4 ms·

DMCA takedown notices and counter-notices received at GitHub

105 points by LorenDB 2y ago

KennyBlanken 2y ago
No cookie for you, MS/GitHub. You're redacting so much information this is a nearly worthless, token effort. Lumen will provide at least some info, enough to identify DMCA abuse. For example, I clicked on one of the most recent DMCA requests in Lumen, filled out the captcha, and then clicked on the submitter's name and...oh hey, they've submitted 100,000 DMCA notices (!)...it's a DMCA mill, specializing in online porn. With how Github is doing this, there's no way to tell who or what was actually involved, thus impossible to verify if the DMCA claim is BS or not: https://github.com/github/dmca/blob/master/2024/06/2024-06-17-plugin-api.md https://github.com/github/dmca/blob/master/2024/06/2024-06-1... If you're making a claim of copyright infringement, your name / who you represent and the nature of the violation is not "private." And further, that redacting is purely Github's decision; nothing in the DMCA requires any redaction or limits publishing of DMCA notices in any way. ...and hilariously, GitHub rejected the counter-notice because...it didn't have the right kind of contact info?
- ChrisMarshallNY 2y ago
  > ...and hilariously, GitHub rejected the counter-notice because...it didn't have the right kind of contact info? I noticed that, too. I'll take "Irony," for $100, Alex...
- benatkin 2y ago
  The notice repo started before they got acquired, and was better back then. It went from "open source almost everything" (which was a half-truth, anyway) to typical BigCo stuff.
- elpocko 2y ago
  >If you're making a claim of copyright infringement, your name [...] is not "private." I can release stuff under a pseudonym. I don't see why my real name should be published just because someone else is infringing on my rights.
  - deleted 2y ago
    [deleted]
  - kstrauser 2y ago
    When you’re filing a legal claim against someone, they get to know who’s accusing them. That’s only fair.
    - elpocko 2y ago
      Maybe the person who infringed on my rights can know. In some cases, as long as my right to privacy is guaranteed to be respected. That doesn't mean that the entire world is entitled to know my real name via Github's issue tracker. The perpetrator remains anonymous while the victim will be doxxed, what a great sense of fairness you have.
      - kstrauser 2y ago
        I'm in the US. Your idea violates our justice system's notion of transparency, and it's one I agree with wholeheartedly. Things are different sometimes in cases where the charges involve sexual violence and/or minors, where courts have upheld that the potential damage of publicly naming the victims was worse than the potential damage of not allowing the defendant to publicly counter the accusations. See for example: https://www.gdnlaw.com/blog/internet-law/anonymous-lawsuit-test/ https://www.gdnlaw.com/blog/internet-law/anonymous-lawsuit-t... So in the US, at least, if you're going to sue someone over IP violations, you should plan on your identity being made part of the public record. As a country we're pretty adamant about that. It's a feature, not a bug. I'm including DMCA notices in things I believe should be -- must be -- transparent. They're legal filings after all, strongly implying that if you don't comply, you're about to be sued. Your proposal would allow, say, Oracle to hide their identity if they were filing a complaint against the Linux kernel so that they could get the benefit of launching a legal salvo without the reputation hit for having done so. I believe that's far more unfair, and more likely, than your scenario.
        elpocko 2y ago
- giancarlostoro 2y ago
  They've had this before Microsoft had bought them out. I think its fine the way its been. I will note, I do know of one instance where a repository was taken down via false DMCA someone else sent in, though I forgot which one, I knew people who knew the person who sent it in. It was regarding a "Private Game Server" so GitHub probably thought, its probably easier to comply and move on.
- forgotpwd16 2y ago
  >specializing in online porn Considering the abundance of porn piracy, a company specializing in DMCAing porn sites wouldn't be surprising to have notices ranking in hundreds of thousands.
- LocalH 2y ago
  Microsoft is hyper afraid of "PII". When they ported a bunch of blogs (including Raymond Chen's) to a new platform, they did not bring the comments along because GDPR would have required them to associate accounts on the old platform with those on the new, to comply with the deletion requirement.
ayhanfuat 2y ago
This reminded me of HackerRank’s SymPy incident (HackerRank (YC S11) DMCA'ed the SymPy Docs [fixed] | https://news.ycombinator.com/item?id=31087175 https://news.ycombinator.com/item?id=31087175). They had taken down SymPy documentation claiming SymPy plagiarized their code snippets but in reality it was them using SymPy docs in their questions. The request for takedown is at https://github.com/github/dmca/blob/6f752b45efb10be0cb5763211e30b06d729147e6/2022/04/2022-04-15-hackerrank.md https://github.com/github/dmca/blob/6f752b45efb10be0cb576321....
thenerdhead 2y ago
This is actually a good thing because dmca in other areas like package registries are usually behind email and you never have an idea of repeat infringers. This community oriented approach really provides enough transparency so the community can hold companies and infringers to a higher standard. I work on one of the biggest registries and this is a huge problem for us and we are thinking of adopting this approach. Any reasons we shouldn’t? I think people need to separate the dmca process and the ledger of dmca requests to separate criticism points.
axpy906 2y ago
Fascinating. Would be interesting to clone and look at some of the patterns here.

105 points by LorenDB 2y ago

No cookie for you, MS/GitHub. You're redacting so much information this is a nearly worthless, token effort. Lumen will provide at least some info, enough to identify DMCA abuse. For example, I clicked on one of the most recent DMCA requests in Lumen, filled out the captcha, and then clicked on the submitter's name and...oh hey, they've submitted 100,000 DMCA notices (!)...it's a DMCA mill, specializing in online porn. With how Github is doing this, there's no way to tell who or what was actually involved, thus impossible to verify if the DMCA claim is BS or not: https://github.com/github/dmca/blob/master/2024/06/2024-06-17-plugin-api.md https://github.com/github/dmca/blob/master/2024/06/2024-06-1... If you're making a claim of copyright infringement, your name / who you represent and the nature of the violation is not "private." And further, that redacting is purely Github's decision; nothing in the DMCA requires any redaction or limits publishing of DMCA notices in any way. ...and hilariously, GitHub rejected the counter-notice because...it didn't have the right kind of contact info?

ChrisMarshallNY 2y ago
> ...and hilariously, GitHub rejected the counter-notice because...it didn't have the right kind of contact info? I noticed that, too. I'll take "Irony," for $100, Alex...
benatkin 2y ago
The notice repo started before they got acquired, and was better back then. It went from "open source almost everything" (which was a half-truth, anyway) to typical BigCo stuff.
elpocko 2y ago
>If you're making a claim of copyright infringement, your name [...] is not "private." I can release stuff under a pseudonym. I don't see why my real name should be published just because someone else is infringing on my rights.
- deleted 2y ago
  [deleted]
- kstrauser 2y ago
  When you’re filing a legal claim against someone, they get to know who’s accusing them. That’s only fair.
  - elpocko 2y ago
    Maybe the person who infringed on my rights can know. In some cases, as long as my right to privacy is guaranteed to be respected. That doesn't mean that the entire world is entitled to know my real name via Github's issue tracker. The perpetrator remains anonymous while the victim will be doxxed, what a great sense of fairness you have.
    - kstrauser 2y ago
      I'm in the US. Your idea violates our justice system's notion of transparency, and it's one I agree with wholeheartedly. Things are different sometimes in cases where the charges involve sexual violence and/or minors, where courts have upheld that the potential damage of publicly naming the victims was worse than the potential damage of not allowing the defendant to publicly counter the accusations. See for example: https://www.gdnlaw.com/blog/internet-law/anonymous-lawsuit-test/ https://www.gdnlaw.com/blog/internet-law/anonymous-lawsuit-t... So in the US, at least, if you're going to sue someone over IP violations, you should plan on your identity being made part of the public record. As a country we're pretty adamant about that. It's a feature, not a bug. I'm including DMCA notices in things I believe should be -- must be -- transparent. They're legal filings after all, strongly implying that if you don't comply, you're about to be sued. Your proposal would allow, say, Oracle to hide their identity if they were filing a complaint against the Linux kernel so that they could get the benefit of launching a legal salvo without the reputation hit for having done so. I believe that's far more unfair, and more likely, than your scenario.
      - elpocko 2y ago
giancarlostoro 2y ago
They've had this before Microsoft had bought them out. I think its fine the way its been. I will note, I do know of one instance where a repository was taken down via false DMCA someone else sent in, though I forgot which one, I knew people who knew the person who sent it in. It was regarding a "Private Game Server" so GitHub probably thought, its probably easier to comply and move on.
forgotpwd16 2y ago
>specializing in online porn Considering the abundance of porn piracy, a company specializing in DMCAing porn sites wouldn't be surprising to have notices ranking in hundreds of thousands.
LocalH 2y ago
Microsoft is hyper afraid of "PII". When they ported a bunch of blogs (including Raymond Chen's) to a new platform, they did not bring the comments along because GDPR would have required them to associate accounts on the old platform with those on the new, to comply with the deletion requirement.

ayhanfuat 2y ago

This reminded me of HackerRank’s SymPy incident (HackerRank (YC S11) DMCA'ed the SymPy Docs [fixed] | https://news.ycombinator.com/item?id=31087175 https://news.ycombinator.com/item?id=31087175). They had taken down SymPy documentation claiming SymPy plagiarized their code snippets but in reality it was them using SymPy docs in their questions. The request for takedown is at https://github.com/github/dmca/blob/6f752b45efb10be0cb5763211e30b06d729147e6/2022/04/2022-04-15-hackerrank.md https://github.com/github/dmca/blob/6f752b45efb10be0cb576321....

thenerdhead 2y ago

This is actually a good thing because dmca in other areas like package registries are usually behind email and you never have an idea of repeat infringers. This community oriented approach really provides enough transparency so the community can hold companies and infringers to a higher standard. I work on one of the biggest registries and this is a huge problem for us and we are thinking of adopting this approach. Any reasons we shouldn’t? I think people need to separate the dmca process and the ledger of dmca requests to separate criticism points.

axpy906 2y ago

Fascinating. Would be interesting to clone and look at some of the patterns here.