9 ms·

My open source API client was taken down by a phony DMCA complaint

188 points by contrahax 13y ago

sarabellumac 13y ago
The grooveshark site prevents you from closing the page. That should tell you everything you need to know about them.
toomuchtodo 13y ago
Why does Github not have a workflow to file a counter-notice?
- viraptor 13y ago
  It has both workflows described - claim and counter-claim: https://help.github.com/articles/dmca-takedown#b-counter-notification-policy https://help.github.com/articles/dmca-takedown#b-counter-not...
  - contrahax 13y ago
    Counter-claim is for after you have removed the content. I am not going to remove the content just because a fuzzy DMCA was issued. Apparently there are no options besides taking it offline or going into a legal battle
    - thoughtpalette 13y ago
      Did you end up taking it down? I can't access it. "Repository unavailable due to DMCA takedown"
      - res0nat0r 13y ago
        Github automatically removes the repo upon a DMCA notice, not the end user.
        jevinskie 13y ago
        And the repo that was taken down is shown as a private repo to only it's owner. Source: a Sony DMCA takedown request did this with my github repo.
        jlgreco 13y ago
        Can you still push to your repo after this has happened? Might be a way to get a free private repo ;)
        jevinskie 13y ago
        What a wonderful idea! I just tried it and was able to push/pull without issue. Free private repos ahoy!* * Please don't do this. Github has always been so nice, especially regarding DMCAs.
        jlgreco 13y ago
        > Please don't do this. Absolutely. Pushing to DMCA'd repos might actually be necessary in some cases, and if this is abused github may be forced to disable this for everybody. Still, pretty neat; thanks for trying it out!
        contrahax 13y ago
        The messed up thing is that I can't even see the repo anymore. If I wanted to remove the offending content I wouldn't be able to
    - ihsw 13y ago
      > Apparently there are no options besides taking it offline or going into a legal battle That's how it (the DMCA) works.
      - pyre 13y ago
        No it doesn't.
    - rsofaer 13y ago
      By filing a counter claim you aren't really starting a legal battle, you're giving them 10 days to start a real legal battle by going to a court. Your content is already offline. File a counter claim and it will be back up in a week and a half.
      - pyre 13y ago
        | you're giving them 10 days to start a real | legal battle by going to a court To be clear, that's 10 days before the content goes back up to take you to court to prevent it from going back up. Nothing stops them from suing you over it after the content is restored.
        hfsktr 13y ago
        Just out of curiosity. Is there a time limit of how long they can sue for after it's restored? Could they wait for you to get a huge user base or revenue and then strike to get the most out of you or is there protection against that? I don't see myself ever creating anything that would get taken down but I imagine most people don't when it happens to them. Any time I hear about DMCA it seems so very one sided that there is just about no recourse.
        pyre 13y ago
        Well, they can sue you at any time. They don't really need to issue a DMCA notice first. The issue is that: 1) Most of the time they don't know your real identity from your (e.g.) YouTube username. IIRC, you have to use your real name or contact information when filing a counter-notice. 2) If they sue you, the content stays up until they can convince the judge to order it to be taken down. The point of the DMCA was to allow for things to be taken down quickly, and then sorted out in court later if need be. The content is taken down quickly. If you push back (counter-notice), then the (claimed) content owner has 10-14 days to start court proceedings to keep it down; otherwise, it goes back up. None of this precludes a suit being filed at any point. The real issue with this process is that there is little relief for negligence in filing DMCA notices. All you have to do is have a good-faith belief that you are the content owner, and this violates your rights. So acting like you're ignorant of the law is actually a defence against being held accountable for filing a bogus notice. If bogus DMCA notices were punished more often, and people were required to consult a lawyer before firing at the hip (e.g. people that don't understand copyright law, and just say, "I don't like X take it down! DMCA!"), then maybe it would be working better.
    - lsaferite 13y ago
      I think you are mis-reading the page. To file the counter notification, you have to provide the link to the content that was already removed by github. They are not telling you that you have to remove the content, then provide a link proving that you removed the content.
      - contrahax 13y ago
        Yeah it looks like I misread the page - thanks
    - xpaulbettsx 13y ago
      This text is a bit misleading - in step two, you aren't promising that you will remove the content, you're simply listing the things that GitHub removed that you'd like to see reinstated. The meaning of the counter-claim is not, "I agree, I removed the stuff, sorry", the meaning is, "I disagree, put the stuff back up. If you don't like it, take me to court."
    - tracker1 13y ago
      No, github already removed access to the public... you have to file the counter-claim for github to put it back. Github will notify the original party of the counter-claim, then if they want it down permanently, they have to take you to court.
citricsquid 13y ago
This is literally the funniest thing I have seen in weeks. Grooveshark is a company that is only able to operate because of DMCA safe harbors.
- milkshakes 13y ago
  And not for long at that :( http://torrentfreak.com/groovesharks-future-in-doubt-after-settlements-with-big-music-130517/ http://torrentfreak.com/groovesharks-future-in-doubt-after-s...
taf2 13y ago
http://webcache.googleusercontent.com/search?q=cache:s43ODsntyuMJ:https://github.com/wearefractal/groovr+&cd=8&hl=en&ct=clnk&gl=us http://webcache.googleusercontent.com/search?q=cache:s43ODsn...
- pygy_ 13y ago
  The package.json is still up in the cache too, but I couldn't reach the index.js. I tried Google, Yahoo, Bing, the Coral CDN, Gigablast and WebCite). package.json: http://webcache.googleusercontent.com/search?output=search&sclient=psy-ab&q=cache%3Ahttps%3A%2F%2Fgithub.com%2Fwearefractal%2Fgroovr%2Fblob%2Fmaster%2Fpackage.json&oq=cache%3Ahttps%3A%2F%2Fgithub.com%2Fwearefractal%2Fgroovr%2Fblob%2Fmaster%2Fpackage.json&gs_l=hp.3...21956.25165.1.25852.12.12.0.0.0.0.0.0..0.0...0.12...1c.1.14.psy-ab.kiqBBvI1ob0&pbx=1 http://webcache.googleusercontent.com/search?output=search&#...
zero1zero 13y ago
I'm going to use this api when it gets put back up. Anyone have a snapshot of the code before it was taken down? Streisand Effect.
- zevyoura 13y ago
  There are several similar projects linked in the comments if you just want to get started.
CptCodeMonkey 13y ago
What did your API provide ( downloads or just search?)
- contrahax 13y ago
  The API client just let you search, get popular songs, and get individual song info. There was no downloading included in the API client - if you wanted to download a song based on the info from their APIs you would have to write your own code to do that
  - CptCodeMonkey 13y ago
    I am not in anyway affiliated with GS/Escape and have 0 influence on their operations, but given what I know of them and that it only replicates what several other API libs provide, this DMCA seems really odd or a mistake? From someone elses comment, looked at the google cache of your github repo, > groovr.getSongFile songs[0].SongID, (err, file) -> might have been the part they have a problem with?
    - contrahax 13y ago
      That endpoint just returns meta info about the song including the duration, quality, etc.
      - fastest963 13y ago
        Despite the fact that the comment on the function says "file.url is an mp3 url you can download the file"?
        contrahax 13y ago
        .url is a part of the meta info from the api - there is no downloading functionality in the api library itself. The song url is just the culmination of the song id and your session
      - 13y ago
DevMonkey 13y ago
The interesting thing is that they say the library used proprietary code. From talking to Contra, they are just using a REST API which is not documented (Undocumented API !== Proprietary). If you publish a publicly accessible API then expect it to be used by everyone and everything.
- dangoldin 13y ago
  By that reasoning, can't one make the argument that what weev did was use an undocumented API though? The endpoints were publicly accessible but obfuscated (and quite poorly at that).
  - Dylan16807 13y ago
    That access route was unintentional, which is rather different from intentional but undocumented.
    - gingerlime 13y ago
      Absolutely. I wonder if by that token you could find a security exploit in an API that causes undesired behaviour (e.g. elevated privileges) and claim you're simply accessing an undocumented API? Or another way of looking at it - does accessing an undocumented API constitute hacking/unauthorized access? (which is probably an even more serious violation than copyright infringement in most countries) (disclaimer: I don't even know what this particular API is doing, or what's the alleged infringement, I'm just wondering about the principles in general)
      - jlgreco 13y ago
        Considering that most custom scrapers these days simplify their job by using whatever undocumented API the site's javascript might be using (makes the job very easy, but is of course a fragile solution), making the use of undocumented APIs be considered "unauthorized access", even in the absence of a restrictive robots.txt or EULA, would be very bad for a lot of people.
      - 13y ago
rawrly 13y ago
Most people who are first interacting with the DMCA law are unfamiliar with the fact it has protections against people files false notifications. Without knowing details about this (and not providing legal advice) this may be how it would work: If the claim is in fact BS, go lawyer up. File a counter notification, wait 10 days and your content will be put back online (unless they file an injunction to keep it offline), then you file suit against the alleged infringer for the statutory damages of $150,000 per false alleged infringement claim. Likely they'll settle out of court for some number less than their legal costs/time. Pay your lawyer, use the rest to fund your project. Go out for a pint, and tell the story to tell on how your project was funded by out witting a scammer.
- rsingel 13y ago
  That sounds really great, but the courts have been very lenient to those who file false DMCA notices and the burden of proof falls on you to prove that it was filed falsely intentionally. So, I'd say, don't lawyer up yet. File the counter-notice and if they come after you, then get a lawyer and publicity.
  - Dylan16807 13y ago
    Yep, there is no penalty whatsoever for gross negligence, it sucks.
    - jlgreco 13y ago
      So basically it is in the best interest of any company that is interested in filing these claims without regard for publicity to hire a complete imbecile to do it. No wonder we see so many idiotic claims.
      - krichman 13y ago
        Who do you think wrote this law?
  - anywhichway 13y ago
VMG 13y ago
Textbook irony.
kbar13 13y ago
Isn't it interesting that the internet is severely misinformed about a law that they love to hate?
- andreasvc 13y ago
  How so? I think it's quite clear that this notice is mistaken, or in any case not specific enough to have merit. Is it infringing on their source code? Which code, then? Is it circumvention of their DRM? That doesn't fall under DMCA takedowns. Is it a TOS violation for not using the public API? Again, doesn't fall under DMCA.
kevinpet 13y ago
If you read the notice carefully, you'll see they do not claim the target of the takedown was infringing their copyright, but only claim that it is an illegal circumvention method. Which is interesting because I've never seen a DMCA takedown that didn't claim infringment. Looking through wikipedia's description, it looks like anti-circumvention isn't even in the same section of the act as the the rules for taking down infringing content.
- fernandotakai 13y ago
  According to one grooveshark software engineer on twitter "@jameshartig: @fernando_takai Groovr was abusing our internal API to provide download links. We have a public API for developers that is free to use."[1] [1]http://twitter.com/jameshartig/status/337307876890648576 http://twitter.com/jameshartig/status/337307876890648576
  - voidlogic 13y ago
    >>According to one grooveshark software engineer on twitter "@jameshartig: @fernando_takai Groovr was abusing our internal API to provide download links. Its not an "internal API" if it is publicly accessible and doesn't require credentials other than the user's own. Did this API client have stolen creds embedded?
    - contrahax 13y ago
      No - it loaded grooveshark.com with the node module "request" and used cheerio to get the session id from the page source. Then API calls are made with the session id and client info. The APIs don't require a login or any authentication
      - fastest963 13y ago
        By "client info" you mean the secret key.
        13y ago
javis 13y ago
Just created a mirror of the repo from Google Cache. Link: https://github.com/joshryandavis/groovr https://github.com/joshryandavis/groovr
nilved 13y ago
This is why you don't use GitHub (or, more generally, American companies.) The prospect that someone can arbitrarily take down your repository until you go out of your way to provide a counternotice is beyond absurd.
- JoshTriplett 13y ago
  If you care about this, also keep your hosting provider and domain name provider in mind as well, since they can simply cut off access to your entire site in response to a DMCA complaint.
  - deleted 13y ago
    [deleted]
drostie 13y ago
(I am not a lawyer, this is not legal advice.) I understand that you want to extend professional courtesy to the lawyers and programmers involved, and by all measures, I think you should do so. However you must understand that the DMCA takedown procedure is not a human; it is a legal robot. By invoking DMCATakedownBot, they have not extended you proper courtesy, and probably the correct action is to file the counter-notification. Your counter-notification can point out that the original legal letter to GitHub was largely not a 'notification of claimed infringement' under 17 USC § 512 (c) (3) (A) [the "safe harbor"/"takedown" requirement of GitHub] -- because it claimed that the injury was a violation of 17 USC § 1201, which is not about copyright infringement. You should point out that there is a claimed infringement in this notice -- "He has taken proprietary source code from inside of our application" -- but that this claimed infringement is outright false, you have not copied any source code from inside of their application. So the 'safe harbor' DMCA takedown notice (§ 512) is probably not a proper venue for the legal discussion to occur. Rather, the proper venue is described in § 1203; they should bring a civil action against you in a US district court for the actual damages and any additional profits of the violator, or statutory damages per violation. You can then add to this notice something about how you'd much rather attempt to sort this out in a one-to-one discussion with the aggrieved programmers at the company, rather than in court. You can also tell them that section 1203 (c) (5) allows a court to remit the total award of damages if you can prove to the court's satisfaction that you were not aware and had no reason to believe that your acts constituted a violation. Since this is not legal advice so much as "advice on what you can say to lawyers to get them off your back", I will recommend that you read the relevant laws here: http://www.law.cornell.edu/uscode/text/17 http://www.law.cornell.edu/uscode/text/17 I also recommend that if they do sue you under section 1203, you contact a lawyer. You might also consider contacting a copyright lawyer right now, if it's not too much hassle.
fastest963 13y ago
Hey guys, I'm an Engineer at Grooveshark and I handle developer relations. Unfortunately, groovr appears to circumvent internal copyright protections for content hosted at Grooveshark. The groovr library offered a way to get, and subsequently allow you to easily download, song mp3s via a call (groovr.getSongFile). It was able to provide these services by using our internal authentication methods and internal API. Grooveshark offers a public API (http://developers.grooveshark.com/ http://developers.grooveshark.com/) which allows you to search for content, authenticate users, view popular music, and more, all for free. Developers are encouraged to register for a key and use our content for their applications.
- tobiasu 13y ago
  So do I actually read this right... Your companies piss-poor coding practices expose things to the world you don't want to have exposed, and instead of fixing your crappy code you file bogus DMCA requests?
- teraflop 13y ago
  OK, so what about the allegation that the developer in question "has taken proprietary source code from inside of our application and posted it as a GitHub project"? Was there any of GrooveShark's actual code that was distributed without permission? Because that's what your lawyer told GitHub in order to get it taken down.
  - RobAley 13y ago
    You'll find that fastest963 is posting that boilerplate reply across the web, and then failing to reply to the very question that you ask, which everyone else is asking too. Grooveshark PR clearly thought that by rolling out a "one of us" developer to make a "shucks, it sucks, but what choice did we have?" type statement, the wider dev community would be pacified and wouldn't keep asking the hard questions. One day they will learn.
- nknighthb 13y ago
  > I handle developer relations. Your tweet[1] says you don't know if anyone reached out to them. Another tweet[2] sure makes it sound like this is a technical issue of how they're doing something, rather than what they're doing. If you "handle developer relations", why weren't you involved before the notice was sent? Why didn't you reach out to the developers before your lawyers reached out to github? This does not sound like "handling developer relations". [1] https://twitter.com/jameshartig/status/337309949317238784 https://twitter.com/jameshartig/status/337309949317238784 [2] https://twitter.com/jameshartig/status/337336039502934017 https://twitter.com/jameshartig/status/337336039502934017
hawkharris 13y ago
I don't know much about law and I'm not qualified to speak on behalf of Grooveshark. Having said that, I interned as a developer for the company for over a year. During that time I got to know its true culture and learned a a bit how it operates. All of the folks I worked with saw it as their mission to support both independent music and independent software development. Everyone in the office brainstormed ways to help broaden their fan bases. (For example, giving artists Flattr accounts & letting them live-broadcast their music as they chatted with fans.) At the same time, many of the Grooveshark engineers I know contributed to open-source projects in their free time. The API has never allowed users to download songs, and it seems clear to me (by browsing the comments in the code on Github) that one element of the project in question performed that function. That seems to be the crux of this problem. Again, I'm not qualified to speak on behalf of Grooveshark, but I know from experience that its engineers are extremely supportive of these kind of open-source projects.
- laurent123456 13y ago
  From the repository copy: groovr.getSongFile songs[0].SongID, (err, file) -> ### file.url is an mp3 url you can download the file object also contains some meta info like song length ### That indeed confirms what the Grooveshark developer was saying on the DCMA notice comments. Even though the API doesn't provide the MP3 file directly, it's trivial to get it through this function call.
  - wnight 13y ago
    file.url (a property of the file object) is an MP3 url YOU can download. Could that be any clearer?
thezach 13y ago
It appears Groveshark has some poor coding practices. It appears that Groveshark innacuraltley filed a DMCA. However it appears that the orriginal poster is in violation of DMCA, for DRM Violations. The DMCA provides groveshark protection against your "API" which is actually a way to circumvent grovesharks DRM. While Groveshark didn't state this in the orriginal DMCA, they can file another and have you taken down for correct issues. Your "API" does violate copyright law.
namuol 13y ago
Grooveshark filing a DMCA notice? The irony is palpable.
namuol 13y ago
Good thing I never released the source code to my project. (http://spiffyshark.com http://spiffyshark.com)

188 points by contrahax 13y ago

sarabellumac 13y ago

The grooveshark site prevents you from closing the page. That should tell you everything you need to know about them.

toomuchtodo 13y ago

Why does Github not have a workflow to file a counter-notice?

viraptor 13y ago
It has both workflows described - claim and counter-claim: https://help.github.com/articles/dmca-takedown#b-counter-notification-policy https://help.github.com/articles/dmca-takedown#b-counter-not...
- contrahax 13y ago
  Counter-claim is for after you have removed the content. I am not going to remove the content just because a fuzzy DMCA was issued. Apparently there are no options besides taking it offline or going into a legal battle
  - thoughtpalette 13y ago
    Did you end up taking it down? I can't access it. "Repository unavailable due to DMCA takedown"
    - res0nat0r 13y ago
      Github automatically removes the repo upon a DMCA notice, not the end user.
      - jevinskie 13y ago
        And the repo that was taken down is shown as a private repo to only it's owner. Source: a Sony DMCA takedown request did this with my github repo.
        jlgreco 13y ago
        Can you still push to your repo after this has happened? Might be a way to get a free private repo ;)
        jevinskie 13y ago
        What a wonderful idea! I just tried it and was able to push/pull without issue. Free private repos ahoy!* * Please don't do this. Github has always been so nice, especially regarding DMCAs.
        jlgreco 13y ago
        > Please don't do this. Absolutely. Pushing to DMCA'd repos might actually be necessary in some cases, and if this is abused github may be forced to disable this for everybody. Still, pretty neat; thanks for trying it out!
      - contrahax 13y ago
        The messed up thing is that I can't even see the repo anymore. If I wanted to remove the offending content I wouldn't be able to
  - ihsw 13y ago
    > Apparently there are no options besides taking it offline or going into a legal battle That's how it (the DMCA) works.
    - pyre 13y ago
      No it doesn't.
  - rsofaer 13y ago
    By filing a counter claim you aren't really starting a legal battle, you're giving them 10 days to start a real legal battle by going to a court. Your content is already offline. File a counter claim and it will be back up in a week and a half.
    - pyre 13y ago
      | you're giving them 10 days to start a real | legal battle by going to a court To be clear, that's 10 days before the content goes back up to take you to court to prevent it from going back up. Nothing stops them from suing you over it after the content is restored.
      - hfsktr 13y ago
        Just out of curiosity. Is there a time limit of how long they can sue for after it's restored? Could they wait for you to get a huge user base or revenue and then strike to get the most out of you or is there protection against that? I don't see myself ever creating anything that would get taken down but I imagine most people don't when it happens to them. Any time I hear about DMCA it seems so very one sided that there is just about no recourse.
        pyre 13y ago
        Well, they can sue you at any time. They don't really need to issue a DMCA notice first. The issue is that: 1) Most of the time they don't know your real identity from your (e.g.) YouTube username. IIRC, you have to use your real name or contact information when filing a counter-notice. 2) If they sue you, the content stays up until they can convince the judge to order it to be taken down. The point of the DMCA was to allow for things to be taken down quickly, and then sorted out in court later if need be. The content is taken down quickly. If you push back (counter-notice), then the (claimed) content owner has 10-14 days to start court proceedings to keep it down; otherwise, it goes back up. None of this precludes a suit being filed at any point. The real issue with this process is that there is little relief for negligence in filing DMCA notices. All you have to do is have a good-faith belief that you are the content owner, and this violates your rights. So acting like you're ignorant of the law is actually a defence against being held accountable for filing a bogus notice. If bogus DMCA notices were punished more often, and people were required to consult a lawyer before firing at the hip (e.g. people that don't understand copyright law, and just say, "I don't like X take it down! DMCA!"), then maybe it would be working better.
  - lsaferite 13y ago
    I think you are mis-reading the page. To file the counter notification, you have to provide the link to the content that was already removed by github. They are not telling you that you have to remove the content, then provide a link proving that you removed the content.
    - contrahax 13y ago
      Yeah it looks like I misread the page - thanks
  - xpaulbettsx 13y ago
    This text is a bit misleading - in step two, you aren't promising that you will remove the content, you're simply listing the things that GitHub removed that you'd like to see reinstated. The meaning of the counter-claim is not, "I agree, I removed the stuff, sorry", the meaning is, "I disagree, put the stuff back up. If you don't like it, take me to court."
  - tracker1 13y ago
    No, github already removed access to the public... you have to file the counter-claim for github to put it back. Github will notify the original party of the counter-claim, then if they want it down permanently, they have to take you to court.

citricsquid 13y ago

This is literally the funniest thing I have seen in weeks. Grooveshark is a company that is only able to operate because of DMCA safe harbors.

milkshakes 13y ago
And not for long at that :( http://torrentfreak.com/groovesharks-future-in-doubt-after-settlements-with-big-music-130517/ http://torrentfreak.com/groovesharks-future-in-doubt-after-s...

taf2 13y ago

http://webcache.googleusercontent.com/search?q=cache:s43ODsntyuMJ:https://github.com/wearefractal/groovr+&cd=8&hl=en&ct=clnk&gl=us http://webcache.googleusercontent.com/search?q=cache:s43ODsn...

pygy_ 13y ago
The package.json is still up in the cache too, but I couldn't reach the index.js. I tried Google, Yahoo, Bing, the Coral CDN, Gigablast and WebCite). package.json: http://webcache.googleusercontent.com/search?output=search&sclient=psy-ab&q=cache%3Ahttps%3A%2F%2Fgithub.com%2Fwearefractal%2Fgroovr%2Fblob%2Fmaster%2Fpackage.json&oq=cache%3Ahttps%3A%2F%2Fgithub.com%2Fwearefractal%2Fgroovr%2Fblob%2Fmaster%2Fpackage.json&gs_l=hp.3...21956.25165.1.25852.12.12.0.0.0.0.0.0..0.0...0.12...1c.1.14.psy-ab.kiqBBvI1ob0&pbx=1 http://webcache.googleusercontent.com/search?output=search&#...

zero1zero 13y ago

I'm going to use this api when it gets put back up. Anyone have a snapshot of the code before it was taken down? Streisand Effect.

zevyoura 13y ago
There are several similar projects linked in the comments if you just want to get started.

CptCodeMonkey 13y ago

What did your API provide ( downloads or just search?)

contrahax 13y ago
The API client just let you search, get popular songs, and get individual song info. There was no downloading included in the API client - if you wanted to download a song based on the info from their APIs you would have to write your own code to do that
- CptCodeMonkey 13y ago
  I am not in anyway affiliated with GS/Escape and have 0 influence on their operations, but given what I know of them and that it only replicates what several other API libs provide, this DMCA seems really odd or a mistake? From someone elses comment, looked at the google cache of your github repo, > groovr.getSongFile songs[0].SongID, (err, file) -> might have been the part they have a problem with?
  - contrahax 13y ago
    That endpoint just returns meta info about the song including the duration, quality, etc.
    - fastest963 13y ago
      Despite the fact that the comment on the function says "file.url is an mp3 url you can download the file"?
      - contrahax 13y ago
        .url is a part of the meta info from the api - there is no downloading functionality in the api library itself. The song url is just the culmination of the song id and your session
    - 13y ago

DevMonkey 13y ago

The interesting thing is that they say the library used proprietary code. From talking to Contra, they are just using a REST API which is not documented (Undocumented API !== Proprietary). If you publish a publicly accessible API then expect it to be used by everyone and everything.

dangoldin 13y ago
By that reasoning, can't one make the argument that what weev did was use an undocumented API though? The endpoints were publicly accessible but obfuscated (and quite poorly at that).
- Dylan16807 13y ago
  That access route was unintentional, which is rather different from intentional but undocumented.
  - gingerlime 13y ago
    Absolutely. I wonder if by that token you could find a security exploit in an API that causes undesired behaviour (e.g. elevated privileges) and claim you're simply accessing an undocumented API? Or another way of looking at it - does accessing an undocumented API constitute hacking/unauthorized access? (which is probably an even more serious violation than copyright infringement in most countries) (disclaimer: I don't even know what this particular API is doing, or what's the alleged infringement, I'm just wondering about the principles in general)
    - jlgreco 13y ago
      Considering that most custom scrapers these days simplify their job by using whatever undocumented API the site's javascript might be using (makes the job very easy, but is of course a fragile solution), making the use of undocumented APIs be considered "unauthorized access", even in the absence of a restrictive robots.txt or EULA, would be very bad for a lot of people.
    - 13y ago

rawrly 13y ago

Most people who are first interacting with the DMCA law are unfamiliar with the fact it has protections against people files false notifications. Without knowing details about this (and not providing legal advice) this may be how it would work: If the claim is in fact BS, go lawyer up. File a counter notification, wait 10 days and your content will be put back online (unless they file an injunction to keep it offline), then you file suit against the alleged infringer for the statutory damages of $150,000 per false alleged infringement claim. Likely they'll settle out of court for some number less than their legal costs/time. Pay your lawyer, use the rest to fund your project. Go out for a pint, and tell the story to tell on how your project was funded by out witting a scammer.

rsingel 13y ago
That sounds really great, but the courts have been very lenient to those who file false DMCA notices and the burden of proof falls on you to prove that it was filed falsely intentionally. So, I'd say, don't lawyer up yet. File the counter-notice and if they come after you, then get a lawyer and publicity.
- Dylan16807 13y ago
  Yep, there is no penalty whatsoever for gross negligence, it sucks.
  - jlgreco 13y ago
    So basically it is in the best interest of any company that is interested in filing these claims without regard for publicity to hire a complete imbecile to do it. No wonder we see so many idiotic claims.
    - krichman 13y ago
      Who do you think wrote this law?
- anywhichway 13y ago

VMG 13y ago

Textbook irony.

kbar13 13y ago

Isn't it interesting that the internet is severely misinformed about a law that they love to hate?

andreasvc 13y ago
How so? I think it's quite clear that this notice is mistaken, or in any case not specific enough to have merit. Is it infringing on their source code? Which code, then? Is it circumvention of their DRM? That doesn't fall under DMCA takedowns. Is it a TOS violation for not using the public API? Again, doesn't fall under DMCA.

kevinpet 13y ago

If you read the notice carefully, you'll see they do not claim the target of the takedown was infringing their copyright, but only claim that it is an illegal circumvention method. Which is interesting because I've never seen a DMCA takedown that didn't claim infringment. Looking through wikipedia's description, it looks like anti-circumvention isn't even in the same section of the act as the the rules for taking down infringing content.

fernandotakai 13y ago
According to one grooveshark software engineer on twitter "@jameshartig: @fernando_takai Groovr was abusing our internal API to provide download links. We have a public API for developers that is free to use."[1] [1]http://twitter.com/jameshartig/status/337307876890648576 http://twitter.com/jameshartig/status/337307876890648576
- voidlogic 13y ago
  >>According to one grooveshark software engineer on twitter "@jameshartig: @fernando_takai Groovr was abusing our internal API to provide download links. Its not an "internal API" if it is publicly accessible and doesn't require credentials other than the user's own. Did this API client have stolen creds embedded?
  - contrahax 13y ago
    No - it loaded grooveshark.com with the node module "request" and used cheerio to get the session id from the page source. Then API calls are made with the session id and client info. The APIs don't require a login or any authentication
    - fastest963 13y ago
      By "client info" you mean the secret key.
      - 13y ago

javis 13y ago

Just created a mirror of the repo from Google Cache. Link: https://github.com/joshryandavis/groovr https://github.com/joshryandavis/groovr

nilved 13y ago

This is why you don't use GitHub (or, more generally, American companies.) The prospect that someone can arbitrarily take down your repository until you go out of your way to provide a counternotice is beyond absurd.

JoshTriplett 13y ago
If you care about this, also keep your hosting provider and domain name provider in mind as well, since they can simply cut off access to your entire site in response to a DMCA complaint.
- deleted 13y ago
  [deleted]

drostie 13y ago

(I am not a lawyer, this is not legal advice.) I understand that you want to extend professional courtesy to the lawyers and programmers involved, and by all measures, I think you should do so. However you must understand that the DMCA takedown procedure is not a human; it is a legal robot. By invoking DMCATakedownBot, they have not extended you proper courtesy, and probably the correct action is to file the counter-notification. Your counter-notification can point out that the original legal letter to GitHub was largely not a 'notification of claimed infringement' under 17 USC § 512 (c) (3) (A) [the "safe harbor"/"takedown" requirement of GitHub] -- because it claimed that the injury was a violation of 17 USC § 1201, which is not about copyright infringement. You should point out that there is a claimed infringement in this notice -- "He has taken proprietary source code from inside of our application" -- but that this claimed infringement is outright false, you have not copied any source code from inside of their application. So the 'safe harbor' DMCA takedown notice (§ 512) is probably not a proper venue for the legal discussion to occur. Rather, the proper venue is described in § 1203; they should bring a civil action against you in a US district court for the actual damages and any additional profits of the violator, or statutory damages per violation. You can then add to this notice something about how you'd much rather attempt to sort this out in a one-to-one discussion with the aggrieved programmers at the company, rather than in court. You can also tell them that section 1203 (c) (5) allows a court to remit the total award of damages if you can prove to the court's satisfaction that you were not aware and had no reason to believe that your acts constituted a violation. Since this is not legal advice so much as "advice on what you can say to lawyers to get them off your back", I will recommend that you read the relevant laws here: http://www.law.cornell.edu/uscode/text/17 http://www.law.cornell.edu/uscode/text/17 I also recommend that if they do sue you under section 1203, you contact a lawyer. You might also consider contacting a copyright lawyer right now, if it's not too much hassle.

fastest963 13y ago

Hey guys, I'm an Engineer at Grooveshark and I handle developer relations. Unfortunately, groovr appears to circumvent internal copyright protections for content hosted at Grooveshark. The groovr library offered a way to get, and subsequently allow you to easily download, song mp3s via a call (groovr.getSongFile). It was able to provide these services by using our internal authentication methods and internal API. Grooveshark offers a public API (http://developers.grooveshark.com/ http://developers.grooveshark.com/) which allows you to search for content, authenticate users, view popular music, and more, all for free. Developers are encouraged to register for a key and use our content for their applications.

tobiasu 13y ago
So do I actually read this right... Your companies piss-poor coding practices expose things to the world you don't want to have exposed, and instead of fixing your crappy code you file bogus DMCA requests?
teraflop 13y ago
OK, so what about the allegation that the developer in question "has taken proprietary source code from inside of our application and posted it as a GitHub project"? Was there any of GrooveShark's actual code that was distributed without permission? Because that's what your lawyer told GitHub in order to get it taken down.
- RobAley 13y ago
  You'll find that fastest963 is posting that boilerplate reply across the web, and then failing to reply to the very question that you ask, which everyone else is asking too. Grooveshark PR clearly thought that by rolling out a "one of us" developer to make a "shucks, it sucks, but what choice did we have?" type statement, the wider dev community would be pacified and wouldn't keep asking the hard questions. One day they will learn.
nknighthb 13y ago
> I handle developer relations. Your tweet[1] says you don't know if anyone reached out to them. Another tweet[2] sure makes it sound like this is a technical issue of how they're doing something, rather than what they're doing. If you "handle developer relations", why weren't you involved before the notice was sent? Why didn't you reach out to the developers before your lawyers reached out to github? This does not sound like "handling developer relations". [1] https://twitter.com/jameshartig/status/337309949317238784 https://twitter.com/jameshartig/status/337309949317238784 [2] https://twitter.com/jameshartig/status/337336039502934017 https://twitter.com/jameshartig/status/337336039502934017

hawkharris 13y ago

I don't know much about law and I'm not qualified to speak on behalf of Grooveshark. Having said that, I interned as a developer for the company for over a year. During that time I got to know its true culture and learned a a bit how it operates. All of the folks I worked with saw it as their mission to support both independent music and independent software development. Everyone in the office brainstormed ways to help broaden their fan bases. (For example, giving artists Flattr accounts & letting them live-broadcast their music as they chatted with fans.) At the same time, many of the Grooveshark engineers I know contributed to open-source projects in their free time. The API has never allowed users to download songs, and it seems clear to me (by browsing the comments in the code on Github) that one element of the project in question performed that function. That seems to be the crux of this problem. Again, I'm not qualified to speak on behalf of Grooveshark, but I know from experience that its engineers are extremely supportive of these kind of open-source projects.

laurent123456 13y ago
From the repository copy: groovr.getSongFile songs[0].SongID, (err, file) -> ### file.url is an mp3 url you can download the file object also contains some meta info like song length ### That indeed confirms what the Grooveshark developer was saying on the DCMA notice comments. Even though the API doesn't provide the MP3 file directly, it's trivial to get it through this function call.
- wnight 13y ago
  file.url (a property of the file object) is an MP3 url YOU can download. Could that be any clearer?

thezach 13y ago

It appears Groveshark has some poor coding practices. It appears that Groveshark innacuraltley filed a DMCA. However it appears that the orriginal poster is in violation of DMCA, for DRM Violations. The DMCA provides groveshark protection against your "API" which is actually a way to circumvent grovesharks DRM. While Groveshark didn't state this in the orriginal DMCA, they can file another and have you taken down for correct issues. Your "API" does violate copyright law.

namuol 13y ago

Grooveshark filing a DMCA notice? The irony is palpable.

namuol 13y ago

Good thing I never released the source code to my project. (http://spiffyshark.com http://spiffyshark.com)