3 ms·

Nice service! I am wondering about the legal part. Because the users store licensed files on your server, then you "distribute" it back to them, could it be an

by XCSme 4y ago

Nice service! I am wondering about the legal part. Because the users store licensed files on your server, then you "distribute" it back to them, could it be any licensing problem? I assume it could also be solved by encrypting the file, so you only store encrypted files on your server, and only the user/owner of that song can decode it.

dns_snek 4y ago
> could it be any licensing problem No more than storing your legally-archived CDs on <insert cloud storage service>, I would imagine. IANAL, of course, but intuitively there shouldn't be any issues as long as the songs aren't made available to anyone other than the user who uploaded it.
- mawise 4y ago
  There was a startup a while ago called mp3.com[1], their model was: 1. put your CD in your computer 2. our website recognizes the CD 3. we grant you listening access to songs on that CD (without actually ripping/uploading) They got sued and lost: >Judge Jed S. Rakoff, in the case UMG v. MP3.com, ruled in favor of the record labels against MP3.com and the service on the copyright law provision of "making mechanical copies for commercial use without permission from the copyright owner." [1]: https://en.wikipedia.org/wiki/MP3.com#My.MP3.com https://en.wikipedia.org/wiki/MP3.com#My.MP3.com
  - dns_snek 4y ago
    That's interesting, although one of the comments in this thread mentioned Capitol Records v. MP3Tunes [1], a similar case tried in the same court 10 years later. MP3Tunes 'won' in principle but they were liable for ignoring DMCA takedown notices and seeding the service with unauthorized copies of music. > First, it established DMCA safe harbor protection for online locker services, potentially granting them "broad immunity from copyright liability". Second, it endorsed data deduplication, which allows cloud music services to more efficiently allocate storage and reduce the amount of space needed per user. I would be curious to know why the rulings were different. If anything it seems like MP3.com provided stronger guarantees that their users legally owned the songs by requiring them to insert a CD. [1] https://en.wikipedia.org/wiki/Capitol_Records,_Inc._v._MP3Tunes,_LLC https://en.wikipedia.org/wiki/Capitol_Records,_Inc._v._MP3Tu...
grose 4y ago
Thank you! The way I tried to solve this problem is by using signed URLs for the files. So every file URL should only be accessible to a user with the matching credentials. At least, that's the idea :-)
- XCSme 4y ago
  What if the user shares that URL with someone? Or the URL is only accessible if you are signed-in?
  - joelennon 4y ago
    Signed URLs (or pre-signed URLs) typically expire after a short time frame. The idea is that they exist for long enough for the object in question to be retrieved in the application, and they then automatically expire. Although they don't typically have a single-use limitation, this is often the intention a developer has when using a pre-signed URL.
    - grose 4y ago
      Yep! It's a bit of a balancing act because you want the files to be cache friendly (skipping tracks back and forth shouldn't make you download it every time) but you also don't want people to abuse (share) them. You can also restrict the signed URLs by IP address but that can cause trouble for people with dynamic IPs so I opted not to do that.

by XCSme 4y ago

dns_snek 4y ago

> could it be any licensing problem No more than storing your legally-archived CDs on <insert cloud storage service>, I would imagine. IANAL, of course, but intuitively there shouldn't be any issues as long as the songs aren't made available to anyone other than the user who uploaded it.

mawise 4y ago
There was a startup a while ago called mp3.com[1], their model was: 1. put your CD in your computer 2. our website recognizes the CD 3. we grant you listening access to songs on that CD (without actually ripping/uploading) They got sued and lost: >Judge Jed S. Rakoff, in the case UMG v. MP3.com, ruled in favor of the record labels against MP3.com and the service on the copyright law provision of "making mechanical copies for commercial use without permission from the copyright owner." [1]: https://en.wikipedia.org/wiki/MP3.com#My.MP3.com https://en.wikipedia.org/wiki/MP3.com#My.MP3.com
- dns_snek 4y ago
  That's interesting, although one of the comments in this thread mentioned Capitol Records v. MP3Tunes [1], a similar case tried in the same court 10 years later. MP3Tunes 'won' in principle but they were liable for ignoring DMCA takedown notices and seeding the service with unauthorized copies of music. > First, it established DMCA safe harbor protection for online locker services, potentially granting them "broad immunity from copyright liability". Second, it endorsed data deduplication, which allows cloud music services to more efficiently allocate storage and reduce the amount of space needed per user. I would be curious to know why the rulings were different. If anything it seems like MP3.com provided stronger guarantees that their users legally owned the songs by requiring them to insert a CD. [1] https://en.wikipedia.org/wiki/Capitol_Records,_Inc._v._MP3Tunes,_LLC https://en.wikipedia.org/wiki/Capitol_Records,_Inc._v._MP3Tu...

grose 4y ago

Thank you! The way I tried to solve this problem is by using signed URLs for the files. So every file URL should only be accessible to a user with the matching credentials. At least, that's the idea :-)

XCSme 4y ago
What if the user shares that URL with someone? Or the URL is only accessible if you are signed-in?
- joelennon 4y ago
  Signed URLs (or pre-signed URLs) typically expire after a short time frame. The idea is that they exist for long enough for the object in question to be retrieved in the application, and they then automatically expire. Although they don't typically have a single-use limitation, this is often the intention a developer has when using a pre-signed URL.
  - grose 4y ago
    Yep! It's a bit of a balancing act because you want the files to be cache friendly (skipping tracks back and forth shouldn't make you download it every time) but you also don't want people to abuse (share) them. You can also restrict the signed URLs by IP address but that can cause trouble for people with dynamic IPs so I opted not to do that.