6 ms·
Total speculation on my part but PyPI hosts yt-dlp, the unauthorized video downloader. https://pypi.org/project/yt-dlp/ https://pypi.org/project/yt-dlp/
by NelsonMinar 3y ago
Total speculation on my part but PyPI hosts yt-dlp, the unauthorized video downloader. https://pypi.org/project/yt-dlp/ https://pypi.org/project/yt-dlp/
- vore 3y agoI would think the government has bigger fish to fry than to spend time subpoenaing yt-dlp.
- throwaway09223 3y agoGoogle is a pretty big fish themselves. What usually happens is the large corporation lays out a case like "yt-dlp is responsible for billions in damages" and they press the DOJ to investigate and prosecute.
- account42 3y agoAFAIK Google hasn't even taken any civil action against y(ou)t(ube)-dl(p) at all, that was all the music industry.
- dual_dingo 3y agoNot a US cititzen, but "The government" is a wide term and any law enforcement agency would fit this, including the ones that are responsible to deal with things like copyright enforcement - that's exactly the type of fish they exist to fry ...
- vore 3y agoGiven the discussion around how lacking PyPI supply chain security is, how juicy of a target it is for attackers, and how critical infrastructure is probably relying on PyPI, yt-dlp is the last thing on my mind.
- ChuckMcM 3y agoFYI for non US readers ... In the US, subpoenas come from the Justice Department (either state or federal depending on the crime for which evidence is being sought). The court that issued the subpoena is on it, and the person or entity being served, has the right to see why some government agency felt it could aid in the uncovering of a crime that had already been committed. The person or entity then has the opportunity to challenge that in court prior to complying with it. This is sometimes informally called "quashing the subpoena." From my sister-in-law who is a defense attorney, the most common result of challenging a subpoena is to get what it asks for narrowed down to just what is plausibly responsive. In the article, this response: As a result we are currently developing new data retention and disclosure policies. These policies will relate to our procedures for future government data requests, how and for what duration we store personally identifiable information such as user access records, and policies that make these explicit for our users and community. Is good practice for limiting what a subpoena can request (you can't give what you don't have). At Blekko we logged access records in such a way that we could use PII for 48 hours and then it was deleted. The CTO, Greg Lindahl, is a huge privacy advocate and this sort of architecture made it possible to get information to improve our ranking and service without compromising people's privacy. In practice I don't think any agency could go from "we have a suspect" to "issue a subpoena" in 48 hrs so it was a useful way for us to stay out of the crosshairs. The most interesting event was the FBI asking for information on IP addresses that had accessed their honeypot CSAM site. That turned out to be some of the machines in the crawling cluster. Given that the site was outside the crawl "horizon" and didn't rank (very few sites linked to it) it didn't even make it into the cache for rank analysis. But in that case the turn around time was impressive. Of course that is because they were just using their own logs to generate subpoena requests.
- sroussey 3y agoYou can get subpoenas that ask for data longer than your window, in which case you have to have a longer one, even if the reachback is shorter. Watch out for smaller jurisdictions that might have “you should have expected” laws that says your 48hr window is too short.
- 3y ago
- sp332 3y agoWhile copyright infringement is usually a civil matter, there are times the DoJ gets involved. They even got a guy sentenced to jail for it in 2018. https://www.justice.gov/usao-ndga/pr/owner-sharebeastcom-sentenced-copyright-infringement https://www.justice.gov/usao-ndga/pr/owner-sharebeastcom-sen...
- sam0x17 3y agoOne would think that yes.... but this is the U.S. :/
- Sparkyte 3y agoI wouldn't be surprised if it was more of AI based impersonation stuff. AI in the government is big because people can use it impersonate people as a form of identity fraud.
- lazide 3y agoThe FBI has it's own 'copyright enforcement' division who has as their sole job enforcing copyright, and has it's own dedicated funding [https://archives.fbi.gov/archives/news/testimony/intellectual-property-law-enforcement-efforts https://archives.fbi.gov/archives/news/testimony/intellectua...]
- RobotToaster 3y agoIsn't copyright infringement a tort not a crime? Why is the FBI involved at all?
- lazide 3y ago[https://www.justice.gov/archives/jm/criminal-resource-manual-1847-criminal-copyright-infringement-17-usc-506a-and-18-usc-2319 https://www.justice.gov/archives/jm/criminal-resource-manual...] There is an applicable federal criminal law.
- qingcharles 3y agoDepends on the level of infringement generally.
- RoyGBivCap 3y agoBecause the people rich enough to own big copyrights can afford politicians.
- dmix 3y agohttps://en.wikipedia.org/wiki/No_Electronic_Theft_Act https://en.wikipedia.org/wiki/No_Electronic_Theft_Act > Introduced in the House as H.R. 2265 by Bob Goodlatte (R–VA) on July 25, 1997 > Committee consideration by United States House Committee on the Judiciary and United States Senate Committee on the Judiciary > Passed the House on November 4, 1997 > Passed the Senate on November 13, 1997 > Signed into law by President Bill Clinton on December 16, 1997
- 3y ago
- deleted 3y ago[deleted]
- astrea 3y agoAmazingly hilarious comment given the history of copyright prosecution.
- vore 3y agoGiven PyPI has been a vector for distributing malware into dependency chains, wouldn't you think that would be a more likely target for the DoJ over one of HN's favorite axes to grind?
- heavyset_go 3y agoThe FBI does sting operations to arrest homeless people who sell bootleg movies and bags on the street.
- WhyNotHugo 3y agoUnlikely, due to: > "Records of all Python Package Index (PyPI) packages uploaded by..." given usernames > "IP download logs of any Python Package Index (PyPI) packages uploaded by..." given usernames I don't think they'd want a list of packages uploaded by a given user if they were after yt-dlp devs. They'd be asking for a list of maintainers of a given package.
- ed25519FUUU 3y agoIf yt-dlp was illegal the first thing they’d do is a takedown request, not a subpoena but leave it online.
- deleted 3y ago[deleted]
- heavyset_go 3y agoThat's if they want to go down the DMCA route and aren't using a subpoena in a different case.
- NoZebra120vClip 3y agoBut what if they want records on everyone who downloaded a tool?
- phkahler 3y agoThanks, I was wondering what it might be about. That makes some sense.
- schleck8 3y agoNo it doesn't. Noone at the government level gives a shit about a youtube downloader package, typosquatting would be way more likely. Pypi is riddled with malware AFAIK, they don't really moderate it.
- ewdurbin 3y agoI took a report down within 3 minutes of upload today. We have regularly received comments from our 3rd-party reporters that we are the most responsive. You are wrong.
- slenk 3y agoyt-dlp is everywhere - why would they go after pypi and not the source at https://github.com/yt-dlp/yt-dlp https://github.com/yt-dlp/yt-dlp
- heavyset_go 3y agoNot that I necessarily believe this is happening, but this can be a case of making an example out of anyone that wants to distribute the software they wanted censored via chilling effects.
- slenk 3y agoAh, fair. Wouldn't be the first time the US Gov't did that
- not2b 3y agoIt seems much more likely that some typosquatter managed to compromise the security of government sites by uploading malware, and Uncle Sam wants to catch the culprit.
- stonepresto 3y agoOr they're chasing threat actors, ransom groups, etc as part of a larger investigation.