6 ms·

DMCA anti-circumvention provisions are regarding tools that circumvent effective access controls. I realize that broken encryption is considered an effective a

DMCA anti-circumvention provisions are regarding tools that circumvent effective access controls. I realize that broken encryption is considered an effective access control in this context despite it being broken, but apps like Newpipe aren't even breaking encryption, right? What aspect of the YouTube servers' behavior can be construed as an effective access control? Is there even a rudimentary secret, that never gets served to clients typically but that apps like Newpipe figured out? Unofficial cable TV descramblers are illegal despite simply reconstructing the missing sync signal, but that's because they facilitate theft of services that are normally paid. YouTube is free.

NovemberWhiskey 3y ago
Access to YouTube videos is only "authorized" through YouTube's site and official apps (or yada yada), and YouTube videos are copyrighted material. YouTube has technological measures to ensure that you only watch YouTube videos that way. If you circumvent those technology measures, that's prima facie a DMCA violation, no? The definition of circumvention of a technology measure is extremely broad including "to avoid, bypass, remove, deactivate, or impair a technological measure". I'm pretty much of the opinion that the DMCA is a piece of crap as a law, but it doesn't lack for breadth and generality in those definitions.
- hunter2_ 3y ago
  Sure, but I'm trying to grok the essence of the technological measure being used by YouTube. I have to imagine that merely offering terms of service doesn't constitute a technological measure, and nor would merely slicing up the response in a DASH-like manner [0]. [0] https://en.wikipedia.org/wiki/Dynamic_Adaptive_Streaming_over_HTTP https://en.wikipedia.org/wiki/Dynamic_Adaptive_Streaming_ove...
  - gjsman-1000 3y ago
    Well... here's the dumb thing. The DASH-like manner (or, "rolling cipher" as they like to call it) has currently held up as being an effective protection measure. It comes up all the time when RIAA in particular sues YouTube stream-rippers. https://torrentfreak.com/deciphering-youtubes-rolling-cypher-in-your-browser-is-a-piece-of-cake-201030/ https://torrentfreak.com/deciphering-youtubes-rolling-cypher...
    - hunter2_ 3y ago
      Very interesting. I feel like any type of digital storage or transmission format (PCM audio formats like CD Audio, packet switched networks like Internet Protocol, etc.) could also be described thusly, given that a typical human can't readily consume it. We use a tool that parses it using some algorithm, not a tool that avoids/breaks the algorithm. The error correction of a CD or the sequence number of a packet surely rolls way more rapidly than those DASH slices, too. Are those more common formats also considered effective access controls, since humans have severe difficulty interacting with them without the help of a tool? Granted, I suppose the difference there is that the creators of those formats/protocols did publish the spec, whereas YouTube didn't. Or did they, though? The JavaScript that YouTube serves is the instruction for parsing the DASH response, available publicly, hardly different from publications like IEC 60908 ("Red Book" CD-DA spec) or an RFC 791 (IP spec) -- a different language, is all. What a mess.
      - Mindwipe 3y ago
        The difference is also intent. YouTube implemented the rolling cypher to satisfy music industry demands that the files were not permanently downloadable (and it appears they were able to provide abundant evidence that Google has communicated that to them in court, I don't think this is a controversial point). That wasn't the point of the red book spec. Intent matters significantly, legally.
        hunter2_ 3y ago
        If the rolling cypher they implemented truly exceeds DASH in such a way as to exert control, then I think that would convey intent. If it's substantially DASH alone and DASH requires the equivalent of a rolling cypher just to work, that's rather meaningless; the intent of implementing DASH certainly would've had most to do with adaptive bitrate UX. Based on some other comments, it sounds like they added something like this for music videos and the like, so it may hold up. But I'm armchair judging at this point, and IANAJ. Isn't a rolling code how RF locks (car fob, garage opener, etc.) operate? Those are actually good at keeping out third parties, though.
    - 3y ago
- AnthonyMouse 3y ago
  DMCA 1201 isn't just a crap law. It's completely unworkable, as has been known since before it was passed. Suppose Bob is in the business of duplicating public domain US government works. He downloads videos from the NASA website, presses them onto DVDs and sells them on eBay. He can do this without anybody's permission because DVDs are from the mid-90s and the patents are expired. He uses the same DVD format as Hollywood so people can watch them on their existing DVD players, but he also makes a free DVD player app for Linux so people can watch his DVDs or rip them or do whatever they want because they're in the public domain. It can also do the same with any other DVDs, because it's the exact same format. Is Bob breaking the law? Now suppose Bob is a jerk who is doing this with public domain works without providing anyone a way to exercise their right to copy them, or doing it to enforce contractually unlawful license terms or something like that. Is someone who makes a tool to thwart Bob breaking the law? If so the law could have (more) First Amendment problems, to say nothing of the obvious unreasonableness. But if not then it's a worthless law because anyone could use that as a justification to break anything. Which it is regardless because it has never been effective at suppressing the availability circumvention tools, only at should-be-impermissible abuses like prohibiting interoperability to prop up existing monopolies. It's also notable that NASA publishes many videos on YouTube. As in, only on YouTube.
  - kmeisthax 3y ago
    DVD supports both encrypted and unencrypted video, so Bob is only breaking the law if he's releasing a decryption tool. The entire DeCSS case hinged on video decryption specifically, everything else was already implemented by other parties. Now, if Bob decides to encrypt those DVDs, then you have an interesting legal area where half the law applies and the other half doesn't. DMCA 1201 only applies to things that protect copyrighted works[0], not just any kind of access control measure. And it comes in two parts: one that makes it illegal to break encryption, and another that makes it illegal to provide tools to break encryption. So if you put uncopyrightables behind DVD CSS's encryption algorithm, you can't sue someone for decrypting that particular DVD. But if you distribute a DVD decryption tool, then you're harming the protection of copyrighted DVDs, so you can't distribute a decryption tool even though some jackass might try to functionally recopyright public domain material with DVD CSS. More interesting than the NASA case would be Kevin MacLeod. He releases Creative Commons music under a CC-BY license, and that license has a clause specifically prohibiting the distribution of Creative commons material with DRM on it. A lot of YouTubers use his music, probably didn't know about this clause, and definitely didn't know that the music industry would rugpull everyone by claiming that dynamic download URLs are a DMCA 1201 technical protection. So if these music industry cases succeed, it also means that a lot of YouTubers are open to some copyleft trolling on Kevin's part. I doubt he'd actually do that, but it's still shitty that this is possible. [0] See Chamberlain Group v. Skyline Technologies; https://en.wikipedia.org/wiki/Chamberlain_Group,_Inc._v._Skylink_Technologies,_Inc.#Decision https://en.wikipedia.org/wiki/Chamberlain_Group,_Inc._v._Sky...
JohnFen 3y ago
> I realize that broken encryption is considered an effective access control in this context despite it being broken, but apps like Newpipe aren't even breaking encryption, right? Encryption isn't the only access control. "Access control" is a pretty loose term. I think of it as being similar to what (in the US) counts as "breaking" in a breaking-and-entering charge: you've "broken into" a place if you had to move anything in order to enter. Even a door that is partially ajar and you had to slightly move it to slip by.
- hunter2_ 3y ago
  I agree. But what is the thing being moved here, in technical (rather than legal) terms?
  - JohnFen 3y ago
    I don't know in this particular piece of software. I'm just saying that an "effective access control" can be something very trivial. It doesn't have to be anything as sophisticated as encryption. Just to speculate, it could be something like using the user's login credentials.
bragr 3y ago
>What aspect of the YouTube servers' behavior can be construed as an effective access control? Is there even a rudimentary secret My understanding is that YouTube does implement a trivial sort of DRM/encoding with a rolling cypher to the actual location of video file. This is what tools like youtube-dl implement, and what get their DCMA from the RIAA. It's supposedly very light weight in terms of DRM, and notably I don't think Google has ever attempted to change it to break downloaders.
- justinclift 3y ago
  > YouTube does implement a trivial sort of DRM/encoding Nope. Youtube break their streams up into a number of tiny pieces so they can adjust bandwidth dynamically extremely easily. It's just the RIAA and friends looking for an excuse, so they've attempted (and likely will continue attempting) to make people believe that's "sort form of DRM". Don't get fooled by their bullshit.
  - dtech 3y ago
    Iirc correctly the youtube-dl thing was about an additional layer of "protection" that was only used for music video's and the like
  - rocqua 3y ago
    As I understand the 'cipher' is in how you find the next tiny piece of stream. I haven't grasped fully how that works for Youtube but it is certainly more than 'increment a counter'. I believe it is something like 'read a variable in the previous packet and decode it'. If they wanted any semblance of an argument, decoding that variable should require a session key that is set on log-in or after a captcha. But I doubt they do that, it would be a horrible hassle to handle the session dependant encoding.
    - hunter2_ 3y ago
      Interesting. So instead of authorizing the fetching of pieces by way of authentication, they're just saying "you can have another piece if we've been talking since the very first piece". I guess that's a bit of a control, just not secret whatsoever. I feel conditioned to equate the two, but they're distinct concepts I suppose. A CAPTCHA is an access control, and one that doesn't rely on secrets.
Retr0id 3y ago
For better or for worse, something being "free" doesn't change anything regarding copyright or access control.
yosito 3y ago
> YouTube is free I'd argue that even YouTube users who aren't paying for premium are paying too, just with their personal data instead of state currency. But it's still an exchange of value. Which IIRC, is the whole reason Newpipe exists, to circumvent that exchange of value.
- bjoli 3y ago
  I pay for Google premium, but use NewPipe since it is better than the regular app in many ways.
- franga2000 3y ago
  It's not just data. Watching ads is paying, because it increases the viewers' cumulative likeliness to spend money with the brands whose ads they see. The way money leaves your wallet is through probability, spread out in time and with the viral ability to spread to others. Compared to a fixed subscription or one-time payment, this is a lot harder to notice or control, but it's money leaving your wallet nonetheless.

NovemberWhiskey 3y ago

Access to YouTube videos is only "authorized" through YouTube's site and official apps (or yada yada), and YouTube videos are copyrighted material. YouTube has technological measures to ensure that you only watch YouTube videos that way. If you circumvent those technology measures, that's prima facie a DMCA violation, no? The definition of circumvention of a technology measure is extremely broad including "to avoid, bypass, remove, deactivate, or impair a technological measure". I'm pretty much of the opinion that the DMCA is a piece of crap as a law, but it doesn't lack for breadth and generality in those definitions.

hunter2_ 3y ago
Sure, but I'm trying to grok the essence of the technological measure being used by YouTube. I have to imagine that merely offering terms of service doesn't constitute a technological measure, and nor would merely slicing up the response in a DASH-like manner [0]. [0] https://en.wikipedia.org/wiki/Dynamic_Adaptive_Streaming_over_HTTP https://en.wikipedia.org/wiki/Dynamic_Adaptive_Streaming_ove...
- gjsman-1000 3y ago
  Well... here's the dumb thing. The DASH-like manner (or, "rolling cipher" as they like to call it) has currently held up as being an effective protection measure. It comes up all the time when RIAA in particular sues YouTube stream-rippers. https://torrentfreak.com/deciphering-youtubes-rolling-cypher-in-your-browser-is-a-piece-of-cake-201030/ https://torrentfreak.com/deciphering-youtubes-rolling-cypher...
  - hunter2_ 3y ago
    Very interesting. I feel like any type of digital storage or transmission format (PCM audio formats like CD Audio, packet switched networks like Internet Protocol, etc.) could also be described thusly, given that a typical human can't readily consume it. We use a tool that parses it using some algorithm, not a tool that avoids/breaks the algorithm. The error correction of a CD or the sequence number of a packet surely rolls way more rapidly than those DASH slices, too. Are those more common formats also considered effective access controls, since humans have severe difficulty interacting with them without the help of a tool? Granted, I suppose the difference there is that the creators of those formats/protocols did publish the spec, whereas YouTube didn't. Or did they, though? The JavaScript that YouTube serves is the instruction for parsing the DASH response, available publicly, hardly different from publications like IEC 60908 ("Red Book" CD-DA spec) or an RFC 791 (IP spec) -- a different language, is all. What a mess.
    - Mindwipe 3y ago
      The difference is also intent. YouTube implemented the rolling cypher to satisfy music industry demands that the files were not permanently downloadable (and it appears they were able to provide abundant evidence that Google has communicated that to them in court, I don't think this is a controversial point). That wasn't the point of the red book spec. Intent matters significantly, legally.
      - hunter2_ 3y ago
        If the rolling cypher they implemented truly exceeds DASH in such a way as to exert control, then I think that would convey intent. If it's substantially DASH alone and DASH requires the equivalent of a rolling cypher just to work, that's rather meaningless; the intent of implementing DASH certainly would've had most to do with adaptive bitrate UX. Based on some other comments, it sounds like they added something like this for music videos and the like, so it may hold up. But I'm armchair judging at this point, and IANAJ. Isn't a rolling code how RF locks (car fob, garage opener, etc.) operate? Those are actually good at keeping out third parties, though.
  - 3y ago
AnthonyMouse 3y ago
DMCA 1201 isn't just a crap law. It's completely unworkable, as has been known since before it was passed. Suppose Bob is in the business of duplicating public domain US government works. He downloads videos from the NASA website, presses them onto DVDs and sells them on eBay. He can do this without anybody's permission because DVDs are from the mid-90s and the patents are expired. He uses the same DVD format as Hollywood so people can watch them on their existing DVD players, but he also makes a free DVD player app for Linux so people can watch his DVDs or rip them or do whatever they want because they're in the public domain. It can also do the same with any other DVDs, because it's the exact same format. Is Bob breaking the law? Now suppose Bob is a jerk who is doing this with public domain works without providing anyone a way to exercise their right to copy them, or doing it to enforce contractually unlawful license terms or something like that. Is someone who makes a tool to thwart Bob breaking the law? If so the law could have (more) First Amendment problems, to say nothing of the obvious unreasonableness. But if not then it's a worthless law because anyone could use that as a justification to break anything. Which it is regardless because it has never been effective at suppressing the availability circumvention tools, only at should-be-impermissible abuses like prohibiting interoperability to prop up existing monopolies. It's also notable that NASA publishes many videos on YouTube. As in, only on YouTube.
- kmeisthax 3y ago
  DVD supports both encrypted and unencrypted video, so Bob is only breaking the law if he's releasing a decryption tool. The entire DeCSS case hinged on video decryption specifically, everything else was already implemented by other parties. Now, if Bob decides to encrypt those DVDs, then you have an interesting legal area where half the law applies and the other half doesn't. DMCA 1201 only applies to things that protect copyrighted works[0], not just any kind of access control measure. And it comes in two parts: one that makes it illegal to break encryption, and another that makes it illegal to provide tools to break encryption. So if you put uncopyrightables behind DVD CSS's encryption algorithm, you can't sue someone for decrypting that particular DVD. But if you distribute a DVD decryption tool, then you're harming the protection of copyrighted DVDs, so you can't distribute a decryption tool even though some jackass might try to functionally recopyright public domain material with DVD CSS. More interesting than the NASA case would be Kevin MacLeod. He releases Creative Commons music under a CC-BY license, and that license has a clause specifically prohibiting the distribution of Creative commons material with DRM on it. A lot of YouTubers use his music, probably didn't know about this clause, and definitely didn't know that the music industry would rugpull everyone by claiming that dynamic download URLs are a DMCA 1201 technical protection. So if these music industry cases succeed, it also means that a lot of YouTubers are open to some copyleft trolling on Kevin's part. I doubt he'd actually do that, but it's still shitty that this is possible. [0] See Chamberlain Group v. Skyline Technologies; https://en.wikipedia.org/wiki/Chamberlain_Group,_Inc._v._Skylink_Technologies,_Inc.#Decision https://en.wikipedia.org/wiki/Chamberlain_Group,_Inc._v._Sky...

JohnFen 3y ago

> I realize that broken encryption is considered an effective access control in this context despite it being broken, but apps like Newpipe aren't even breaking encryption, right? Encryption isn't the only access control. "Access control" is a pretty loose term. I think of it as being similar to what (in the US) counts as "breaking" in a breaking-and-entering charge: you've "broken into" a place if you had to move anything in order to enter. Even a door that is partially ajar and you had to slightly move it to slip by.

hunter2_ 3y ago
I agree. But what is the thing being moved here, in technical (rather than legal) terms?
- JohnFen 3y ago
  I don't know in this particular piece of software. I'm just saying that an "effective access control" can be something very trivial. It doesn't have to be anything as sophisticated as encryption. Just to speculate, it could be something like using the user's login credentials.

bragr 3y ago

>What aspect of the YouTube servers' behavior can be construed as an effective access control? Is there even a rudimentary secret My understanding is that YouTube does implement a trivial sort of DRM/encoding with a rolling cypher to the actual location of video file. This is what tools like youtube-dl implement, and what get their DCMA from the RIAA. It's supposedly very light weight in terms of DRM, and notably I don't think Google has ever attempted to change it to break downloaders.

justinclift 3y ago
> YouTube does implement a trivial sort of DRM/encoding Nope. Youtube break their streams up into a number of tiny pieces so they can adjust bandwidth dynamically extremely easily. It's just the RIAA and friends looking for an excuse, so they've attempted (and likely will continue attempting) to make people believe that's "sort form of DRM". Don't get fooled by their bullshit.
- dtech 3y ago
  Iirc correctly the youtube-dl thing was about an additional layer of "protection" that was only used for music video's and the like
- rocqua 3y ago
  As I understand the 'cipher' is in how you find the next tiny piece of stream. I haven't grasped fully how that works for Youtube but it is certainly more than 'increment a counter'. I believe it is something like 'read a variable in the previous packet and decode it'. If they wanted any semblance of an argument, decoding that variable should require a session key that is set on log-in or after a captcha. But I doubt they do that, it would be a horrible hassle to handle the session dependant encoding.
  - hunter2_ 3y ago
    Interesting. So instead of authorizing the fetching of pieces by way of authentication, they're just saying "you can have another piece if we've been talking since the very first piece". I guess that's a bit of a control, just not secret whatsoever. I feel conditioned to equate the two, but they're distinct concepts I suppose. A CAPTCHA is an access control, and one that doesn't rely on secrets.

Retr0id 3y ago

For better or for worse, something being "free" doesn't change anything regarding copyright or access control.

yosito 3y ago

> YouTube is free I'd argue that even YouTube users who aren't paying for premium are paying too, just with their personal data instead of state currency. But it's still an exchange of value. Which IIRC, is the whole reason Newpipe exists, to circumvent that exchange of value.

bjoli 3y ago
I pay for Google premium, but use NewPipe since it is better than the regular app in many ways.
franga2000 3y ago
It's not just data. Watching ads is paying, because it increases the viewers' cumulative likeliness to spend money with the brands whose ads they see. The way money leaves your wallet is through probability, spread out in time and with the viral ability to spread to others. Compared to a fixed subscription or one-time payment, this is a lot harder to notice or control, but it's money leaving your wallet nonetheless.