8 ms·

DMCA Notices Took Down 20,517 GitHub Projects Last Year

78 points by isaacfrond 3y ago

WarOnPrivacy 3y ago
Modern copyright doing what it does best: Limiting creativity & productivity, typically to the benefit of deeper pockets.
- sidewndr46 3y ago
  At least several of those are from me. I found numerous instances of individuals taking my CC by attribution and BSD licensed work, stripping all of the identifying information & then posting it as their own work.
  - master-lincoln 3y ago
    Those were most likely done with malicious intend. So did the perpetrators face any other consequence apart from having their repository closed? Does DMCA help to make this happen less often?
    - Sirizarry 3y ago
      It only stops honest people from making “mistakes”. Anyone with the desire to abuse these frankly stupid copyright laws can and will do so
  - thomastjeffery 3y ago
    ~~That's literally what the BSD license is for.~~ nevermind, BSD includes attribution... As for attribution... why in the world can't we just prosecute people for fraud? Fraud has been illegal literally the whole time. There is no reason it should be resolved with copyright or contracts.
- NovemberWhiskey 3y ago
  Look; I'm no more of a fan of big-copyright than anyone else, but I'm still pretty sure that investment in tools that ultimately serve to let you download YouTube videos bypassing the site (etc) return fairly little in terms of either creativity or productivity to the world.
  - jdiff 3y ago
    This is such a crazy comment to read from my perspective because the answer seems so painfully obvious to me: of course it encourages creativity, and of course it boosts productivity. Being able to obtain, manipulate, and reshare bits of culture like videos is a huge source of creativity. Even in the commercial creative world, being able to download a trailer, advertisement, or really any video with a particular effect and take it frame-by-frame to dissect and understand it is a powerful learning tool. And it's valuable to be able to archive works that are likely to be torn down or that need to be accessed offline. As an example of the latter, I'm currently a high school software teacher, I often download videos demonstrating this or that and share the MP4s with my students since YouTube is blocked.
    - tmaly 3y ago
      There is some gray area with fair use I have found. When I was in the university, some of my roommates were in the film department. Their was this understanding that you could use a certain number of seconds of a copyrighted video in your project. But in practice today, it is hit or miss. I have seen a TikTok stitching Harry Potter to make a parody taken down as violating copyright. While there exists other videos on TikTok doing the same thing for longer duration.
      - jdiff 3y ago
        This isn't fair use changing, it's the platforms. It's all fair use, but it's easier to take things down without question, without even receiving an actual DMCA takedown notice. Music going on in the background for a 15 second video does not replace or in any way negatively affect the market value of music used. And yet, my fiancee has scrolled through her TikTok bookmarks to show me how long she can go without running into a video that isn't silent with a copyright notice banner along the bottom. It's not about fair use or even making sense, it's about the ego and what they can get away with.
- alephnerd 3y ago
  A number of GitHub repos are just lists of torrent sites and download links. For example, this - https://github.com/orgs/community/discussions/105156 https://github.com/orgs/community/discussions/105156 Edit: Turns out the repo got taken down
boomboomsubban 3y ago
I still don't see why anyone is responding to DRM circumvention DMCA takedowns. The DMCA is very clear about the penalties for a circumvention tool needing a court order, and the section on takedowns does not mention circumvention. I sometimes wonder if I'm missing some relevant change in law or case law, as the sections seem easy to read as somebody who isn't a lawyer.
- some_random 3y ago
  DMCA takedown notices have become a sort of gentlemen's agreement to avoid either party ever having to go to court where they could both end up spending lots of money.
- Shrezzing 3y ago
  If someone says they're going to sue you, and it's black-and-white that they'd win the suit, then it's pragmatic for all parties concerned to just skip the time & cost of a court appearance, and just do the thing the court would otherwise force you to do. In a sane world, civil suits between firms should really only go ahead if the case's result is ambiguous, and the courts in this case would almost certainly side with the takedown request - and moreover would be pissed at Github for wasting the court's time on it.
  - boomboomsubban 3y ago
    Github can't reasonably he considered one of the parties in this scenario, the owners of the circumvention technology would be.
    - Shrezzing 3y ago
      If a GitHub user fails to respond to a DMCA request, and GitHub doesn't remove the content in question, GitHub as a service provider would then become party to the complaint under the copyright safe-harbor rules (a suit that GitHub would definitely lose, and can have fairly drastic downstream consequences for their status as a safe-harbor going forward). It's not that users are irrationally responding to DMCA requests when they don't need to, its that as a service provider, GitHub defaults to a stance where a claimant's DMCA is automatically processed if a repo author doesn't reply within 1 working day. This effectively means that for DMCA requests of all types on GitHub, "no response" is synonymous with "I'm guilty of infringement, plaese take down the content". A DMCA claim response in GitHub is admissible as testimony should the case ever make it to court, and therefore carries the penalty of perjury (both parties are informed of this before opening/responding to the claim in the GitHub UI). So unless the repo author is absolutely certain that they're not hosting DRM circumvention software, they have little-to-no recourse but to allow the takedown request to go ahead.
RajT88 3y ago
Not sure if DMCA is invoked to take them down, but a friend of mine recently challenged me to scrape a video file from one of these shady free streaming sites. I promise this has something to do with GitHub. Gamely, I accepted the challenge. Browser dev mode to sniff things out was very difficult - they put a lot of work into jamming that up. Turns out it is trivially easy with Fiddler. What I learned in the process was interesting, trying on a few video files. What these sites do is slice up their video files into thousands of chunks, and then rename the files as innocuous file extensions (like *.jpg, *.html, *.csv, etc.) and stick them on various hosting services where you can do a GET on the file for free with no authentication. They spread those thousands of files for each video file all over the internet. Usually across multiple accounts / repos on a service like GitHub but not just GitHub - any place they can manage. A lot I looked at while testing had files on GitHub though. Then, once the thousands of files are distributed, they stitch them together via an *.m3u8 playlist file which the in-browser player can handle buffering to make it all seamless.
- Grimblewald 3y ago
  Thanks for sharing, that was enormously intriguing. Do you have a bigger write-up on this? I'd love to read it.
  - deleted 3y ago
    [deleted]
  - EMIRELADERO 3y ago
    https://github.com/movie-web https://github.com/movie-web covers this quite well
    - notso411 3y ago
      [dead]
    - cosmojg 3y ago
      Oh wow, this is quite practical! Thanks for sharing! In the past, I've typically relied on a great deal of google-fu and considerable time investment (~10 minutes! *gasp*) whenever I couldn't find a show on one of the big streaming services, and it seems like the backend sources made available by the movie-web extension are a superset of those used by the various shady and ephemeral middleman-of-the-month streaming websites I would typically land on. It's also quite nice how they've neatly open-sourced and atomized all the little tools that go into making the service work such that one could, in theory, build other services on top of these tools. The quality of the documentation is outstanding, too.
gtirloni 3y ago
For DMCA, the reporting process is really optimized. If you try to report spam/malware on the other hand, good luck. GitHub only lets you open 2 tickets every few days and each has to be for a specific repo. I've tried to tell them how I was able to easily find spam/malware by using the search and they shut me down.
- junon 3y ago
  Spam or malware sources or covert, intentionally malicious binaries? Malware sources are expressly allowed on GitHub for reasons of education.
  - gtirloni 3y ago
    I'm aware of that and I'm not shitting on security researchers. These are covert intentionally malicious binaries that attackers were hosting on GitHub and trying to get victims to download and run. Also, lots of empty repositories with descriptions like "download leaked onlyfans of her here: <url with tons of malware>". I'm not going to waste my time trying to report that anymore though.
    - junon 3y ago
      Ahh yeah, okay. That's a shame though, I can't stand how bad GitHub's support has gotten since the acquisition.
zengid 3y ago
"...copyright law is the only functional internet law" - Nilay Patel [0] [0] https://x.com/reckless/status/1558065621925072901?s=20 https://x.com/reckless/status/1558065621925072901?s=20
deleted 3y ago
[deleted]

78 points by isaacfrond 3y ago

Modern copyright doing what it does best: Limiting creativity & productivity, typically to the benefit of deeper pockets.

sidewndr46 3y ago
At least several of those are from me. I found numerous instances of individuals taking my CC by attribution and BSD licensed work, stripping all of the identifying information & then posting it as their own work.
- master-lincoln 3y ago
  Those were most likely done with malicious intend. So did the perpetrators face any other consequence apart from having their repository closed? Does DMCA help to make this happen less often?
  - Sirizarry 3y ago
    It only stops honest people from making “mistakes”. Anyone with the desire to abuse these frankly stupid copyright laws can and will do so
- thomastjeffery 3y ago
  ~~That's literally what the BSD license is for.~~ nevermind, BSD includes attribution... As for attribution... why in the world can't we just prosecute people for fraud? Fraud has been illegal literally the whole time. There is no reason it should be resolved with copyright or contracts.
NovemberWhiskey 3y ago
Look; I'm no more of a fan of big-copyright than anyone else, but I'm still pretty sure that investment in tools that ultimately serve to let you download YouTube videos bypassing the site (etc) return fairly little in terms of either creativity or productivity to the world.
- jdiff 3y ago
  This is such a crazy comment to read from my perspective because the answer seems so painfully obvious to me: of course it encourages creativity, and of course it boosts productivity. Being able to obtain, manipulate, and reshare bits of culture like videos is a huge source of creativity. Even in the commercial creative world, being able to download a trailer, advertisement, or really any video with a particular effect and take it frame-by-frame to dissect and understand it is a powerful learning tool. And it's valuable to be able to archive works that are likely to be torn down or that need to be accessed offline. As an example of the latter, I'm currently a high school software teacher, I often download videos demonstrating this or that and share the MP4s with my students since YouTube is blocked.
  - tmaly 3y ago
    There is some gray area with fair use I have found. When I was in the university, some of my roommates were in the film department. Their was this understanding that you could use a certain number of seconds of a copyrighted video in your project. But in practice today, it is hit or miss. I have seen a TikTok stitching Harry Potter to make a parody taken down as violating copyright. While there exists other videos on TikTok doing the same thing for longer duration.
    - jdiff 3y ago
      This isn't fair use changing, it's the platforms. It's all fair use, but it's easier to take things down without question, without even receiving an actual DMCA takedown notice. Music going on in the background for a 15 second video does not replace or in any way negatively affect the market value of music used. And yet, my fiancee has scrolled through her TikTok bookmarks to show me how long she can go without running into a video that isn't silent with a copyright notice banner along the bottom. It's not about fair use or even making sense, it's about the ego and what they can get away with.
alephnerd 3y ago
A number of GitHub repos are just lists of torrent sites and download links. For example, this - https://github.com/orgs/community/discussions/105156 https://github.com/orgs/community/discussions/105156 Edit: Turns out the repo got taken down

boomboomsubban 3y ago

I still don't see why anyone is responding to DRM circumvention DMCA takedowns. The DMCA is very clear about the penalties for a circumvention tool needing a court order, and the section on takedowns does not mention circumvention. I sometimes wonder if I'm missing some relevant change in law or case law, as the sections seem easy to read as somebody who isn't a lawyer.

some_random 3y ago
DMCA takedown notices have become a sort of gentlemen's agreement to avoid either party ever having to go to court where they could both end up spending lots of money.
Shrezzing 3y ago
If someone says they're going to sue you, and it's black-and-white that they'd win the suit, then it's pragmatic for all parties concerned to just skip the time & cost of a court appearance, and just do the thing the court would otherwise force you to do. In a sane world, civil suits between firms should really only go ahead if the case's result is ambiguous, and the courts in this case would almost certainly side with the takedown request - and moreover would be pissed at Github for wasting the court's time on it.
- boomboomsubban 3y ago
  Github can't reasonably he considered one of the parties in this scenario, the owners of the circumvention technology would be.
  - Shrezzing 3y ago
    If a GitHub user fails to respond to a DMCA request, and GitHub doesn't remove the content in question, GitHub as a service provider would then become party to the complaint under the copyright safe-harbor rules (a suit that GitHub would definitely lose, and can have fairly drastic downstream consequences for their status as a safe-harbor going forward). It's not that users are irrationally responding to DMCA requests when they don't need to, its that as a service provider, GitHub defaults to a stance where a claimant's DMCA is automatically processed if a repo author doesn't reply within 1 working day. This effectively means that for DMCA requests of all types on GitHub, "no response" is synonymous with "I'm guilty of infringement, plaese take down the content". A DMCA claim response in GitHub is admissible as testimony should the case ever make it to court, and therefore carries the penalty of perjury (both parties are informed of this before opening/responding to the claim in the GitHub UI). So unless the repo author is absolutely certain that they're not hosting DRM circumvention software, they have little-to-no recourse but to allow the takedown request to go ahead.

RajT88 3y ago

Not sure if DMCA is invoked to take them down, but a friend of mine recently challenged me to scrape a video file from one of these shady free streaming sites. I promise this has something to do with GitHub. Gamely, I accepted the challenge. Browser dev mode to sniff things out was very difficult - they put a lot of work into jamming that up. Turns out it is trivially easy with Fiddler. What I learned in the process was interesting, trying on a few video files. What these sites do is slice up their video files into thousands of chunks, and then rename the files as innocuous file extensions (like *.jpg, *.html, *.csv, etc.) and stick them on various hosting services where you can do a GET on the file for free with no authentication. They spread those thousands of files for each video file all over the internet. Usually across multiple accounts / repos on a service like GitHub but not just GitHub - any place they can manage. A lot I looked at while testing had files on GitHub though. Then, once the thousands of files are distributed, they stitch them together via an *.m3u8 playlist file which the in-browser player can handle buffering to make it all seamless.

Grimblewald 3y ago
Thanks for sharing, that was enormously intriguing. Do you have a bigger write-up on this? I'd love to read it.
- deleted 3y ago
  [deleted]
- EMIRELADERO 3y ago
  https://github.com/movie-web https://github.com/movie-web covers this quite well
  - notso411 3y ago
    [dead]
  - cosmojg 3y ago
    Oh wow, this is quite practical! Thanks for sharing! In the past, I've typically relied on a great deal of google-fu and considerable time investment (~10 minutes! *gasp*) whenever I couldn't find a show on one of the big streaming services, and it seems like the backend sources made available by the movie-web extension are a superset of those used by the various shady and ephemeral middleman-of-the-month streaming websites I would typically land on. It's also quite nice how they've neatly open-sourced and atomized all the little tools that go into making the service work such that one could, in theory, build other services on top of these tools. The quality of the documentation is outstanding, too.

gtirloni 3y ago

For DMCA, the reporting process is really optimized. If you try to report spam/malware on the other hand, good luck. GitHub only lets you open 2 tickets every few days and each has to be for a specific repo. I've tried to tell them how I was able to easily find spam/malware by using the search and they shut me down.

junon 3y ago
Spam or malware sources or covert, intentionally malicious binaries? Malware sources are expressly allowed on GitHub for reasons of education.
- gtirloni 3y ago
  I'm aware of that and I'm not shitting on security researchers. These are covert intentionally malicious binaries that attackers were hosting on GitHub and trying to get victims to download and run. Also, lots of empty repositories with descriptions like "download leaked onlyfans of her here: <url with tons of malware>". I'm not going to waste my time trying to report that anymore though.
  - junon 3y ago
    Ahh yeah, okay. That's a shame though, I can't stand how bad GitHub's support has gotten since the acquisition.

zengid 3y ago

"...copyright law is the only functional internet law" - Nilay Patel [0] [0] https://x.com/reckless/status/1558065621925072901?s=20 https://x.com/reckless/status/1558065621925072901?s=20

deleted 3y ago

[deleted]