5 ms·

Not an attorney, but I suspect two mistakes the YouTube Vanced team did with the project is having "YouTube" in the name (Could be considered as a false associa

Not an attorney, but I suspect two mistakes the YouTube Vanced team did with the project is having "YouTube" in the name (Could be considered as a false association and trademark violation by Google or YouTube), and redistributing complete APKs that were modified YouTube APKs that would be under copyright. I have not looked into the inner works of this, but on device patching of APK DEX classes from a set of patches is possible. Would not require root as long as it generates a patched APK and installs that using the standard PackageInstaller. That is probably a less risky proposition then distributing modified APKs themselves.

chakkepolja 5y ago
Wouldn't patches still be considered derivative work?
- ntauthority 5y ago
  One could argue it does, one could also argue it does not. If a company wants a quick takedown of something it feels 'isn't right', having to rely on something like that with limited precedent (and a high risk of setting the wrong precedent for them) is a lot more difficult, so you're more likely to not get C&D'd/sued over such - but if you then do something that is easier to sue over, like trademark infringement or more outright copyright infringement, you're likely getting hit for one of those whenever a company 'disliking you' notices instead of them trying the 'hard' arguments.
franga2000 5y ago
Yeah binary patching would basically solve this issue and wouldn't be any more of a hassle for the user than vanced already was. For a similar example, see the way most alternative Minecraft servers download and patch official binaries on first start (they started doing this due to getting a bunch of DMCA takedowns a few years ago). With a bit of effort, Vanced could even have the download page perform the patching and signing in JS/wasm, then include the privkey in the app so it could download, patch and sign new copies of itself on the fly. Or, for better security, have a web service that signs any APK that matches a set of hashes. Clients patch the APK locally, then send it in to get signed - everyone now has byte-identical APKs, but Vanced severs never technically distributed Google's binaries.
- shabier 5y ago
  That's a good approach, I like it a lot. Do know a project that has already applied that flow?
  - franga2000 5y ago
    Not the online or browser-based signing, no, but LuckyPatcher lets you patch APKs locally (I think their specific implementation requires root, but that wouldn't be necessary if APKs were downloaded in-app). I was actually really surprised when I first found Vanced that it wasn't using something like LP and instead distributing pre-modded APKs.
    - shabier 5y ago
      Good call, I didn't think of that. I believe that the non-root approach for LuckyPatcher is to create a separate, (limited) modified APK file rather than modifying an existing, installed app
    - roastedpeacock 5y ago
      LP is exactly what I was referring to by my previous comment.
anyfactor 5y ago
> "YouTube" in the name (Could be considered as a false association and trademark violation by Google or YouTube) This is an important point. The "insert popular company name" for "insert industry" works great when you have just launched but this statement should be ditched as immediately as you get some traction. I liked how, the Reddit client App "RIF" started. It was first "Reddit is fun", now it has become "RIF is fun". No matter how benevolent you think the company you are referring to is, at the end everyone wants money, and the survival rate using this strategy is close to zero. Without naming any names, I have seen certain startups claiming they are the Stackoverflow or Quora of "X" industry. The path Stackoverflow's ownership is taking, I bet they will start suing these companies for false representation sooner then we can imagine.
- roastedpeacock 5y ago
  Makes me wonder how thin the lines are for the youtube-dl and yt-dlp projects at this point. (The former fell victim to a DMCA takedown from RIAA asserting it was a 'circumvention' tool to download publicly accessible content that was copyrighted by the RIAA, but AFAIK Google did not comment on the incident.)
- electroly 5y ago
  The name on the Google Store is now "rif is fun for Reddit"; I'm not sure that's a great example. It still has Reddit in the name. If you do it right, it doesn't matter if the other party is upset about it. They can be upset all they want; you're allowed to do it to show interoperability.

chakkepolja 5y ago

Wouldn't patches still be considered derivative work?

ntauthority 5y ago
One could argue it does, one could also argue it does not. If a company wants a quick takedown of something it feels 'isn't right', having to rely on something like that with limited precedent (and a high risk of setting the wrong precedent for them) is a lot more difficult, so you're more likely to not get C&D'd/sued over such - but if you then do something that is easier to sue over, like trademark infringement or more outright copyright infringement, you're likely getting hit for one of those whenever a company 'disliking you' notices instead of them trying the 'hard' arguments.

franga2000 5y ago

Yeah binary patching would basically solve this issue and wouldn't be any more of a hassle for the user than vanced already was. For a similar example, see the way most alternative Minecraft servers download and patch official binaries on first start (they started doing this due to getting a bunch of DMCA takedowns a few years ago). With a bit of effort, Vanced could even have the download page perform the patching and signing in JS/wasm, then include the privkey in the app so it could download, patch and sign new copies of itself on the fly. Or, for better security, have a web service that signs any APK that matches a set of hashes. Clients patch the APK locally, then send it in to get signed - everyone now has byte-identical APKs, but Vanced severs never technically distributed Google's binaries.

shabier 5y ago
That's a good approach, I like it a lot. Do know a project that has already applied that flow?
- franga2000 5y ago
  Not the online or browser-based signing, no, but LuckyPatcher lets you patch APKs locally (I think their specific implementation requires root, but that wouldn't be necessary if APKs were downloaded in-app). I was actually really surprised when I first found Vanced that it wasn't using something like LP and instead distributing pre-modded APKs.
  - shabier 5y ago
    Good call, I didn't think of that. I believe that the non-root approach for LuckyPatcher is to create a separate, (limited) modified APK file rather than modifying an existing, installed app
  - roastedpeacock 5y ago
    LP is exactly what I was referring to by my previous comment.

anyfactor 5y ago

> "YouTube" in the name (Could be considered as a false association and trademark violation by Google or YouTube) This is an important point. The "insert popular company name" for "insert industry" works great when you have just launched but this statement should be ditched as immediately as you get some traction. I liked how, the Reddit client App "RIF" started. It was first "Reddit is fun", now it has become "RIF is fun". No matter how benevolent you think the company you are referring to is, at the end everyone wants money, and the survival rate using this strategy is close to zero. Without naming any names, I have seen certain startups claiming they are the Stackoverflow or Quora of "X" industry. The path Stackoverflow's ownership is taking, I bet they will start suing these companies for false representation sooner then we can imagine.

roastedpeacock 5y ago
Makes me wonder how thin the lines are for the youtube-dl and yt-dlp projects at this point. (The former fell victim to a DMCA takedown from RIAA asserting it was a 'circumvention' tool to download publicly accessible content that was copyrighted by the RIAA, but AFAIK Google did not comment on the incident.)
electroly 5y ago
The name on the Google Store is now "rif is fun for Reddit"; I'm not sure that's a great example. It still has Reddit in the name. If you do it right, it doesn't matter if the other party is upset about it. They can be upset all they want; you're allowed to do it to show interoperability.