make this argument. It seems obvious to me. [1]: https://news.ycombinator.com/item?id=25006577 https://news.ycombinator.com/item?id=25006577 [2]: https://news.ycombinator.com/item?id=24997072 https://news.ycombinator.com/item?id=24997072
rzwitserloot 6y ago
That's a DMCA argument (I'm not hacking). But it doesn't really work: If you protect your house with no lock, not even a door, but just a little rope with a sign on: "Do not jump over or duck under this ribbon, or cut it!", that's, for the DMCA, enough - so you get into fun games where you claim that, say, a long random unique key that is right there in the HTML youtube.com serves which links to the video is a 'security measure' and that 'I shall read the URLs in this <video> tag and download what I find there instead of showing it on the screen' is 'circumventing this'. How far can you stretch the meaning of 'circumventing access-control measures' before, in court, you lose your argument? I don't think anybody quite knows yet, but surely github doesn't want to be on the hook for it without microsoft's legal team and management signing off on the risk. Furthermore, separate from DMCA's hacking provisions, there is simply the concept of who is responsible for any copyright infringement caused by stuff github hosts. As per 17 USC §512 (the so-called 'safe harbor provision'), the idea of claiming 'hey I just host this stuff, I'm not responsible for this, why dont you take it up with whomever uploaded this' is codified: You can do that, but it does mean that you _MUST_ take down the content in response to a takedown notice, and if you don't, then you are now liable any infringement that content makes. The idea is that the owner of the data files a counterclaim notice, at which point the hoster (github) is free to re-host everything without opening itself up to liability, but only if, as per 17 USC §512, they do so 'no less than 10 days and no more than 14', and github did it in 1 day, so whoopsie there I guess. At that point it does turn into a fight between claimer and counterclaimer: The idea behind those 10 days is that the supposed real content owner can then go file in court against the counterclaimer; merely filing a lawsuit is enough: Show that to the hoster (github), and they can no longer re-enable the content without then being liable for infringement by doing so. You can't file a counterclaim until your content is removed. Yeah, that means an utter bozo can take your content down for at least 10 days and there is nothing you can do about this. The DMCA is not particularly well designed in this manner (it doesn't protect against trolly crud well, and getting a barratry verdict in the US is borderline impossible). But that's how it works. In github's shoes, the fact that youtube-dl doesn't infringe is relevant only insofar that they are willing to ride that notion allllll the way to the gavel in the ensuing court case, because they will be defendants if they ignore the takedown request. Presumably they weren't going to just do that without at least a close look by microsoft's legal team, and a signoff from the big wigs for the likely millions this will cost, given that US law in these matters is... well, have you ever seen one of those shows where 2 people are on a beam and trying to knock the other one off with a giant q-tip? US law is like that, except the ends of the q-tips are moneybags.
jonplackett 6y ago
I wonder if the RIAA will now be putting pressure on YouTube to use the same DRM as Netflix, so that when a video is downloaded they can’t use this ‘it’s just a browser guv’ defence because there would then have to be some circumvention to make it work.

globular-toast 6y ago

Whenever you watch a video you are downloading it. youtube-dl merely gives you control over where that stream goes, whether it's to a hard disk or to a media player like the regular Youtube.

bigbubba 6y ago
The point is that youtube-dl does more than just download videos. It can also be used for downloading metadata. I use -J to download metadata formatted as JSON.
- boogies 6y ago
  How much of that metadata is not normally downloaded alongside the video?
  - bigbubba 6y ago
    Plenty of it? I regularly download the metadata and subtitles of entire channels or playlists so that I can search for specific words or phrases in thousands of hours of video. I know of no other way to accomplish this.
    - boogies 6y ago
      Subtitles are a perfect example of data that any normal browser downloads if you click CC, and can even be ^F'd if you click ‘Show Transcript’ on YouTube, but just happen to be orders of magnitude more useful if you control where they download to. I think you’re proving globular-toast’s point.
      - bigbubba 6y ago
        Subtitles are not video, so no. And I'd like to see you visit a thousand video pages with an RIAA approved browser and ^F on each of them. Nice joke!

mschuster91 6y ago

> If GitHub were fighting for the developer they would have funded the attorney, right? By expressively taking the side of the accused (such as paying their attorney), Github could have opened themselves to being liable for whatever youtube-dl does. Having the EFF as an independent party sidesteps that issue.

kodah 6y ago

Open question to HackerNews: are there big tech firms that give lobbying money to free software lobbyists? Feel free to highlight them here. I'd rather cut this problem off at the head than sit around and establish legal defense funds if possible. I'm glad GitHub and Microsoft could help contribute to this victory though.

kovek 6y ago
> I'd rather cut this problem off at the head I don't understand what you mean by this! I know it's an expression or a way of saying something, but I don't understand what you mean
- deleted 6y ago
  [deleted]
- throwaway373438 6y ago
  They are suggesting lobbying to change the law, rather than struggling with current law in court.
  - bluGill 6y ago
    Don't lobby. go to your local caucus and change it from within. Note that I said Caucus: even in a primary state there is some form of caucus where the party decides things. You want to be in this system, this is where the party platform is decided on. This is where the people who are working behind the scene to elect someone make the plans. In turn this is where politicians go to find people who will work for them. Which in turn means this is where you can have a one-on-one meeting from the standpoint of someone important to listen to. (when you spend a few Saturdays knocking on potential voters doors for someone that someone listens to you) If both parties get anti-DRM legislation into the platform in random places you can be assured they will listen. If both parties see their big supporters as against something they will listen. Politicians do not want money, contrary to what you might think: they want a power, and in this country that means they need votes. Money (for ads) is one way to get votes, but real humans doing real work is at least as powerful.

wintorez 6y ago

EEF deserves every penny of donation they receive.

dylan604 6y ago
The EFF might deserve it more though
- wintorez 6y ago
  Couldn't agree more: https://supporters.eff.org/donate/ https://supporters.eff.org/donate/
  - adtac 6y ago
    not sure if you noticed, but the parent comment was joking about your typo -- you said EEF, not EFF :)
    - wintorez 6y ago
      Oh! I see... well... my bad... ¯\_(ツ)_/¯

Rochus 6y ago

I don't believe that Github actually needed the EFF's writing for this, or that they don't have the necessary technical expertise themselves. That is probably rather a protective assertion not to lose face. But at least they seem to have learned something from it now and want to review such requests technically before they (unjustifiably) act.

TheKarateKid 6y ago
This. Github is acting like the knight in shining armor, but they really didn't do anything except respond to the backlash their complicit no-questions-asked removal caused.
- TechBro8615 6y ago
  On the contrary, they’re doing a lot, including establishing a $1M legal defense fund for developers and a technical team to review the validity of anti-circumvention DMCA notices. It seems like they’re doing a lot more than just paying lip service to EFF / developer freedom, and they should be commended for it.
  - TheKarateKid 6y ago
    They’re correcting a wrong because their reputation took a big hit in the dev community. Now there’s big talk of the dangers of not self-hosting your repo and the monoculture of using GitHub. Although it probably has good intent, this is largely PR.
    - Vorh 6y ago
      Even if largely PR, that's still a million dollars.
      - woofie11 6y ago
        After Nat's cynically duplicitous comments and actions, it's hard to view this as anything other than PR. A $1 million expense is not a big advertising expense for github. It was a $7.5 billion sale. Microsoft spend 0.013% of that on this PR piece. I can't imagine the fallout from this didn't wipe several times that off of github's valuation. If github had done this before the EFF letter, it would have been something else. With the EFF letter, they have zero liability to reinstating the repo, and are borderline legally required to do so.

Fumtumi 6y ago

Lets assume, for once, that what they wrote, is what they stand for. I think this is a very very good / exemplary reaction.

remram 6y ago
Why didn't they start with youtube-dl though? They will defend developers and err on their side "going forward" but no not that one? Surely they already had the legal manpower when the youtube-dl removal started making waves. The fact that they did nothing for over three weeks and are publishing this blog post right after the issue was fixed by someone else (EFF) makes it hard to believe their "changes".
- JokerDan 6y ago
  In large organisations, with lots of tape actually getting the ball rolling on what is proposed with all the sign offs, funds allocated, people/resource allocated for the tasks.... It takes months, not weeks. They probably published this off the back of a signed off proposal and may start implementing off the back of it early next year.
- Fumtumi 6y ago
  My daily work is often not adhoc or that fast; I'm not sure why this is so unrelatable to you but for me, daily business is, that things just take 1-3 weeks. Legal manpower still means, that people interrupt their current tasks, which they properly have plenty of, to reprioritize something, others might even not care about at all or never heard of. I stay with my statement and i have enough live experience, that i don't expect a 3 minute solution and answer from github.com
  - remram 6y ago
    I didn't expect any "3 minute solution", but realistically they didn't even have to get the problem fixed. They could have pledged to assist youtube-dl by now, helped them file a counter-notice sometime this week (surely they can get 1 lawyer's time for pressing PR matters), and figured out how to deal with the human resource situation over the coming months. Instead they found a million dollars (!!!), wrote a blog post with explicit commitments, but then waited on somebody else to step up. It just doesn't add up.

ponker 6y ago

When Microsoft and the RIAA square off, the letter of the law isn’t really the battlefield. The battlefield is influence with the US Senate, and the EFF, while well regarded, is a Sancho Panza compared to Microsoft.

AsyncAwait 6y ago
Microsoft won't square off with the RIAA since they're part of it.
- psadauskas 6y ago
  So Microsoft sent a bogus DMCA takedown request to Microsoft, and the non-profit EFF had to respond to keep Microsoft from suing Microsoft? Microsoft also has a program for matching employee donations to non-profits, so its likely Microsoft has also given money to the EFF as well.
  - AsyncAwait 6y ago
    I guess that's one way to put it :-D 2020 sure is a strange year.

NoSalt 6y ago

To be honest, I had no idea youtube-dl did anything else other than download YouTube videos. What other functions does it have?

seba_dos1 6y ago
"Downloading" doesn't mean "saving a copy" (unless you count "saving a temporary copy of its chunks in RAM"...). Most of my youtube-dl usage comes from its mpv integration, so the video is simply streamed directly for playback.
calcifer 6y ago
It supports a lot of video sources [1], not just Youtube. [1] https://github.com/ytdl-org/youtube-dl/tree/3f1748b9445e9d9367d29221c4b7bf9b88895e4e/youtube_dl/extractor https://github.com/ytdl-org/youtube-dl/tree/3f1748b9445e9d93...
- arbaal 6y ago
  I was suprised today that it supports downloaded videos on reddit too.
dredmorbius 6y ago
youtube-dl is a networked multimedia swiss army knife supporting many operations and manipulations of audio, video, metadata, and auxiliary content from many video and audio hosting sites and platforms, as well as serving as an access layer for several playback tools, including mps-youtube, mpv, and VLC.
npteljes 6y ago
It supports audio-only sites too. I personally sync my favourites on Mixcloud with it.
maeln 6y ago
It support a gigantic amount of website, including audio one. Most of the time, I use it to have an offline copy of a podcast, radio show or some video that I might need to look at wherever I am not guarantee to have an internet connexion (very useful when travelling). It also has a lot of useful option like downloading the audio only of a video, choosing the quality of the video/audio which might be hidden in the website you are trying to watch it from, download subtitle (this is just so useful), you can pass ffmpeg options also to post-process the video in one go, ... There is just so many thing you can do with it. One last example : one of my computer really struggle to watch video/stream directly from the browser (for whatever reason), but with youtube-dl I can stream directly to VLC/MPV and it use 1/10 the CPU comparing to watching the same video in the browser.

deleted 6y ago

[deleted]

duxup 6y ago

Also their examples in their docs for youtube-dl included copyrighted content ... I'll let the lawyers debate that whole thing, but IMO I think that was a bit of a mistake / bad idea. Granted, fixable, but maybe a lesson of something to avoid.

app4soft 6y ago

> It seems like EFF fought for youtube-dl and GitHub used their letter as legal firepower to bring the repo back online. I'm at least one of those who requested EFF to take a look on "The RIAA’s attack on YouTube-dl is not a DMCA 512 infringement" thread.[0,1] [0] https://twitter.com/app4soft/status/1320617082866847746 https://twitter.com/app4soft/status/1320617082866847746 [1] https://news.ycombinator.com/item?id=24888234 https://news.ycombinator.com/item?id=24888234

jjeaff 6y ago

How has youtube not sent a cease and desist for the name youtube-dl? They would most definitely have a case that the name makes it appear to be a youtube product. Would a cease and desist for the name only somehow imply that google has no issue with the functionality? Because I know not protecting your trademark can lead to dilution. And by issuing takedown notices, they are showing that they are aware of the existence of this usage of the youtube trademark.

asperous 6y ago
Youtube has to realize that a significant amount of content that people watch on its site is reaction, commentary, compilations, and other recycled content. I think its for this reason that they don't go after these projects very aggressively.
- hombre_fatal 6y ago
  It's just arbitrary. There's prob even a low-sev ticket somewhere in Youtube's issue tracker to take out youtube-dl. They can do it at any time. That they haven't done it (make youtube-dl's life harder) yet just means they might do it tomorrow, not that they don't care.

sneak 6y ago

GitHub is owned by Microsoft, who is a member of the RIAA who created this legal action. For Microsoft to pay for the lawyers to take it down (via their RIAA membership payments) and also pay for the lawyers to keep it up seems... rather silly.

mmcdermott 6y ago
From the outside in, there are a lot of aspects of the legal system that look like this - welfare for lawyers. Unfortunately, fixing it requires changing the law and we've made of practice of sending a lot of lawyers to Capitol Hill who are very sympathetic to the needs of lawyers. It's probably the biggest self-perpetuating interest group there is.

lscotte 6y ago

Actually it seems more like the EFF had nothing to do with it at all and the unit test patch is the reason it was restored - just like Github says in the blog entry.

tubbyjr 6y ago

i have ytdl bound to some macros on my browser, so i can stream videos outside of the browser for accessibility reasons

1vuio0pswjnm7 6y ago

Add to this that the original author recently posted a story about the origins of the youtube-dl script admitting it was designed to do:- download YouTube videos and name the downloaded files appropriately. https://rg3.name/202011071352.html https://rg3.name/202011071352.html Under DMCA, neither writing a script like youtube-dl nor using it is prohibited (making an unauthorised copy of a video could be fair use).FN1 Section 1201 however prohibits distributing the script to others. Thus, the author of the script who "releases" (distributes) it is not necessarily the only one who might be violating the DMCA. Any recipient of the script who distributes it further, e.g., Microsoft, could be violating the DMCA as well. FN 1. Section 1201 prohibits distributing technology that is designed to circumvent either "access controls" and/or "copy controls". Similarly, the act of circumventing "access controls" is prohibited. However, the act of circumventing "copy controls" is not explicitly prohibited. Making unauthorised copies, e.g., downloading YouTube videos, is subject to the defense of fair use. It is arguable that youtube-dl is only designed to circumvent "copy controls". As others in the thread point out, there are generally no "access controls" on YouTube videos, e.g., password protection. There could be exceptions. If youtube-dl is designed to circumvent geographic or age restrictions, would those be considered "access controls". Aside from DMCA concerns, Google's Terms of Service for YouTube would appear to prohibit use of youtube-dl: "The following restrictions apply to your use of the Service. You are not allowed to: 1. access, reproduce, download, distribute, transmit, broadcast, display, sell, license, alter, modify or otherwise use any part of the Service or any Content except: (a) as expressly authorized by the Service; or (b) with prior written permission from YouTube and, if applicable, the respective rights holders; 2. circumvent, disable, fraudulently engage with, or otherwise interfere with any part of the Service (or attempt to do any of these things), including security-related features or features that (a) prevent or restrict the copying or other use of Content or (b) limit the use of the Service or Content; 3. access the Service using any automated means (such as robots, botnets or scrapers) except (a) in the case of public search engines, in accordance with YouTube's robots.txt file; or (b) with YouTube's prior written permission;" https://www.youtube.com/static?template=terms https://www.youtube.com/static?template=terms Would these TOS be enforceable if challenged. #1 makes no allowance for fair use. What do you think.

RoutinePlayer 6y ago

Honestly, the name is problematic. Why do some developers insist on bad names? Stop the bad names .. unpronounceable crap like xoyx-mp4, zycx10 should also be avoided .. what's wrong with vidl, or something simple like that? .. I'm half joking, but it's worth underscoring.

Bqhatevwr 6y ago
They literally had a test case in the repo for circumventing copy protection on youtube. I'm somewhat baffled they managed to get the repo reinstated given that's very much a violation of the DMCA.
- dodobirdlord 6y ago
  The argument is that it doesn’t do anything that a web browser doesn’t do already, and there’s established precedent that it’s not “circumventing copyright” if it requires no secret knowledge.

joshspankit 6y ago

An important point: There are many videos on YouTube that are 100% legal to download.