7 ms·

If people fork the repo, would they also be sent a takedown?

EspadaV9 3y ago
If people are forking it, it would probably be worth mirroring it to GitLab, Sourcehut, Codeberg, or some other place that isn't GitHub, since they could likely very easily remove all the forks at once if asked.
aaomidi 3y ago
If you fork it, do a proper git clone and git push. Github can and has DMCAed direct forks in the past.
- sokoloff 3y ago
  At the risk of asking a dumb question, what does a git push do for you there? (Fully agree on the clone locally point.)
  - pc86 3y ago
    Not the GP but at that point it's available and more discoverable for at least a little while longer for others (and no guarantee you'd get hit with a takedown as well).
    - sokoloff 3y ago
      Thank you! I was considering a different/lesser form of "keep it privately available" (as I suspected that keeping it widely/anonymously publicly available was never going to work.)
    - hooverd 3y ago
      Don't rely on GH alone. Save a local copy. Host it somewhere that isn't so centralized and discoverable. One upside of increasing centralization is that people who you don't want finding things are awful at finding said things that exist outside it.
  - jeroenhd 3y ago
    If Github doesn't realise you forked the project, it doesn't appear in the list of forks, which a lot of companies use when sending an actual DMCA notice to Github. I'm not sure what you'd need to do to disconnect your fork, but clicking the "fork" button will often get your repo automatically taken down if the parent repository gets DMCA'd. If the commit history is different (say, because you rebased the project onto a slightly different initial state), Github won't auto-detect the fork as easily, so the lawyers would need to find your project and include it in their takedown notice.
    - sokoloff 3y ago
      When I read ‘git clone’, I assumed “on the command line of a machine you control, run git clone” not “use GitHub’s repo fork web interface action”.
  - nostrademons 3y ago
    It's not marked as a fork in their systems. Instead, it's as if you'd written a bunch of code in a local repository and then pushed it to GitHub. It could still be identified as the same codebase by eg. comparing commit hashes or content hashes, but that's harder. If you really want to be sure, clone the repository, make a few local edits to files (eg. adding a comment to each file), copy the full source repository to a new directory in the filesystem, git init that as a new repository, commit changes, and push. That blows away all the existing history of commits, and ensures that each file has a different hash. It's still technically possible to detect it as a dupe, but would require an extremely expensive shingling or filesystem diff on every repository in GitHub.
    - aaomidi 3y ago
      Find the first commit and overwrite it :P
      - bspammer 3y ago
        That could still be fairly easily detected by looking at the tree and blob ids.
      - xeromal 3y ago
        I never use squash but couldn't you squash all the commits into a new one for a new history?
    - penteract 3y ago
      > It's still technically possible to detect it as a dupe, but would require an extremely expensive shingling or filesystem diff on every repository in GitHub. Wouldn't a GitHub search still find it pretty easily? As I understand it, they put significant effort into supporting search; but since that's being done anyway, it doesn't have a very high marginal cost.
- tzs 3y ago
  This doesn't appear to be a DMCA takedown request, so I doubt Github would care. This appears to be the company contacting the developer directly to ask that they withdraw the code.
  - detaro 3y ago
    because a company asking for a takedown would never file a takedown request afterwards?
    - tzs 3y ago
      In this case probably not. DMCA takedown requests are only for alleged copyright infringement. The allegation here is that the software is using an API on a company server in violation of the terms of use.

If people are forking it, it would probably be worth mirroring it to GitLab, Sourcehut, Codeberg, or some other place that isn't GitHub, since they could likely very easily remove all the forks at once if asked.

aaomidi 3y ago

If you fork it, do a proper git clone and git push. Github can and has DMCAed direct forks in the past.

sokoloff 3y ago
At the risk of asking a dumb question, what does a git push do for you there? (Fully agree on the clone locally point.)
- pc86 3y ago
  Not the GP but at that point it's available and more discoverable for at least a little while longer for others (and no guarantee you'd get hit with a takedown as well).
  - sokoloff 3y ago
    Thank you! I was considering a different/lesser form of "keep it privately available" (as I suspected that keeping it widely/anonymously publicly available was never going to work.)
  - hooverd 3y ago
    Don't rely on GH alone. Save a local copy. Host it somewhere that isn't so centralized and discoverable. One upside of increasing centralization is that people who you don't want finding things are awful at finding said things that exist outside it.
- jeroenhd 3y ago
  If Github doesn't realise you forked the project, it doesn't appear in the list of forks, which a lot of companies use when sending an actual DMCA notice to Github. I'm not sure what you'd need to do to disconnect your fork, but clicking the "fork" button will often get your repo automatically taken down if the parent repository gets DMCA'd. If the commit history is different (say, because you rebased the project onto a slightly different initial state), Github won't auto-detect the fork as easily, so the lawyers would need to find your project and include it in their takedown notice.
  - sokoloff 3y ago
    When I read ‘git clone’, I assumed “on the command line of a machine you control, run git clone” not “use GitHub’s repo fork web interface action”.
- nostrademons 3y ago
  It's not marked as a fork in their systems. Instead, it's as if you'd written a bunch of code in a local repository and then pushed it to GitHub. It could still be identified as the same codebase by eg. comparing commit hashes or content hashes, but that's harder. If you really want to be sure, clone the repository, make a few local edits to files (eg. adding a comment to each file), copy the full source repository to a new directory in the filesystem, git init that as a new repository, commit changes, and push. That blows away all the existing history of commits, and ensures that each file has a different hash. It's still technically possible to detect it as a dupe, but would require an extremely expensive shingling or filesystem diff on every repository in GitHub.
  - aaomidi 3y ago
    Find the first commit and overwrite it :P
    - bspammer 3y ago
      That could still be fairly easily detected by looking at the tree and blob ids.
    - xeromal 3y ago
      I never use squash but couldn't you squash all the commits into a new one for a new history?
  - penteract 3y ago
    > It's still technically possible to detect it as a dupe, but would require an extremely expensive shingling or filesystem diff on every repository in GitHub. Wouldn't a GitHub search still find it pretty easily? As I understand it, they put significant effort into supporting search; but since that's being done anyway, it doesn't have a very high marginal cost.
tzs 3y ago
This doesn't appear to be a DMCA takedown request, so I doubt Github would care. This appears to be the company contacting the developer directly to ask that they withdraw the code.
- detaro 3y ago
  because a company asking for a takedown would never file a takedown request afterwards?
  - tzs 3y ago
    In this case probably not. DMCA takedown requests are only for alleged copyright infringement. The allegation here is that the software is using an API on a company server in violation of the terms of use.