6 ms·
Indian Programmer Exposes Code Injection, Gets a Cease and Desist from Injectors
- eridius 11y ago> and Github, for their part, cravenly pulled the code as part of DMCA request. That's a very weirdly-opinionated statement. Isn't GitHub legally required to obey the DMCA request?
- sp332 11y agoNot required exactly, but if they refuse to take down the content, then they can be sued for copyright infringement themselves. The DMCA removes their liability and makes the fight between the uploader and the copyright holder. But if they step outside of the "safe harbor" they become potential targets.
- poizan42 11y agoIANAL, but can't github still be sued in India where the DMCA doesn't apply? GitHub is doing business in India as well, so wouldn't they be subject to the jurisdiction of an indian court?
- mikecb 11y agoThey may be able to, depending on Indian Court's jurisprudence on personal jurisdiction, but unless they have assets in India, the Indian judgement would have to be brought to the United States for enforcement. The U.S. has laws and procedures outlining what sorts of foreign judgements will and will not be honored and enforced by U.S. Courts. For example, a U.S. Court will not enforce a libel judgement from a UK court, because of the SPEECH Act. See more: http://en.wikipedia.org/wiki/Enforcement_of_foreign_judgments#Enforcement_of_foreign_judgments_in_the_U.S http://en.wikipedia.org/wiki/Enforcement_of_foreign_judgment....
- dilippkumar 11y agoDidn't India ban Github a while back? http://thenextweb.com/in/2014/12/31/vimeo-github-30-sites-blocked-india-content-isis/ http://thenextweb.com/in/2014/12/31/vimeo-github-30-sites-bl...
- deleted 11y ago[deleted]
- duskwuff 11y agoNo, it's absolutely not. Placing content in the public domain takes an explicit public domain dedication; simply making it available doesn't have that effect. (Edit: Alternatively, content can enter the public domain if all copyrights on it have expired. But that's certainly not the case here either.)
- errtnsd 11y agoNo, the code is still copyrighted by Networks Layer8 or Airtel. Publishing or delivering it on request doesn't make it public domain. Here is one definition of public domain: the status of a literary work or an invention whose copyright or patent has expired or that never had such protection.
- MichaelGG 11y agoHow was it in the public domain?
- Sanddancer 11y agoYep. Part of DMCA safe harbor is that you have to pull it down for a couple weeks, regardless of frivolity.
- ikeboy 11y agoGoogle rejects many DMCA requests, does that mean they aren't covered under safe harbor?
- sp332 11y agoI think they only reject badly-formed ones or cases where an automated system clearly mis-identified content. https://torrentfreak.com/google-further-highlights-wrongful-dmca-takedowns-130320/ https://torrentfreak.com/google-further-highlights-wrongful-... So they could be sued, but since they would obviously win in court, no one bothers suing over these.
- masklinn 11y agoFor the DMCA they rejected and if the request is found to be valid, yes, they become potential party to the legal action. I'm guessing they reject obviously spurious and incomplete/ill-formed ones.
- wnevets 11y agoit means the people who made the request can sue google.
- duskwuff 11y agoGoogle is in the unusual situation of receiving a lot of blatantly invalid DMCA takedowns. Like, a movie studio (or a company under contract to them) will do a Google search for something broad, like "download game of thrones", and issue a mass takedown for every single link that shows up, often without even looking at the links. So a lot of perfectly legal content (e.g, a news article that says "Game Of Thrones is one of the most commonly downloaded TV shows") gets swept up, and Google is being good enough to spot those and reject them. (Sometimes the DMCA agents screw up even worse. For instance, there's evidence that some of them forget important keywords sometimes, and end up issuing a takedown on all the top links for searches like "download".)
- mkagenius 11y agoI have never heard the term "American" programmer. Why?
- ska 11y agoI have, but not in America. Perhaps an "us" as opposed to "them" pre-supposition on the part of writers wherever they are?
- smeyer 11y agoAre you in the US and/or consuming primarily American media sources? I'd imagine the term might be more common in articles written in India and the term Indian programmer more common in articles written in the US.
- mkagenius 11y agoI am in India. Never heard American programmer. Maybe Indian media doesn't cover much tech.
- smeyer 11y agoInteresting, thanks for the perspective. I wonder if the term is more common in any other countries or just uncommon in general. I can find a few examples googling but that doesn't really answer if it's common or not.
- duaneb 11y agoI felt it was more about the situation of the person (being an Indian ISP and in India) rather than a defining characteristic of the person. I would expect them to call a programmer American if it's an Indian newspaper and the piece of news happened in the US.
- danso 11y agoSo...without knowing anything more about you...I would guess the reason is because you currently either reside in the U.S. or get much of your news from U.S.-based sources. So a U.S.-based press outlet might write this: "The Game of Thrones cast includes British actors Kit Harrington and Emilia Clarke" But a U.S.-based press outlet would probably not write this, because it is assumed their audience is American and the "default" nationality is American unless stated otherwise: "The cast of Seinfeld includes American actors Jerry Seinfeld and Julia Louis-Dreyfus" In the case of the OP, TechCrunch is an American based outlet with a heavily American-skewed audience. If this case involved an American programmer who exposed the flaw, it might not be in the headline, but it would likely be stated in the body text since the story deals with two foreign-owned entities and the readers could likely be curious about the affiliation of the programmer.
- webkike 11y agoI wonder, if I write some HTML/JS code and deny the write to modify, can I send Flash a cease and desist for violation?
- TheDong 11y agoYou don't have to do that; there are plenty of webpages with GPL'd html and injecting such code into that html without also providing the code under GPL on request to any user is a violation of the GPL. I'm curious if the above copyright infringement would stand in court or not... Copyright infringement normally does need intent and I'm not sure if this is really intent or not.
- GhotiFish 11y agoI'd never considered that angle before, that's a good thought! If they intend to modify the source of a page then that would be considered a derivation, and obfuscated code is not considered a source code release. I'd love to hear a more professional analysis on this angle.
- nightpool 11y agoIts clear intent on the part of the programmer who wrote the code, in my opinion. They obviously designed it to modify webpages, and its not doing anything out of the ordinary or unexpected when its modifying GPL'd webpages. Just because the programmer didn't consider that there may be licensing restrictions attached to modifying web pages doesn't mean that they should be exempt from them.
- belorn 11y agoIntent for specific infringements has so far not been a requirement when torrent sites has been taken down. It is enough that they simply causes infringement in the abstract to be found guilty of assisting in copyright infringement. The problem with injecting code into html is that it "adapts" the work, and adaptations requires copyright permission.
- jamra 11y agoHe got a cease and desist letter from the copyright holders, not the injectors. I believe his ISP was injecting.
- shkkmo 11y agoWhy is this downvoted? The statement appears to be correct based on the article linked. >an Indian Airtel customer, Thejesh GN, discovered that the carrier had begun using Flash Networks Layer8 “monetization” (read “ad injection”) solutions. >However, like so many ridiculous cease and desist letters, that hasn’t stopped Flash Networks lawyer Ameet Metha at Solicis Lex from trying to scare Thejesh >Airtel, for their part, told Storypick that they have nothing to do with the C&D:
- jamra 11y agoI think we should do a research project on comments like mine that get initially downvoted, but then receive statements like yours clarifying the authenticity of the original comment. I have more upvotes on this comment than on most of my other comments.
- shkkmo 11y agoFunnily enough, my clarification got 1 up vote...
- deleted 11y ago[deleted]
- nish1500 11y agoWow! I was using the WiFi at the Bangalore or Mumbai airport one day when I realised that half of the websites appeared broken in some way. I looked into the code and realised that the WiFi provider was injecting JavaScript ad codes in all the web pages I was visiting. I talked to some people about it, but no one seemed perturbed. Such invasions of privacy are a hallmark of Indian companies. Even more perturbing is the lackadaisical attitude of consumers towards such breaches; most them don't think it's wrong. On a slightly un-related note: India has a national DND registry, for preventing marketers from spamming users' phones. I have filed over a dozen DND complaints and appeals over the last year, with Airtel and Vodafone, against major e-commerce Indian companies. It's amazing the extent to which these operators would go to suppress the issue. None of my complaints were resolved, and I still get spammed. People tell me - It's just a bunch of messages. Ignore them.
- pskocik 11y agoWell, you should always be able to tell if you limit yourself to HTTPS sites. If they offered their own devices and had hacked them to make middle-manned HTTPS sites appear safe, that would be crossing the line for me.
- currentoor 11y agoIt's not really a big deal but why do they need to say Indian programmer as apposed to just a programmer?
- josefresco 11y agoIt does provide some context, but probably not enough to justify it's use - unless of course adding it to your lead caused an increase in readership.
- jimrandomh 11y agoBecause the story takes place in India, and since TechCrunch is an American publication, people would otherwise assume the story was taking place in the US.
- poizan42 11y agoThat and the DMCA does not apply in India, they are just abusing the system.
- jimrandomh 11y agoNo, the DMCA does apply because GitHub is an American company. (I mean, they are abusing the system, but not in that particular way.)
- duaneb 11y agoGithub is in the US, where India does not have jurisdiction. DMCA laws DO apply.
- currentoor 11y agoGood point.
- deleted 11y ago[deleted]
- madez 11y agoThis happens in Brazil, too. It is outrageous but the public in Brazil is horribly unenducated and they couldn't care less.
- rroriz 11y agoI'm from Brazil. Which carrier do you use that has this same behaviour? I really want to check what they are doing...
- madez 11y agoI had a sim card from VIVO and they regularly used DNS-hijacking to show me captive portals which tried to convince to pay for more traffic. One thing at least as annoying as that is that Firefox caches that site so that when I close the portal and try to reaccess the original website Firefox shows me again the captive portal.
- jimrandomh 11y agoBrief summary: Thejesh has accused Indian Airtel and Flash Networks Layer8 of something that may be a crime (depending on the particulars of Indian law) and is definitely a scandal. Specifically, the accusation is that Flash Networks Layer8 wrote a piece of malicious software and that Airtel injected it into customers' network connections. Thejesh republished the injected script on GitHub. Flash Networks sent a nasty letter to GitHub asking them to take down the evidence, claiming that their malicious software is copyrighted. GitHub complied.
- wvenable 11y agoJust because code/webpages are delivered to you over the web doesn't mean you can take them and republish them somewhere else.
- jimrandomh 11y agoJust because fingerprints were found at the scene of the burglary doesn't mean you take them and republish them somewhere else.
- errtnsd 11y agoDoesn't that fall under vigilantism? Publishing fingerprints might get you in trouble. In most countries you are forbidden to take photos in a private setting without permission, and in some even in public. wvenable's comment is on point. Just as public websites aren't public domain, publishing information delivered on request might not be legal.
- 0xdeadbeefbabe 11y agoIt may not be legal, but I'm not sure it is wrong either (the web stuff and not the burglary)
- ars 11y agoFingerprints are not copyrighted, code is. You might claim fair use if you published it as part of an article, but probably not on GitHub which is intended for using and editing code.
- shubhamjain 11y agoPrivacy is never a serious issue in India and even in this case, it only caught an eye when C&D letter was sent. In fact, code and advertisement injection is something broadband providers like MTNL have been doing since ages. Sadly, business malpractices rarely get punished in India and have become more of norm that comes with running it. The only way I see out is to hurt these companies as much as possible. Boycotting their services on a large scale, so they get to know that they are not the king here.
- mahouse 11y agoHow weird, an israeli company doing this.
- anandpdoshi 11y agoDoesn't using HTTPS prevent such an injection?
- acomjean 11y agoI would hope so, unless there is some monkey business with the SSL Certs like the "superfish". A lot of pages aren't https yet though.
- Leon 11y agoSuperfish was because the laptop manufacturer bundled adware which added its own root certificate that was broken, they aren't able to add root certificates in this case.
- nightpool 11y agoUnless its something they require on their phones as a carrier ¯\_(ツ)_/¯
- anandpdoshi 11y agoAFAIK Mozilla is trying to make https certificates free for everyone. Edit: Here's the link: https://letsencrypt.org https://letsencrypt.org
- paraxisi 11y agoFor those of you who are interested, here is the code: http://pastebin.com/shcMPTHc http://pastebin.com/shcMPTHc
- caioariede 11y agoUnminified version: http://pastebin.com/Zgjaksng http://pastebin.com/Zgjaksng
- ashishchaudhary 11y agoThere was a question about it on the stackexchange network as early as 30 April: http://superuser.com/questions/908092/my-isp-is-inserting-a-javascript-file-into-all-the-pages-i-browse http://superuser.com/questions/908092/my-isp-is-inserting-a-...
- dang 11y agoThis has been posted a few times, most notably https://news.ycombinator.com/item?id=9683108 https://news.ycombinator.com/item?id=9683108.
- nightpool 11y agoare these automated? this story has 6x the comments and 3x the upvotes then that one.
- ejcx 11y agoI had a similar thing happen to me in the USA actually but had a different outcome. I got on instagram.com (when it was still served over HTTP) one day and noticed an alignment issue. I believe reddit also had the issue. It was caused by a rogue iframe that was being injected into the page. After some investigating the iframe domain was owned by my ISP. I sent emails to some of the higher ups telling them they should stop and the problem disappeared after about a month, and wrote a chrome extension to block the domains in the meantime. Not really sure what their idea was but it goes to show that you can't trust your ISP anywhere in the world (or anyone on the internet for that matter).
- Rudism 11y agoComcast uses code injection like this in markets where they implement the 300gb/mo bandwidth cap. Not for injecting ads or anything outwardly malicious, but to display a javascript overlay telling you when you're approaching or over your bandwidth limit for the current month. It's a piece of javascript that they'll inject right on whatever page you're browsing (HN, Reddit, whatever).