5 ms·

DMCA Notice Targeting 'Bypass Paywalls Clean' Isn't the Thing to Get Angry About

57 points by pabs3 3y ago

deleted 3y ago
[deleted]
eduction 3y ago
Bizarre to call this “circumvention”. I have not looked at BPC but I have an idea what’s going on: Many “paywalls” operate by letting you download the full content of an article but covering it up with an overlay imposed via JavaScript code. You’d be surprised how many so-called paywalls stop working when you turn off JavaScript. Presumably at least part of how BPC works is simply blocking the JavaScript from covering up the content already transmitted to you. So this is what passes for circumvention these days: A publisher sends you the full content of an article in a web page, but you decline to run hostile code that would like to hide most of the content you have already downloaded. We are a long, long way from DeCSS. At least that involved decryption. This essentially criminalizes “view source.”
- bee_rider 3y ago
  I often browse without JavaScript, and often find myself bumping into paywalled sites don’t send the article in the first place. Of course, it is hard to distinguish between that, and a page that is just broken without JavaScript.
  - shiroiushi 3y ago
    If a paywalled site doesn't send the article in the first place unless you have a valid, paid account that you've logged in with, then what exactly is the problem with BPC? BPC can't hack into accounts like that.
    - czarit 3y ago
      Guessing from the interface it exposes, BPC seems to work by making a ruleset matching sites with a battery of possible changes, including resetting cookies (to reset freebie-counters), fetching from Google cache, disabling javascript (for purely client-side paywalls) and by finding exceptions for the paywall (user-agent, referer, IP). The last one is probably the one that is closest to being a breach of some law. If the plugin did not ship with rules for a lot of sites, it would probably be considered harmless, but shipping a list of the magic user-agents etc. that circumvents paywalls seems risky, legality-wise.
      - bee_rider 3y ago
        Although, it seems really weird, user-agents are generally thought of as an authentication mechanism, right? I’m 0% sympathetic to sites that for which this works. The reason they accept these user agents is to mislead Google, right? I think it is fine for a site to not send content to me if I have ads or JavaScript disabled, or if I don’t have a subscription. But it is wrong to falsely advertise that the content is available. For some reason I assumed this had some automatic archive integration or something like that—actually circumventing real account mechanisms by copying out the content to some third party host. Because otherwise, taking them down seems pretty dumb. But then, I should not have assumed, the world is a pretty dumb place.
karma_pharmer 3y ago
although the definition of ‘free’ has been adjusted over time, mostly to mean no money changes hands. Just watch a few ads, allow the content providers to share your data with the world, and enjoy a lifetime of ‘free’ content. And it stays this way, because attention and personal data are magically exempt from AML/KYC. If I "pay with my attention" by watching ads, no AML/KYC is required. If I "pay with my data" by being tracked, no AML/KYC is required. But if I want to pay with real money, AML/KYC is required. And the cost of doing AML/KYC is prohibitive for micropayments. We have outlawed micropayments-with-money while allowing micropayments-with-data and micropayments-with-attention. The result of doing this should surprise absolutely nobody.
- runiq 3y ago
  What are/is AML/KYC?
  - kelsey98765431 3y ago
    Anti Money Laundering and Know Your Customer legislation that certain businesses and entities under financial oversight must adhere to in order to prevent funding of state sanctioned entities.
  - bradley13 3y ago
    AML - Anti-Money Laundering KYC - Know Your Customer
- nonrandomstring 3y ago
  We asked what is "self respect?" in a recent thread [0]. Here's a fresh definition; It's the difference in the exchange rate between dollars and the alternative currency of attention and personal data. I've been on the Internet since it existed (well, mid 80s) and never had a problem that some things must be paid for. But for whatever reason (the corrupt banking system?) micropayments never got traction. So, as you say, alternative economies have arisen. Some people have been happy to treat their data and time like the price of a cup of coffee. For me, I would not give my attention or personal data for hundreds of thousands of dollars. So each person has their own "price for which they will sell themselves", and in the digital world that is what "self-respect" means. It also means the determination to stick by that self valuation. This gives corporations an incentive to aggressively drive down self-respect - to get a better exchange rate. BigTech not only wants to colonise your devices, it wants to colonise your dignity, to undermine your confidence, independence and sense of self-worth. No wonder there is a mental health crisis arising from digital technology. Sadly for BigTech things are moving the other way. Minimum levels of dignity and self-respect are literally being legislated. But also (perhaps consequently) people are waking up and realising the real value of their attention and private affairs. A hope is that this forces BigTech to turn on the banking system and financial regulators, so we can finally get universal, frictionless anonymous micropayments and put this while tawdry "surveillance capitalism" episode behind us. [0] https://news.ycombinator.com/item?id=39999713 https://news.ycombinator.com/item?id=39999713
deleted 3y ago
[deleted]
iplaundering 3y ago
If only dmca notices were being sent to microsoft and open AI for their wide scale intellectual property laundering theft, but when its in big corp interest the laws bend to them. Rule of law is dead.
- crummy 3y ago
  The NYT is taking big AI to court right?
  - dmcahhhhbbb 3y ago
    False equivalency, dmca notices get immediately enforced, meanwhile big AI continues to steal and launder millions of stolen works while the courts slowly grind out an outcome that will surely benefit everyone but the individuals whose life's work were stolen. The rule of law is dead.
gnabgib 3y ago
HN Discussion a couple of days ago:[0] (326 points, 2 days ago, 122 comments) [0]: https://news.ycombinator.com/item?id=40015961 https://news.ycombinator.com/item?id=40015961
floating-io 3y ago
Correct me if I'm wrong, but this plugin just removes stuff that the site puts over the content to restrict it. It doesn't fool the site into sending the content to the user's computer; it's already done that. Am I wrong in this? IMO, there needs to be shift in understanding. They sent their information to my computer. Whatever I do with what they sent is my business, not theirs. It's on my computer. And yet they want it to stop. IMO, if you want it to stop, don't be lazy; don't send it in the first place. Then a bypass might have CFAA behind it. These are the same people who want to use my bandwidth and CPU capacity to track me everywhere I go on the web. If they can make legal claims about what I do with the information they send to my computer, I should be able to make legal claims for them using my own computer against me without my consent. Of course, I'm also more than a little drunk at the moment, so what do I know?
- anon373839 3y ago
  Even though drunk, I think you have articulated valid points. Visiting a website is not making a binding promise that your user agent will execute all scripts that are served. In fact, if you consider a11y needs, the web could never work that way. I don’t think publishing information can come with a conditional license on how the information is processed (“the reader shall not skip ahead to the ending of this book”).
- squigz 3y ago
  > IMO, there needs to be shift in understanding. They sent their information to my computer. Whatever I do with what they sent is my business, not theirs. It's on my computer. And yet they want it to stop. This is the whole thing to me. Companies like YT have no right to force me to see stuff I don't want to, or bypass what I say goes on in my browser (i.e., an adblocker) If they don't like it, they can not serve my requests. Simple.
  - appplication 3y ago
    This is such a wildly first-amendment-forward take I couldn’t even begin to understand how you could construct a principled argument against it.
voiceblue 3y ago
Having been a victim of DMCA abuse, sometimes it's just easier to shut shop if you're not feeling it to be worth your time and effort to counterclaim and partake of legal battles. This is especially the case if you never bothered to form a legal entity in the first place (which is an indicator that the product/project was not worth such extra effort). In this sense I think the prevalence of such DMCA notices has made the internet a bit of a hostile place, just this month we were reading about it here. [0] Is there any chance these laws will be fixed? [0] https://news.ycombinator.com/item?id=39934696 https://news.ycombinator.com/item?id=39934696
- shiroiushi 3y ago
  >Is there any chance these laws will be fixed? Probably about the same chance that Apophis will strike the Earth next time it comes around in the next decades, and wipe out humanity.
kelsey98765431 3y ago
I hate to say it, but under the CFAA this is absolutely a circumvention of an access control displayed on connection to the computer system. Bypassing that access control, no matter how weak it is, no matter that they already gave you the data, as long as that data comes with an access restriction that explicitly informs you that accessing the obfuscated data is a circumvention of their poorly designed access control - it's a CFAA felony violation. Reform is the answer. Repeal the CFAA and introduce better legislation aligned with the reality we live in today instead of the barely understood beauty of the baud that informed the creation of the Computer Fraud and Abuse Act of the 80s. This is a fully busted law that harms every single entity it interacts with besides the budget of the FBI and the courts. Oh and the for profit prison system.
- indymike 3y ago
  > I hate to say it, but under the CFAA this is absolutely a circumvention of an access control displayed on connection to the computer system. No. The information has been sent to my computer. I can view it in the browser inspector. There is no real access control here - only styling that hides content when rendered by the browser.
  - calgoo 3y ago
    I agree, was there not a case recently where all the information was being posted on the government webpage, and depending on your info it only show a select view. It was found that if you viewed the source it showed all the info for all users. The judge upheld that it was not hacking as the governor had stated.
    - tomkarho 3y ago
      https://missouriindependent.com/2022/02/23/claim-that-reporter-hacked-state-website-was-debunked-parson-still-says-hes-a-criminal/ https://missouriindependent.com/2022/02/23/claim-that-report... You mean this? "Cole County Prosecutor Locke Thompson declined to press charges, saying that if any crime was committed it was both unintentional and based on a law so broad and vague it essentially criminalizes “using a computer to look up someone’s information."
ryanjshaw 3y ago
I'm curious. For anybody here: when was the last time a paywall news article improved your QOL, and in what way? I have been doing just fine without this stuff for years now, am I missing out?
dbetteridge 3y ago
These projects really need to start distributing a torrent seed with each release, otherwise you're at the full whims of (usually American) tech companies to nuke at any time
- crtasm 3y ago
  IPFS seems more like the way to go, but you still need a way to get updates to your users
  - brokenmachine 3y ago
    BitTorrent v2 supports updates, "mutable torrents", I'm dreaming of the day we see it widely adopted.
janalsncm 3y ago
If we want journalists to be able to do their jobs, we are going to have to pay them. And when I talk about “journalism” I’m not talking about reporting on sports scores. I’m talking about identifying a problem and asking tough questions to people who don’t want to answer them. Keeping the public informed. Democracy is a pesky thing. It works when people know what’s actually going on so they can make informed decisions. If we want to live in a democracy we need journalists. And it’s not just a matter of, maybe the paper will make it up next year. Once a newspaper closes up, it’s gone. That town no longer has a newspaper. Or maybe it gets bought by some newspaper conglomerate. I don’t know what the solution is. Ads are unsustainable and in many cases even malware. Paywalls kind of work. Maybe something like Apple News+ but platform independent.
HowAboutAJoist 3y ago
What a POS article. Look at this writing: "If the vision for the creation of the web included a day one feature that could restrict access to content, people working on their own specialist topics, catering to their own niche audiences, would’ve happily pressed the button." And the assertion itself is unsupported nonsense: "A hundred or a thousand thriving communities, small utopias in their own right, with no connection to each other, would’ve been seen as a feature, not the failure of the internet we otherwise see today." Why even bother.
karmakaze 3y ago
I'd really want to know if GitLab is overreacting here. I don't recall reading about GitLab behaving this way before. > In fact, the URL where the repo could be previously found returns only a 404 error; there’s no indication that a DMCA complaint was even received, let alone who sent it and what it said. > This user is blocked. > There’s no information close to hand on GitLab that attempts to explain why magnolia1234 is ‘blocked’ and no reason supplied on the developer’s account on X either. Responses from BPC users are limited to those who @Magnolia1234B specifically mentions, so discussion is somewhat limited. > More than One Type of DMCA Notice > The developer’s earlier comment, “another day another DMCA takedown notice” tends to suggest receipt of two, three or potentially more DMCA notices. On which platforms they were received isn’t specified but if those all relate to GitLab, it raises the question of whether a ‘repeat infringer’ policy came into play. That could explain the ‘blocked’ account status but since details aren’t being made available, it’s difficult to say for sure.

57 points by pabs3 3y ago

deleted 3y ago

[deleted]

Bizarre to call this “circumvention”. I have not looked at BPC but I have an idea what’s going on: Many “paywalls” operate by letting you download the full content of an article but covering it up with an overlay imposed via JavaScript code. You’d be surprised how many so-called paywalls stop working when you turn off JavaScript. Presumably at least part of how BPC works is simply blocking the JavaScript from covering up the content already transmitted to you. So this is what passes for circumvention these days: A publisher sends you the full content of an article in a web page, but you decline to run hostile code that would like to hide most of the content you have already downloaded. We are a long, long way from DeCSS. At least that involved decryption. This essentially criminalizes “view source.”

bee_rider 3y ago
I often browse without JavaScript, and often find myself bumping into paywalled sites don’t send the article in the first place. Of course, it is hard to distinguish between that, and a page that is just broken without JavaScript.
- shiroiushi 3y ago
  If a paywalled site doesn't send the article in the first place unless you have a valid, paid account that you've logged in with, then what exactly is the problem with BPC? BPC can't hack into accounts like that.
  - czarit 3y ago
    Guessing from the interface it exposes, BPC seems to work by making a ruleset matching sites with a battery of possible changes, including resetting cookies (to reset freebie-counters), fetching from Google cache, disabling javascript (for purely client-side paywalls) and by finding exceptions for the paywall (user-agent, referer, IP). The last one is probably the one that is closest to being a breach of some law. If the plugin did not ship with rules for a lot of sites, it would probably be considered harmless, but shipping a list of the magic user-agents etc. that circumvents paywalls seems risky, legality-wise.
    - bee_rider 3y ago
      Although, it seems really weird, user-agents are generally thought of as an authentication mechanism, right? I’m 0% sympathetic to sites that for which this works. The reason they accept these user agents is to mislead Google, right? I think it is fine for a site to not send content to me if I have ads or JavaScript disabled, or if I don’t have a subscription. But it is wrong to falsely advertise that the content is available. For some reason I assumed this had some automatic archive integration or something like that—actually circumventing real account mechanisms by copying out the content to some third party host. Because otherwise, taking them down seems pretty dumb. But then, I should not have assumed, the world is a pretty dumb place.

karma_pharmer 3y ago

although the definition of ‘free’ has been adjusted over time, mostly to mean no money changes hands. Just watch a few ads, allow the content providers to share your data with the world, and enjoy a lifetime of ‘free’ content. And it stays this way, because attention and personal data are magically exempt from AML/KYC. If I "pay with my attention" by watching ads, no AML/KYC is required. If I "pay with my data" by being tracked, no AML/KYC is required. But if I want to pay with real money, AML/KYC is required. And the cost of doing AML/KYC is prohibitive for micropayments. We have outlawed micropayments-with-money while allowing micropayments-with-data and micropayments-with-attention. The result of doing this should surprise absolutely nobody.

runiq 3y ago
What are/is AML/KYC?
- kelsey98765431 3y ago
  Anti Money Laundering and Know Your Customer legislation that certain businesses and entities under financial oversight must adhere to in order to prevent funding of state sanctioned entities.
- bradley13 3y ago
  AML - Anti-Money Laundering KYC - Know Your Customer
nonrandomstring 3y ago
We asked what is "self respect?" in a recent thread [0]. Here's a fresh definition; It's the difference in the exchange rate between dollars and the alternative currency of attention and personal data. I've been on the Internet since it existed (well, mid 80s) and never had a problem that some things must be paid for. But for whatever reason (the corrupt banking system?) micropayments never got traction. So, as you say, alternative economies have arisen. Some people have been happy to treat their data and time like the price of a cup of coffee. For me, I would not give my attention or personal data for hundreds of thousands of dollars. So each person has their own "price for which they will sell themselves", and in the digital world that is what "self-respect" means. It also means the determination to stick by that self valuation. This gives corporations an incentive to aggressively drive down self-respect - to get a better exchange rate. BigTech not only wants to colonise your devices, it wants to colonise your dignity, to undermine your confidence, independence and sense of self-worth. No wonder there is a mental health crisis arising from digital technology. Sadly for BigTech things are moving the other way. Minimum levels of dignity and self-respect are literally being legislated. But also (perhaps consequently) people are waking up and realising the real value of their attention and private affairs. A hope is that this forces BigTech to turn on the banking system and financial regulators, so we can finally get universal, frictionless anonymous micropayments and put this while tawdry "surveillance capitalism" episode behind us. [0] https://news.ycombinator.com/item?id=39999713 https://news.ycombinator.com/item?id=39999713

deleted 3y ago

[deleted]

iplaundering 3y ago

If only dmca notices were being sent to microsoft and open AI for their wide scale intellectual property laundering theft, but when its in big corp interest the laws bend to them. Rule of law is dead.

crummy 3y ago
The NYT is taking big AI to court right?
- dmcahhhhbbb 3y ago
  False equivalency, dmca notices get immediately enforced, meanwhile big AI continues to steal and launder millions of stolen works while the courts slowly grind out an outcome that will surely benefit everyone but the individuals whose life's work were stolen. The rule of law is dead.

gnabgib 3y ago

HN Discussion a couple of days ago:[0] (326 points, 2 days ago, 122 comments) [0]: https://news.ycombinator.com/item?id=40015961 https://news.ycombinator.com/item?id=40015961

floating-io 3y ago

Correct me if I'm wrong, but this plugin just removes stuff that the site puts over the content to restrict it. It doesn't fool the site into sending the content to the user's computer; it's already done that. Am I wrong in this? IMO, there needs to be shift in understanding. They sent their information to my computer. Whatever I do with what they sent is my business, not theirs. It's on my computer. And yet they want it to stop. IMO, if you want it to stop, don't be lazy; don't send it in the first place. Then a bypass might have CFAA behind it. These are the same people who want to use my bandwidth and CPU capacity to track me everywhere I go on the web. If they can make legal claims about what I do with the information they send to my computer, I should be able to make legal claims for them using my own computer against me without my consent. Of course, I'm also more than a little drunk at the moment, so what do I know?

anon373839 3y ago
Even though drunk, I think you have articulated valid points. Visiting a website is not making a binding promise that your user agent will execute all scripts that are served. In fact, if you consider a11y needs, the web could never work that way. I don’t think publishing information can come with a conditional license on how the information is processed (“the reader shall not skip ahead to the ending of this book”).
squigz 3y ago
> IMO, there needs to be shift in understanding. They sent their information to my computer. Whatever I do with what they sent is my business, not theirs. It's on my computer. And yet they want it to stop. This is the whole thing to me. Companies like YT have no right to force me to see stuff I don't want to, or bypass what I say goes on in my browser (i.e., an adblocker) If they don't like it, they can not serve my requests. Simple.
- appplication 3y ago
  This is such a wildly first-amendment-forward take I couldn’t even begin to understand how you could construct a principled argument against it.

voiceblue 3y ago

Having been a victim of DMCA abuse, sometimes it's just easier to shut shop if you're not feeling it to be worth your time and effort to counterclaim and partake of legal battles. This is especially the case if you never bothered to form a legal entity in the first place (which is an indicator that the product/project was not worth such extra effort). In this sense I think the prevalence of such DMCA notices has made the internet a bit of a hostile place, just this month we were reading about it here. [0] Is there any chance these laws will be fixed? [0] https://news.ycombinator.com/item?id=39934696 https://news.ycombinator.com/item?id=39934696

shiroiushi 3y ago
>Is there any chance these laws will be fixed? Probably about the same chance that Apophis will strike the Earth next time it comes around in the next decades, and wipe out humanity.

kelsey98765431 3y ago

I hate to say it, but under the CFAA this is absolutely a circumvention of an access control displayed on connection to the computer system. Bypassing that access control, no matter how weak it is, no matter that they already gave you the data, as long as that data comes with an access restriction that explicitly informs you that accessing the obfuscated data is a circumvention of their poorly designed access control - it's a CFAA felony violation. Reform is the answer. Repeal the CFAA and introduce better legislation aligned with the reality we live in today instead of the barely understood beauty of the baud that informed the creation of the Computer Fraud and Abuse Act of the 80s. This is a fully busted law that harms every single entity it interacts with besides the budget of the FBI and the courts. Oh and the for profit prison system.

indymike 3y ago
> I hate to say it, but under the CFAA this is absolutely a circumvention of an access control displayed on connection to the computer system. No. The information has been sent to my computer. I can view it in the browser inspector. There is no real access control here - only styling that hides content when rendered by the browser.
- calgoo 3y ago
  I agree, was there not a case recently where all the information was being posted on the government webpage, and depending on your info it only show a select view. It was found that if you viewed the source it showed all the info for all users. The judge upheld that it was not hacking as the governor had stated.
  - tomkarho 3y ago
    https://missouriindependent.com/2022/02/23/claim-that-reporter-hacked-state-website-was-debunked-parson-still-says-hes-a-criminal/ https://missouriindependent.com/2022/02/23/claim-that-report... You mean this? "Cole County Prosecutor Locke Thompson declined to press charges, saying that if any crime was committed it was both unintentional and based on a law so broad and vague it essentially criminalizes “using a computer to look up someone’s information."

ryanjshaw 3y ago

I'm curious. For anybody here: when was the last time a paywall news article improved your QOL, and in what way? I have been doing just fine without this stuff for years now, am I missing out?

dbetteridge 3y ago

These projects really need to start distributing a torrent seed with each release, otherwise you're at the full whims of (usually American) tech companies to nuke at any time

crtasm 3y ago
IPFS seems more like the way to go, but you still need a way to get updates to your users
- brokenmachine 3y ago
  BitTorrent v2 supports updates, "mutable torrents", I'm dreaming of the day we see it widely adopted.

janalsncm 3y ago

If we want journalists to be able to do their jobs, we are going to have to pay them. And when I talk about “journalism” I’m not talking about reporting on sports scores. I’m talking about identifying a problem and asking tough questions to people who don’t want to answer them. Keeping the public informed. Democracy is a pesky thing. It works when people know what’s actually going on so they can make informed decisions. If we want to live in a democracy we need journalists. And it’s not just a matter of, maybe the paper will make it up next year. Once a newspaper closes up, it’s gone. That town no longer has a newspaper. Or maybe it gets bought by some newspaper conglomerate. I don’t know what the solution is. Ads are unsustainable and in many cases even malware. Paywalls kind of work. Maybe something like Apple News+ but platform independent.

HowAboutAJoist 3y ago

What a POS article. Look at this writing: "If the vision for the creation of the web included a day one feature that could restrict access to content, people working on their own specialist topics, catering to their own niche audiences, would’ve happily pressed the button." And the assertion itself is unsupported nonsense: "A hundred or a thousand thriving communities, small utopias in their own right, with no connection to each other, would’ve been seen as a feature, not the failure of the internet we otherwise see today." Why even bother.

karmakaze 3y ago

I'd really want to know if GitLab is overreacting here. I don't recall reading about GitLab behaving this way before. > In fact, the URL where the repo could be previously found returns only a 404 error; there’s no indication that a DMCA complaint was even received, let alone who sent it and what it said. > This user is blocked. > There’s no information close to hand on GitLab that attempts to explain why magnolia1234 is ‘blocked’ and no reason supplied on the developer’s account on X either. Responses from BPC users are limited to those who @Magnolia1234B specifically mentions, so discussion is somewhat limited. > More than One Type of DMCA Notice > The developer’s earlier comment, “another day another DMCA takedown notice” tends to suggest receipt of two, three or potentially more DMCA notices. On which platforms they were received isn’t specified but if those all relate to GitLab, it raises the question of whether a ‘repeat infringer’ policy came into play. That could explain the ‘blocked’ account status but since details aren’t being made available, it’s difficult to say for sure.