5 ms·

Can people realize by now how ludicrous it is that a bot or idiot is able to take down 116 repositories without any oversight or validation, and your only recou

by nilved 12y ago

Can people realize by now how ludicrous it is that a bot or idiot is able to take down 116 repositories without any oversight or validation, and your only recourse is to (a) deal with it (b) take time from your day to jump through flaming hoops for bureaucrats? GitHub's brand of DMCA compliance is much like YouTube's: lazy to the point of unequivocally benefiting copyright owners, not content producers. Hosting your code on GitHub is senseless because anybody can take your code down at a moment's notice.

Hermel 12y ago
Also questionable is how the computer that sends out the e-mail can have a "good faith belief"? Especially given that their detection rates are often abismal.
- rasz_pl 12y ago
  You are free to counter claim and go to court spending $xxxK on lawyers to test it.
Already__Taken 12y ago
Someone should make a bot that DMCAs accounts belonging to employees and their connections in the parent company. For each unverified DMCA they enact. They're the employees who will have to get in and make changes to the system and they work for the companies that have to make noise and say no to the DMCA issuers. If they blanket exclude their own employees of the policies everyone else has to abide, well, that'll say something won't it. There seems to be no negative effect of making false DMCAs so play that game.
- sneak 12y ago
  > There seems to be no negative effect of making false DMCAs so play that game. Unprosecuted crimes (e.g. the perjury one must commit to file a false DMCA notice) have a strange way of suddenly becoming prosecuted crimes when people act in blatant disregard for the law.
  - cowbell 12y ago
    I believe there's only a perjury penalty if you misrepresent the fact that you are authorized to act on behalf of the copyright holder. So if you say, "I'm requesting you take this down because it infringes on Star Wars and I'm an authorized agent of Disney" when you have no relation with Disney, you're up for perjury. However, if you say, "I'm requesting you take this down because it infringes on blahblah.avi and I hold copyright to blahblah.avi" which is true, then no perjury penalty. Even if blahblah.avi has nothing to do with the github repo being taken down. "Oops, my bad, honest mistake, wink wink." The person on the receiving end of the DMCA still has to jump through all the hoops to get their own copyright material reinstated. So if you do your bot right, there's no penalty. None at all. If there is, I'd love to know about it, because these bots need to die in a fire.
    - paulgb 12y ago
      You can claim damages against a false takedown, it's just really hard. The only notable case I know of is OPG v. Diebold http://en.wikipedia.org/wiki/OPG_v._Diebold http://en.wikipedia.org/wiki/OPG_v._Diebold
      - cowbell 12y ago
        I wasn't aware of that case. Thanks. I found sec 512(f) here: http://www.law.cornell.edu/uscode/text/17/512#f http://www.law.cornell.edu/uscode/text/17/512#f
wpietri 12y ago
Honestly, I'm ok with this. The specific case is dumb, but I can't imagine a change to the laws that could make things better. You can't outlaw dumb. Recently I found that one of my popular posts on startups had been boosted without permission or credit by some wannabe-accelerator in Texas. I filed a DMCA request and their host took the page down promptly. It just worked. I'd hope Github is doing some basic checks on requests like this. But I don't want them to try to become a mini-court. We already have a perfectly good court system for resolving ownership disputes.
- pelario 12y ago
  > We already have a perfectly good court system for resolving ownership disputes. Patent trolls are ok too ?
  - wpietri 12y ago
    I gather you must not be a native speaker of English. "Perfectly good" does not mean perfect. It means something like "serviceable" or "adequate for the purpose at hand": http://www.theonion.com/video/nations-parents-release-annual-ranking-of-top-50-p,35204/ http://www.theonion.com/video/nations-parents-release-annual... http://www.urbandictionary.com/define.php?term=perfectly%20good%20airplane http://www.urbandictionary.com/define.php?term=perfectly%20g...
    - ianphughes 12y ago
      Ha. Great reference.
- sneak 12y ago
  > I'd hope Github is doing some basic checks on requests like this. You're not allowed to do that without losing the safe harbor provisions of the DMCA. Anything that shows up that matches the format must be obeyed. That's why counter-notifications exist.
  - wpietri 12y ago
Pxtl 12y ago
Now I'm wondering if it's possible to DDOS a DCMA takedown system with a randomized spam of takedown requests. You know, like a mad-lib "Your site has our content askjdh12312312.avi on the link yourtube.io/5h0rtur1/ and must be removed to comply with yadda yadda yadda". It's probably five kinds of illegal and three kinds of immoral, though.
- AimHere 12y ago
  A normal DMCA takedown request is taken under penalty of perjury (sadly, a lot of the big common carriers, like Youtube, have gentleman's agreements with Big Media, so they don't rely on formal DMCA takedowns), and knowingly and falsely claiming to be the copyright holder is likely an infringement of the author's moral rights, which is at the criminal end of copyright law, so that's two flavours of illegal right there.
jrochkind1 12y ago
> GitHub's brand of DMCA compliance is much like YouTube's: lazy to the point of unequivocally benefiting copyright owners, not content producers. I believe the text of the DMCA is written to cause this. If you are an ISP, and you don't want to be liable for infringments, you have to take things down after receiving a DMCA takedown notice. The end. You can put it back up after the user has followed the right procedure to challenge and assume liability themselves. I admit I'm not sure exactly what procedure the DMCA outlines for this. I think what ISP's _could_ do is facilitate user's filing challenges more easily. But they've got to take it down after receiving a takedown request, that's pretty much what the law says (or else the ISP can be sued for the copyright infringement too). Theoretically you can sue someone for issuing a takedown request in bad faith. Perhaps ISP's could help their users do this too, but it could get sticky for them.
- jrochkind1 12y ago
  Now, I guess, if an ISP ignores a DMCA takedown request, all that happens is that they too can be sued for copyright infringement of the content. Now, I guess an ISP _could_ individually evaluate each DCMA takedown request, decide that some of them are completely illegitimate and there was in fact no infringing material, and thus that they have little legal risk to leaving it up, and probably nobody's going to take them to court over it, and if someone does, the ISP will probably still win and they're willing to deal with it. I think it's pretty obvious that it's not really reasonable to expect a business to do this (by assigning an actual lawyer to evaluate every request? By trusting less trained/certified people to make the determination? Even paying them minimum wage it's probably not affordable), although it would be pretty exciting if one decided to anyway.
  - spikexxx 12y ago
    You can't ignore a request. But you can make them work for it. For example: http://www.diynetwork.com/about-us/dmca-digital-millennium-copyright-act-notice-and-policy/index.html http://www.diynetwork.com/about-us/dmca-digital-millennium-c...
    - 12y ago
joesmo 12y ago
One of the big problems with the DMCA and a lot of similar laws is that they have no built-in protections for abuse. Anyone is allowed to claim anything and because of legal fears, many content hosts immediately side with the alleged copyright holder when there is no proof whatsoever. The only way I can see this not being a problem (other than a repeal of the DMCA itself) is if such actions start to have consequences. Bot or not, this is an intentional action by Qualcomm. Github should push back against this if it wants to remain credible in the open source community. Are there some general provisions in the law that allow it to respond to abuse (which this is a clear case of) with their own lawsuit? Of course, the Qualcomm repository should be pulled. Permanently.
tericho 12y ago
> "Hosting your code on GitHub is senseless because anybody can take your code down at a moment's notice" While I agree with the sentiment, this statement is a bit extreme. Especially since it's a distributed system so you're not exactly losing your work. Also, you can get it back online if you jump through the flaming hoops. In reality there is no better option for hosting OSS code right now than GitHub.
- nilved 12y ago
  > In reality there is no better option for hosting OSS code right now than GitHub. You're right that your code isn't permanently lost, but you're wrong that GitHub is the only option or even the best option for hosting your code. GitLab and gogs are incredible pieces of software and if your needs are small, you can even just use cgit or the built-in gitweb tool. DigitalOcean is one host that can trivially provision GitLab instances. I've hosted my own git server for about a year at https://stealthis.ca https://stealthis.ca. It costs less money than GitHub's cheapest plan and supports unlimited mirrors and private repositories with any amount of collaborators. It also has never went taken my code offline, ever, for any reason. You can guess what'd happen if somebody sent me a DMCA request.
  - air 12y ago
    Github costs $0 and 0h of admin work for OSS code.
    - nilved 12y ago
      If you don't include "regaining access to your code because you upset somebody and they filed a false DMCA complaint that GitHub blindly obeyed" as admin work then you're indeed correct!
kllrnohj 12y ago
It's what the law requires. GitHub, YouTube, etc... don't have a choice in the matter. They are required to take down the content until they receive a formal counter-notice from the recevier of the takedown.
pjc50 12y ago
Hosting your code on the internet may be taken down at a moment's notice. If you host it on your own domain it may be confiscated.
grrowl 12y ago
The most worrying part is the flip side, which is the takedown notice must state that “under penalty of perjury, that the information contained in the notification is accurate.” [512(c)(3)(A)(vi)]. In fact, here it is[1]: > Qualcomm is the owner of an exclusive copyright for each of these documents. Cyveillance is authorized to act on behalf of Qualcomm, and has a good faith belief that the publication and/or disclosure by your web site is not authorized by Qualcomm, any of Qualcomm’s agents, or the law. I certify, under penalty of perjury, that the information in this notice is accurate. The pertinent document: https://github.com/CyanogenMod/android_device_sony_huashan/blob/cm-11.0/rootdir/system/etc/xtwifi.conf https://github.com/CyanogenMod/android_device_sony_huashan/b... [1]: https://github.com/github/dmca/blob/master/2014-07-02-Qualcomm.md https://github.com/github/dmca/blob/master/2014-07-02-Qualco...

by nilved 12y ago

Hermel 12y ago

Also questionable is how the computer that sends out the e-mail can have a "good faith belief"? Especially given that their detection rates are often abismal.

rasz_pl 12y ago
You are free to counter claim and go to court spending $xxxK on lawyers to test it.

Already__Taken 12y ago

Someone should make a bot that DMCAs accounts belonging to employees and their connections in the parent company. For each unverified DMCA they enact. They're the employees who will have to get in and make changes to the system and they work for the companies that have to make noise and say no to the DMCA issuers. If they blanket exclude their own employees of the policies everyone else has to abide, well, that'll say something won't it. There seems to be no negative effect of making false DMCAs so play that game.

sneak 12y ago
> There seems to be no negative effect of making false DMCAs so play that game. Unprosecuted crimes (e.g. the perjury one must commit to file a false DMCA notice) have a strange way of suddenly becoming prosecuted crimes when people act in blatant disregard for the law.
- cowbell 12y ago
  I believe there's only a perjury penalty if you misrepresent the fact that you are authorized to act on behalf of the copyright holder. So if you say, "I'm requesting you take this down because it infringes on Star Wars and I'm an authorized agent of Disney" when you have no relation with Disney, you're up for perjury. However, if you say, "I'm requesting you take this down because it infringes on blahblah.avi and I hold copyright to blahblah.avi" which is true, then no perjury penalty. Even if blahblah.avi has nothing to do with the github repo being taken down. "Oops, my bad, honest mistake, wink wink." The person on the receiving end of the DMCA still has to jump through all the hoops to get their own copyright material reinstated. So if you do your bot right, there's no penalty. None at all. If there is, I'd love to know about it, because these bots need to die in a fire.
  - paulgb 12y ago
    You can claim damages against a false takedown, it's just really hard. The only notable case I know of is OPG v. Diebold http://en.wikipedia.org/wiki/OPG_v._Diebold http://en.wikipedia.org/wiki/OPG_v._Diebold
    - cowbell 12y ago
      I wasn't aware of that case. Thanks. I found sec 512(f) here: http://www.law.cornell.edu/uscode/text/17/512#f http://www.law.cornell.edu/uscode/text/17/512#f

wpietri 12y ago

Honestly, I'm ok with this. The specific case is dumb, but I can't imagine a change to the laws that could make things better. You can't outlaw dumb. Recently I found that one of my popular posts on startups had been boosted without permission or credit by some wannabe-accelerator in Texas. I filed a DMCA request and their host took the page down promptly. It just worked. I'd hope Github is doing some basic checks on requests like this. But I don't want them to try to become a mini-court. We already have a perfectly good court system for resolving ownership disputes.

pelario 12y ago
> We already have a perfectly good court system for resolving ownership disputes. Patent trolls are ok too ?
- wpietri 12y ago
  I gather you must not be a native speaker of English. "Perfectly good" does not mean perfect. It means something like "serviceable" or "adequate for the purpose at hand": http://www.theonion.com/video/nations-parents-release-annual-ranking-of-top-50-p,35204/ http://www.theonion.com/video/nations-parents-release-annual... http://www.urbandictionary.com/define.php?term=perfectly%20good%20airplane http://www.urbandictionary.com/define.php?term=perfectly%20g...
  - ianphughes 12y ago
    Ha. Great reference.
sneak 12y ago
> I'd hope Github is doing some basic checks on requests like this. You're not allowed to do that without losing the safe harbor provisions of the DMCA. Anything that shows up that matches the format must be obeyed. That's why counter-notifications exist.
- wpietri 12y ago

Pxtl 12y ago

Now I'm wondering if it's possible to DDOS a DCMA takedown system with a randomized spam of takedown requests. You know, like a mad-lib "Your site has our content askjdh12312312.avi on the link yourtube.io/5h0rtur1/ and must be removed to comply with yadda yadda yadda". It's probably five kinds of illegal and three kinds of immoral, though.

AimHere 12y ago
A normal DMCA takedown request is taken under penalty of perjury (sadly, a lot of the big common carriers, like Youtube, have gentleman's agreements with Big Media, so they don't rely on formal DMCA takedowns), and knowingly and falsely claiming to be the copyright holder is likely an infringement of the author's moral rights, which is at the criminal end of copyright law, so that's two flavours of illegal right there.

jrochkind1 12y ago

> GitHub's brand of DMCA compliance is much like YouTube's: lazy to the point of unequivocally benefiting copyright owners, not content producers. I believe the text of the DMCA is written to cause this. If you are an ISP, and you don't want to be liable for infringments, you have to take things down after receiving a DMCA takedown notice. The end. You can put it back up after the user has followed the right procedure to challenge and assume liability themselves. I admit I'm not sure exactly what procedure the DMCA outlines for this. I think what ISP's _could_ do is facilitate user's filing challenges more easily. But they've got to take it down after receiving a takedown request, that's pretty much what the law says (or else the ISP can be sued for the copyright infringement too). Theoretically you can sue someone for issuing a takedown request in bad faith. Perhaps ISP's could help their users do this too, but it could get sticky for them.

jrochkind1 12y ago
Now, I guess, if an ISP ignores a DMCA takedown request, all that happens is that they too can be sued for copyright infringement of the content. Now, I guess an ISP _could_ individually evaluate each DCMA takedown request, decide that some of them are completely illegitimate and there was in fact no infringing material, and thus that they have little legal risk to leaving it up, and probably nobody's going to take them to court over it, and if someone does, the ISP will probably still win and they're willing to deal with it. I think it's pretty obvious that it's not really reasonable to expect a business to do this (by assigning an actual lawyer to evaluate every request? By trusting less trained/certified people to make the determination? Even paying them minimum wage it's probably not affordable), although it would be pretty exciting if one decided to anyway.
- spikexxx 12y ago
  You can't ignore a request. But you can make them work for it. For example: http://www.diynetwork.com/about-us/dmca-digital-millennium-copyright-act-notice-and-policy/index.html http://www.diynetwork.com/about-us/dmca-digital-millennium-c...
  - 12y ago

joesmo 12y ago

One of the big problems with the DMCA and a lot of similar laws is that they have no built-in protections for abuse. Anyone is allowed to claim anything and because of legal fears, many content hosts immediately side with the alleged copyright holder when there is no proof whatsoever. The only way I can see this not being a problem (other than a repeal of the DMCA itself) is if such actions start to have consequences. Bot or not, this is an intentional action by Qualcomm. Github should push back against this if it wants to remain credible in the open source community. Are there some general provisions in the law that allow it to respond to abuse (which this is a clear case of) with their own lawsuit? Of course, the Qualcomm repository should be pulled. Permanently.

tericho 12y ago

> "Hosting your code on GitHub is senseless because anybody can take your code down at a moment's notice" While I agree with the sentiment, this statement is a bit extreme. Especially since it's a distributed system so you're not exactly losing your work. Also, you can get it back online if you jump through the flaming hoops. In reality there is no better option for hosting OSS code right now than GitHub.

nilved 12y ago
> In reality there is no better option for hosting OSS code right now than GitHub. You're right that your code isn't permanently lost, but you're wrong that GitHub is the only option or even the best option for hosting your code. GitLab and gogs are incredible pieces of software and if your needs are small, you can even just use cgit or the built-in gitweb tool. DigitalOcean is one host that can trivially provision GitLab instances. I've hosted my own git server for about a year at https://stealthis.ca https://stealthis.ca. It costs less money than GitHub's cheapest plan and supports unlimited mirrors and private repositories with any amount of collaborators. It also has never went taken my code offline, ever, for any reason. You can guess what'd happen if somebody sent me a DMCA request.
- air 12y ago
  Github costs $0 and 0h of admin work for OSS code.
  - nilved 12y ago
    If you don't include "regaining access to your code because you upset somebody and they filed a false DMCA complaint that GitHub blindly obeyed" as admin work then you're indeed correct!

kllrnohj 12y ago

It's what the law requires. GitHub, YouTube, etc... don't have a choice in the matter. They are required to take down the content until they receive a formal counter-notice from the recevier of the takedown.

pjc50 12y ago

Hosting your code on the internet may be taken down at a moment's notice. If you host it on your own domain it may be confiscated.

grrowl 12y ago

The most worrying part is the flip side, which is the takedown notice must state that “under penalty of perjury, that the information contained in the notification is accurate.” [512(c)(3)(A)(vi)]. In fact, here it is[1]: > Qualcomm is the owner of an exclusive copyright for each of these documents. Cyveillance is authorized to act on behalf of Qualcomm, and has a good faith belief that the publication and/or disclosure by your web site is not authorized by Qualcomm, any of Qualcomm’s agents, or the law. I certify, under penalty of perjury, that the information in this notice is accurate. The pertinent document: https://github.com/CyanogenMod/android_device_sony_huashan/blob/cm-11.0/rootdir/system/etc/xtwifi.conf https://github.com/CyanogenMod/android_device_sony_huashan/b... [1]: https://github.com/github/dmca/blob/master/2014-07-02-Qualcomm.md https://github.com/github/dmca/blob/master/2014-07-02-Qualco...