10 ms·
The SymPy/HackerRank DMCA Incident
- CaliforniaKarl 4y agoFYI: The author, Aaron Meurer, is lead developer for SymPy.
- anm89 4y agoIt's really rare for someone to handle something like this as well as it appears Vivek at Hackerrank did. The apology was straightforward and took full ownership, they showed that they had changed a process so it wouldn't happen again, and they compensated SymPy for their time in a way that seems at least superficially very fair. Hats off to Vivek.
- rav 4y agoGiven that HackerRank has more than 1000 employees, I agree that it is surprising that they were able to react and apologize on the same day as the takedown and all the buzz on social media. However, I still think it's a damn shame that HackerRank needed such a high-profile incident before reconsidering their shady arrangement involving probably-automated DMCA takedowns against GitHub repositories. Either they didn't know what that would incur on open source repositories hosted on GitHub and other platforms, or they just didn't care about it as long as it wouldn't cause a huge fuss for themselves (which it did in this case).
- benaduggan 4y agoFormer HackerRank Employee here, while I agree it seems like a very quick response, I just want to point out they have nowhere near 1000 employees. When I was there it was probably a quarter of that. As a YC backed company, it seemed like almost everything on HackerNews was known about within the company when I was there.
- 2pEXgD0fZ5cF 4y agoThe question that always remains in cases like this: Would they have handled it this well if their target wasn't as well known as SymPy? This could just be another case of a problem being solved by hitting the news and making enough waves. Sure they did the right thing, but it was still their active wrongdoing and I won't attribute their reaction to them being decent people. I'm tired of all the DMCA abuse, and reverting it for once isn't worthy of special praise. It makes HackerRank better than other DMCA abusers, but DMCA abusers they still are.
- bitcharmer 4y agoVivek failed repeatedly to answer the question if they intend to address their unjustified DMCA strikes against other projects. To me it looks like a well calculated PR action. I'll change my mind when they make it up to other teams they wronged.
- deleted 4y ago[deleted]
- teraflop 4y agoThis is a great write-up, but I'll quibble with one small part of it: > It’s important to understand, however, that GitHub’s hands are tied in many ways here. If they do not follow the notice and counter notice procedures exactly as outlined in the DMCA law, they risk losing their safe harbor status with the US Copyright Office. Were this to happen, it would be completely disastrous to GitHub as a business. I believe this is a bit of an exaggeration, because there is no such thing as "safe harbor status with the US Copyright Office". (The author might be thinking of the fact that providers have to register a designated agent with the Copyright Office, for service of infringement reports, in order to benefit from the law.) The DMCA safe harbor is a legal defense against copyright infringement, and it operates on a case-by-case basis. If GitHub fails to respond to a particular takedown request as it's required to, it loses the ability to assert the safe harbor defense for the allegedly infringing material identified in that request. It does not mean it somehow loses the DMCA protections for any other material that it hosts. In practice, this means that GitHub employees can make mistakes, or the company can deliberately choose to stand up to superficially-valid DMCA takedowns that it thinks are frivolous, without necessarily posing an existential risk to the entire company.
- dwild 4y ago> the company can deliberately choose to stand up to superficially-valid DMCA takedowns that it thinks are frivolous, without necessarily posing an existential risk to the entire company. We all seen the Oracle vs Google lawsuit... sure they can choose to stand up to frivolous DMCA takedowns, but it doesn't means there won't be a frivolous lawsuit that follow. It just not worth it, why takes that risk when taking something down protect you from it?
- czx4f4bd 4y agoI think you mean Viacom v. Google. Oracle v. Google wasn't related to the DMCA. https://en.wikipedia.org/wiki/Viacom_International_Inc._v._YouTube,_Inc https://en.wikipedia.org/wiki/Viacom_International_Inc._v._Y.... https://en.wikipedia.org/wiki/Google_LLC_v._Oracle_America,_Inc https://en.wikipedia.org/wiki/Google_LLC_v._Oracle_America,_....
- rocqua 4y agoI believe that a real DMCA takedown (not the copyright notice used by youtube) needs the following two clauses: "I have a good faith belief that use of the copyrighted materials described above on the infringing web pages is not authorized by the copyright owner, or its agent, or the law." and "I swear, under penalty of perjury, that the information in this notification is accurate and that I am the copyright owner, or am authorized to act on behalf of the owner, of an exclusive right that is allegedly infringed." This takedown does not seem to have been in good faith or accurate, if only because of the following: > The notice also stated “the infringing website is not willing to remove our client's work”, which came as a surprise to us since, at no point in time prior to receiving this notice had we received any communications from HackerRank or WorthIT Solutions. Are there any consequences against whomever at WorthIT signed the DMCA request? If not, how come?
- dannyw 4y agoPerjury is a criminal offense, but to date, no one has been even charged or prosecuted[1] for perjury for abuse of the DMCA takedown process. [1]: https://law.stackexchange.com/questions/51541/has-anyone-been-convicted-of-perjury-for-false-dmca-takedown-notices https://law.stackexchange.com/questions/51541/has-anyone-bee...
- rodgerd 4y agoThere has been one case - the Addison Caine lawsuit - but the fact that it's only one shows how ineffectual the provisions are as a counterbalance.
- bilekas 4y agoI can't speak for WorthIT but I've heard countless stories surrounding YouTube takedowns which are overturned because they just don't apply however Iv'e never heard of any repercussions for those making the claim. They do seem to be given the benefit of the doubt, which is fine, but if they're not pushed towards improving their automation its just going to stay a nightmare for everyone else.
- 4y ago
- VMtest 4y agodo they also DMCA strike replicated repositories hosted in other countries, like China/Russia or SEA countries? I definitely won't tell you guys to copy the orignal HackerRank questions and solutions to other self-hosted git services once in a while
- philderbeast 4y agoif its not US based the DMCA doesn't apply (since its US law) so even if they did, providers in other countries so not need to honour it.
- vadiml 4y agoIf we REALLY want to reform DMCA there is relatevily simple way to do it: Organize a massive simultaneous DMCA takedowns of congressmen web pages... The reform will come in days.
- Cthulhu_ 4y agoIsn't there a consequence for making frivolous or baseless DMCA takedowns? I mean there should be given the amount done on e.g. youtube, but if you obviously don't own copyright on something, it'll be considered malicious and you'd get prosecuted yourself.
- Qem 4y agoPeople could just post hackerrank problem answers to congressmen's pages and wait.
- SturgeonsLaw 4y ago> Isn't there a consequence for making frivolous or baseless DMCA takedowns? In theory yes, in practice no
- rmbyrro 4y agoThis is also a great way to get sued for perjury and be made as an example that citizens should not challenge their representatives in such ways.
- addingnumbers 4y agoThat's the whole point, to get them to reform the law, or to set courtroom precedent against spurious claims, while they're forced to take the position of its victims instead of continuing to side with the more well-funded perpetrators.
- rhino369 4y agoPurposely filing notices as a protest is indisputably bad-faith. That's not going to set any precedent against bad-faith notices with a veneer of plausible deniability.
- matthews2 4y agoSending a false DMCA takedown notice should prevent you from sending further notices to that platform for a year. (Or forever!)
- kwertzzz 4y agoThis list of DMCA take-down at [1] is really extremely long and there are several universities that ask for instance to remove the solution of students' assignments [2]. I am wondering if a university can really claim copyright to a solution made by students and if a breach of "Georgia Tech Honor Code" (for example) is really a copyright issue. From [2] it does not seem that the assignment itself is copied to the repository. Should it be GitHub's responsibility that the students comply with their honor code? [1] https://github.com/github/dmca https://github.com/github/dmca [2] https://github.com/github/dmca/blob/master/2022/03/2022-03-16-georgia-tech-2.md https://github.com/github/dmca/blob/master/2022/03/2022-03-1...
- Cthulhu_ 4y agoI'm fairly sure that there's some T's and C's these days when you go to a university, just to cover this legally. And they cover it legally to prevent cheating and copying answers, because that would seriously reduce the worth of a degree from that university.
- quietbritishjim 4y agoA student breaching terms of a contract would still not constitute a copyright violation, which is the only thing DMCA can be used for (legally).
- 0x0000000 4y agoA student publishing code derived from starter code / skeleton developed by course faculty is indeed a copyright violation.
- rmbyrro 4y agoCopyright law has provisions to protect educational purposes.
- quietbritishjim 4y agoIf that were so then I would agree (although, depending on how much code is in the skeleton, it might not contain enough creativity to reach the threshold for copyrightability). But didn't sound like what's happening in this particular case (the wording is a bit ambiguous ... maybe deliberately?): > I am part of the Georgia Tech [private], and I have found code solutions for a class at Georgia Tech. Whenever student turn into their code assignments they agree to the Georgia Tech Honor Code stating they are not cheating or allowing others to cheat by sharing Georgia Tech’s assessment materials. The assignment materials were provided to students so that they could complete their tasks and isn't to be shared with others.
- perihelions 4y ago- "When a provider receives a counter notice, they must forward it to the original complainant, and restore the challenged material after 10-14 business days. At this point, if the complainant wishes to keep the material down, they must file a lawsuit against the alleged infringer." In practice, the complainant probably finds it more cost-efficient to (0) ignore your counter-notice, and (1) refile their original complaint, unaltered, restarting the DMCA process from zero. If GitHub reinstated your work, they'll simply take it right back down again, like a yo-yo. Much cheaper than lawyers. https://github.com/github/dmca/search?q=TheRayTracer https://github.com/github/dmca/search?q=TheRayTracer This is what the process looks like when you're not HN-front-page support tier. (I'm not affiliated with these parties; I stumbled on this set of DMCA interactions while reading the previous HN story last week).
- tremon 4y agoCan't GitHub ignore the second complaint as a duplicate? The quoted text explicitly says "if the complainant wishes to keep the material down, they must file a lawsuit" so simply re-filing the original complaint should not take the material down again.
- philderbeast 4y agogithub (and other providers) have no obligation to host your content though, so the "restore the challanged material" part has no effect in a lot of cases and the material stays down regardless of sending a counter notice.
- lynguist 4y agoThis is enraging. Would you please be willing to countersue HackerRank on behalf of: (1) abusing the DMCA (2) lying in the DMCA message I want that HackerRank is made an example and that this sets a precedent for all other DMCA trolls. Please follow through with this for all other open source projects that can be targeted the same way.
- perihelions 4y ago- "This is enraging." Lawsuits are a mediocre vehicle for channeling rage. Realistically (though I'm no lawyer), the $25,000 they've already accepted is far more than a court would plausibly award them, for the tangible damage of half a day's downtime on GitHub.
- ok123456 4y ago
- kingcharles 4y agoI agree. I'm always talking to people who are going to sue "for millions", but when I go through settlement agreements and jury awards they are generally much lower than headlines would lead you to believe. Often they can even be zero. I had a district attorney send me a very rude letter recently (under non-disclosure) saying that he didn't give a fuck if I won a case against the county because he loses cases all the time. He said that even when he loses he gives zero shits because he'll get in front of the jury when it's time to figure out damages and paint the plaintiff as such an asshole that the jury will award zero damages. I believe him.
- andi999 4y agoWhy blame the dmca process and not HackerRank? I mean you blame the person who pulls tge trigger normally, wont you?
- miguelmurca 4y agoA large part of the world certainly feels like not having guns widely and easily available can help. Keeping in line with your analogy, I mean.
- andi999 4y agoNo part of the world wont file murder charges to the guy pulling though.
- paulgb 4y agoThe article blames both. I think the focus on DMCA makes sense from the point of view of preventing this from happening again. HackerRank likely will exercise more caution, given the PR and monetary cost of this episode, but the DMCA still exists and is prime for abuse by others.
- ThePhysicist 4y agoThere aren't many things that are more against "hacker culture" than taking down an open-source repository via a DMCA notice. The fact that HackerRank had to apologize due to public pressure cant' really excuse this, in my opinion.
- q-big 4y agoWhy not delete your HackerRank account and tell HackerRank the reason for this?
- hyfgfh 4y agoHackerRank is a terrible product. If any company I applied uses it I withdraw immediately.
- starwind 4y agoSame. If they insist on HackerRank, that tells me they hire based on solving logic puzzles and not building software and systems. Not a place I'm interested in
- lokar 4y agoIt depends how you use it. I've used it to pre-screen candidates with very basic code questions. It filters out a lot of people who are either lying or just don't believe they will have to ever write any code. This allows me to consider a much wider range of candidates outside top tier schools and employers.
- starwind 4y agoThat's fair, and not at all the way I've seen it used
- matsemann 4y ago> One thing that confused us was that the support email came from a domain, githubsupport.com And it was a real e-mail... Great way to train your customers to be phished in the future, GH.
- tgsovlerkhgsel 4y agoSimilar vein: * PayPal's links go to paypal-communication.com * 3DSecure, where random third party web sites ask for bank credentials * Some banks call customers without being able to meaningfully accept a callback, with negative consequences if you don't react to their call
- lvl102 4y agoI just want to understand the problem: did HackerRank initiate the takedown? If so, that apology and $25K donation is not enough. They need to be sued with the help of NumFOCUS lawyers. My understanding is that they’ve done this many times in the past and used “third-party” as an excuse. I’ve never used HackerRank but this made sure I will never use them in the future.
- mwt 4y ago_They_ didn't _do_ it per se, it was done by a third party (probably for hire) and it seems to have been the result of automation gone wrong (not an excuse IMHO). Of course they bear responsibility for the work they contract out and the third party bears responsibility for their automation being worse than ineffective. But the facts do not seem to point to an evil person in a basement initiating the takedown themselves. > They need to be sued with the help of NumFOCUS lawyers. This seems like it could be costly and quickly easily eat away at the small amount of revenue they take in (something like $5MM, mostly from grants and donations) compared to supporting open source projects that are desperate for support.
- jeroenhd 4y agoThey've been doing this for years, it's hardly "automation gone wrong". They willfully abuse the DMCA system because they can't sell their puzzles to employers if interviewees publish their algorithms online. Notice in the words of the CEO how he still doesn't think it's wrong to submit takedowns to code they don't hold any copyright over. At least he's honest about his bad intentions, so that's better than the drivel some tech companies come up with when they reach the front page of HN. These guys are exactly what's wrong with copyright law and nobody has the time, interest, and resources to fight them.
- mwt 4y agoIt's pretty clearly automation gone wrong. I didn't specify if it's a matter of neglect or abuse.
- BeetleB 4y ago
- jrochkind1 4y agoI love how clearly and objectively the OP wrote this up.
- 29athrowaway 4y agoIn short, Hackerrank people have no common sense and decided to take down content that looked like solutions to Hackerrank problems. The affected content was the documentation of opensource projects, which is not even something they own. That in itself should be illegal.
- jeroenhd 4y agoIt technically is, because the statement is taken under perjury, but good luck enforcing the perjury clause of the DMCA against a company in Pakistan.
- frob 4y agoThis seems like a solid case where Hacker Rank and their contractor filed bad-faith documents and lied under the penalty of perjury. Now that SymPy has $25k of found money, it might make sense to hire a lawyer and counter-sue for damages.
- lima 4y agoDamages would hardly exceed $25k
- ratel 4y agoWhat I don't understand is that although there are a lot of non-profits in the US that are willing to help in these kinds of cases. Non of them ever tried or suggested going after the original notice giver for perjury as at least some of these notices would fall under 'willful ignorance' as defined in United States v. Fawley (1998). The notice giver is in a (unique) position to determine if they actually hold the copyright and which specific part of some digital information is indeed infringing on that as this is the entire basis of the take-down notice. The fact that they do not supply it when serving the notice, but later will have to rely on it in court makes them willful ignorant when serving the notice. Getting the perjury clause of the DMCA upheld would of course have a chilling effect on sending take-down notices in such a frivolous manor. Disclaimer: a) I am not a US citizen b) TGIANAL
- charlieyu1 4y agoMaybe such a predatory copyright law is the main problem.
- zamalek 4y ago> HackerRank did follow through with the $25k donation to SymPy. I feel like it's important to raise the volume of this statement. Just how often does the "we will donate to X for our mistake" promises blow over? Inversely as frequently as is required for PR upkeep, most likely (and given that nobody keeps tabs on this: they always blow over). We desperately need more DMCA countersuits. There is currently no practical downside for filing fraudulent claims (irrespective of what legal downside should exist). If SymPy/NumFOCUS are in the position to retaliate, I really hope that they do.
- Komodai 4y agoHackerRank should be sued, and that $25k hush-money is just sad.