6 ms·

Brief summary: Thejesh has accused Indian Airtel and Flash Networks Layer8 of something that may be a crime (depending on the particulars of Indian law) and is

Brief summary: Thejesh has accused Indian Airtel and Flash Networks Layer8 of something that may be a crime (depending on the particulars of Indian law) and is definitely a scandal. Specifically, the accusation is that Flash Networks Layer8 wrote a piece of malicious software and that Airtel injected it into customers' network connections. Thejesh republished the injected script on GitHub. Flash Networks sent a nasty letter to GitHub asking them to take down the evidence, claiming that their malicious software is copyrighted. GitHub complied.

wvenable 11y ago
Just because code/webpages are delivered to you over the web doesn't mean you can take them and republish them somewhere else.
- jimrandomh 11y ago
  Just because fingerprints were found at the scene of the burglary doesn't mean you take them and republish them somewhere else.
  - errtnsd 11y ago
    Doesn't that fall under vigilantism? Publishing fingerprints might get you in trouble. In most countries you are forbidden to take photos in a private setting without permission, and in some even in public. wvenable's comment is on point. Just as public websites aren't public domain, publishing information delivered on request might not be legal.
    - 0xdeadbeefbabe 11y ago
      It may not be legal, but I'm not sure it is wrong either (the web stuff and not the burglary)
  - ars 11y ago
    Fingerprints are not copyrighted, code is. You might claim fair use if you published it as part of an article, but probably not on GitHub which is intended for using and editing code.
    - shmerl 11y ago
      Publishing research on malware should be perfectly legit.
      - wvenable 11y ago
        Publishing a book report is very different than publishing the book itself.
        shmerl 11y ago
        If that book is malware itself? It should be OK, because it's security research and exposure of that malware. It should be covered by fair use.
    - DrJokepu 11y ago
      But fingerprints are personal data and at least in the EU the handling of personal data is very strictly regulated. It's not the same thing at all, but still the analogy works I think.
      - ars 11y ago
        Personal data and copyright are completely different things. The analogy doesn't work at all. For example, even if you are worried about personal data, you can still publish a fingerprint if you don't identify the individual.
    - jimrandomh 11y ago
      That was a very imprecise analogy. What we actually have here is the intersection of copyright, digital forensic evidence, three jurisdictions, and facts and circumstances that are in dispute. Figuring out what the law actually says on this matter would be a sizable project for a law firm, and probably can't be settled without a judge.
- shmerl 11y ago
  Is illegal code (i.e. malware) protected by the copyright to begin with? If it is, then all antiviruses blatantly violate copyright. But something tells me they don't need to ask any permission from malware authors.
  - wvenable 11y ago
    It seems like illegal works should be protected by copyright[1] But that begs the question, as ad injectors are probably not illegal. [1] http://www.cardozo.yu.edu/sites/default/files/Eldar%20Haber,%20Wrong%20Copyright.pdf http://www.cardozo.yu.edu/sites/default/files/Eldar%20Haber,...
    - shmerl 11y ago
      I'm not sure they are not illegal. At least they shouldn't be any less illegal than many other types of malware. But I'm not familiar what laws that falls under.
      - wvenable 11y ago
        Injecting ads into content has been what television stations have been doing for decades. Users of the network service may even have agreed to this in the terms of service for using the network. It's a crappy thing to do but not all crappy things are illegal.
        shmerl 11y ago
        This example was not about injecting ads. It was about collecting data about users which is violating their privacy (i.e. it's malware).
        wvenable 11y ago
        What are you basing this on? Flash Networks said "The javascript mentioned does not collect or store any user data but is used to deliver user messages." and I haven't heard anything to contrary. In fact, it doesn't sound like it was even going to be used to inject ads except for offering users to upgrade to larger plan when they were near their data expiration. I agree that any code injection is shady and unwanted but you're just making stuff up.
- derefr 11y ago
  "Just because", no. But: 1. The server has no access restrictions for the Javascript URL, presumably. So, if you trust the server's configuration to match the owner's intent, then the owner was saying "this page is intended for public consumption." Which is to say, importantly, not only for their customers to view in exchange for their subscription fees (which would put the ad-injector script under license of whatever TOS the customers agreed to), but rather for anyone to view who has no prior relationship with them, for any purpose. This is the "reproductions are allowed of works of artistic craftsmanship (buildings, sculptures, etc.) that are permanently situated in a public place or in premises open to the public" argument. 2. The owner never put a copyright claim against anyone else making copies of this work. Like the Internet Archive's copy of their website, say (if there is one.) That would suggest this takedown notice is a motivated use of copyright law to attack someone, rather than business-as-usual of them enforcing their IP. Judges don't like it when you have a history of not caring about people doing something you could have complained about. They take that as evidence you don't care. 3. Fair use! This is a: • transformative use (it's visible source code, not an executing program!), • of a small part of their copyrighted work (it's just the Javascript!), • intended for a purpose that could be said to be both parody (revealing a previously-unnoticed essence of the original work through transformation) and edification (teaching people that the network is doing this thing.) There's probably even more arguments than these. I hope the poster takes some of them to Github with a counter-takedown to get their repo back up.
  - wvenable 11y ago
    > The server has no access restrictions for the Javascript URL, presumably. So, if you trust the server's configuration to match the owner's intent, then the owner was saying "this page is intended for public consumption." That argument did not help weev with AT&T. If they are distributing the code, they are allowed to do that as the copyright owner. That's why it's called copyright. But that doesn't grant anyone else the right to distribute the content. By your argument, any content posted anywhere publicly on the Internet is not subject to copyright restrictions. Which is clearly not the case. > The owner never put a copyright claim against anyone else making copies of this work. It's unlikely they are aware of anyone else distributing their work. This may be the only unauthorized distribution of this work so far. > transformative use (it's visible source code, not an executing program!), There is nothing transformative about this. > of a small part of their copyrighted work (it's just the Javascript!), It must be very small; an excerpt. This is not an excerpt of the program. > There's probably even more arguments than these. If they're of the same quality they're unlikely to make a difference. These are poor arguments. Fair use never* applies to copying a complete work. * It's perhaps possible; but this case certainly doesn't qualify.
smhenderson 11y ago
Additionally Airtel denies foreknowledge and says it has nothing to with the C&D. I would not be surprised if this is PR (given their weasel-worded reasoning behind being affiliated with Flash NW in the first place [1]) but on the face of it they also think the C&D was unwarranted and not a good idea... [1] “This is a standard solution deployed by telcos globally to help their customers keep track of their data usage in terms of mega bytes used. It is therefore meant to improve customer experience and empower them to manage their usage. One of our network vendor partners has piloted this solution through a third party to help customers understand their data consumption in terms of volume of data used. As a responsible corporate, we have the highest regard for customer privacy and we follow a policy of zero tolerance with regard to the confidentiality of customer data. We are also surprised at the Cease & Desist notice served by Flash Networks to Thejesh GN, and categorically state that we have no relation, whatsoever, with the notice.”
- deleted 11y ago
  [deleted]
sarciszewski 11y ago
If anyone finds themselves in a similar situation, please email me the snippets and explain the story. I'll mirror them for you. scott@arciszewski.me Fuck censorship.
- shiven 11y ago
  Your site is down. Error 526 Ray ID: 1f474c500f7a0ef1 • 2015-06-10 18:56:46 UTC Invalid SSL certificate
  - sarciszewski 11y ago
    Oh? It's up from here. Maybe it's a CF issue? Regardless, I have other domains/sites for mirroring content. ;)
  - techaddict009 11y ago
    https://scott.arciszewski.me/contact/ https://scott.arciszewski.me/contact/ this is the site url probably.
  - chrisBob 11y ago
    The link in his profile works (https://scott.arciszewski.me/ https://scott.arciszewski.me/) even though I see the same error when going directly to https://arciszewski.me/ https://arciszewski.me/ does not. My guess is that arciszewski.me is not on the certificate because it is not meant to host web content, only the subdomains do.
    - sarciszewski 11y ago
      Oh, right. I had SSL on both endpoints and the main site was intended to be just a list of family members' domains I hosted (and by that, I usually mean "reverse proxied" because I don't trust them).

wvenable 11y ago

Just because code/webpages are delivered to you over the web doesn't mean you can take them and republish them somewhere else.

jimrandomh 11y ago
Just because fingerprints were found at the scene of the burglary doesn't mean you take them and republish them somewhere else.
- errtnsd 11y ago
  Doesn't that fall under vigilantism? Publishing fingerprints might get you in trouble. In most countries you are forbidden to take photos in a private setting without permission, and in some even in public. wvenable's comment is on point. Just as public websites aren't public domain, publishing information delivered on request might not be legal.
  - 0xdeadbeefbabe 11y ago
    It may not be legal, but I'm not sure it is wrong either (the web stuff and not the burglary)
- ars 11y ago
  Fingerprints are not copyrighted, code is. You might claim fair use if you published it as part of an article, but probably not on GitHub which is intended for using and editing code.
  - shmerl 11y ago
    Publishing research on malware should be perfectly legit.
    - wvenable 11y ago
      Publishing a book report is very different than publishing the book itself.
      - shmerl 11y ago
        If that book is malware itself? It should be OK, because it's security research and exposure of that malware. It should be covered by fair use.
  - DrJokepu 11y ago
    But fingerprints are personal data and at least in the EU the handling of personal data is very strictly regulated. It's not the same thing at all, but still the analogy works I think.
    - ars 11y ago
      Personal data and copyright are completely different things. The analogy doesn't work at all. For example, even if you are worried about personal data, you can still publish a fingerprint if you don't identify the individual.
  - jimrandomh 11y ago
    That was a very imprecise analogy. What we actually have here is the intersection of copyright, digital forensic evidence, three jurisdictions, and facts and circumstances that are in dispute. Figuring out what the law actually says on this matter would be a sizable project for a law firm, and probably can't be settled without a judge.
shmerl 11y ago
Is illegal code (i.e. malware) protected by the copyright to begin with? If it is, then all antiviruses blatantly violate copyright. But something tells me they don't need to ask any permission from malware authors.
- wvenable 11y ago
  It seems like illegal works should be protected by copyright[1] But that begs the question, as ad injectors are probably not illegal. [1] http://www.cardozo.yu.edu/sites/default/files/Eldar%20Haber,%20Wrong%20Copyright.pdf http://www.cardozo.yu.edu/sites/default/files/Eldar%20Haber,...
  - shmerl 11y ago
    I'm not sure they are not illegal. At least they shouldn't be any less illegal than many other types of malware. But I'm not familiar what laws that falls under.
    - wvenable 11y ago
      Injecting ads into content has been what television stations have been doing for decades. Users of the network service may even have agreed to this in the terms of service for using the network. It's a crappy thing to do but not all crappy things are illegal.
      - shmerl 11y ago
        This example was not about injecting ads. It was about collecting data about users which is violating their privacy (i.e. it's malware).
        wvenable 11y ago
        What are you basing this on? Flash Networks said "The javascript mentioned does not collect or store any user data but is used to deliver user messages." and I haven't heard anything to contrary. In fact, it doesn't sound like it was even going to be used to inject ads except for offering users to upgrade to larger plan when they were near their data expiration. I agree that any code injection is shady and unwanted but you're just making stuff up.
derefr 11y ago
"Just because", no. But: 1. The server has no access restrictions for the Javascript URL, presumably. So, if you trust the server's configuration to match the owner's intent, then the owner was saying "this page is intended for public consumption." Which is to say, importantly, not only for their customers to view in exchange for their subscription fees (which would put the ad-injector script under license of whatever TOS the customers agreed to), but rather for anyone to view who has no prior relationship with them, for any purpose. This is the "reproductions are allowed of works of artistic craftsmanship (buildings, sculptures, etc.) that are permanently situated in a public place or in premises open to the public" argument. 2. The owner never put a copyright claim against anyone else making copies of this work. Like the Internet Archive's copy of their website, say (if there is one.) That would suggest this takedown notice is a motivated use of copyright law to attack someone, rather than business-as-usual of them enforcing their IP. Judges don't like it when you have a history of not caring about people doing something you could have complained about. They take that as evidence you don't care. 3. Fair use! This is a: • transformative use (it's visible source code, not an executing program!), • of a small part of their copyrighted work (it's just the Javascript!), • intended for a purpose that could be said to be both parody (revealing a previously-unnoticed essence of the original work through transformation) and edification (teaching people that the network is doing this thing.) There's probably even more arguments than these. I hope the poster takes some of them to Github with a counter-takedown to get their repo back up.
- wvenable 11y ago
  > The server has no access restrictions for the Javascript URL, presumably. So, if you trust the server's configuration to match the owner's intent, then the owner was saying "this page is intended for public consumption." That argument did not help weev with AT&T. If they are distributing the code, they are allowed to do that as the copyright owner. That's why it's called copyright. But that doesn't grant anyone else the right to distribute the content. By your argument, any content posted anywhere publicly on the Internet is not subject to copyright restrictions. Which is clearly not the case. > The owner never put a copyright claim against anyone else making copies of this work. It's unlikely they are aware of anyone else distributing their work. This may be the only unauthorized distribution of this work so far. > transformative use (it's visible source code, not an executing program!), There is nothing transformative about this. > of a small part of their copyrighted work (it's just the Javascript!), It must be very small; an excerpt. This is not an excerpt of the program. > There's probably even more arguments than these. If they're of the same quality they're unlikely to make a difference. These are poor arguments. Fair use never* applies to copying a complete work. * It's perhaps possible; but this case certainly doesn't qualify.

smhenderson 11y ago

Additionally Airtel denies foreknowledge and says it has nothing to with the C&D. I would not be surprised if this is PR (given their weasel-worded reasoning behind being affiliated with Flash NW in the first place [1]) but on the face of it they also think the C&D was unwarranted and not a good idea... [1] “This is a standard solution deployed by telcos globally to help their customers keep track of their data usage in terms of mega bytes used. It is therefore meant to improve customer experience and empower them to manage their usage. One of our network vendor partners has piloted this solution through a third party to help customers understand their data consumption in terms of volume of data used. As a responsible corporate, we have the highest regard for customer privacy and we follow a policy of zero tolerance with regard to the confidentiality of customer data. We are also surprised at the Cease & Desist notice served by Flash Networks to Thejesh GN, and categorically state that we have no relation, whatsoever, with the notice.”

deleted 11y ago
[deleted]

sarciszewski 11y ago

If anyone finds themselves in a similar situation, please email me the snippets and explain the story. I'll mirror them for you. scott@arciszewski.me Fuck censorship.

shiven 11y ago
Your site is down. Error 526 Ray ID: 1f474c500f7a0ef1 • 2015-06-10 18:56:46 UTC Invalid SSL certificate
- sarciszewski 11y ago
  Oh? It's up from here. Maybe it's a CF issue? Regardless, I have other domains/sites for mirroring content. ;)
- techaddict009 11y ago
  https://scott.arciszewski.me/contact/ https://scott.arciszewski.me/contact/ this is the site url probably.
- chrisBob 11y ago
  The link in his profile works (https://scott.arciszewski.me/ https://scott.arciszewski.me/) even though I see the same error when going directly to https://arciszewski.me/ https://arciszewski.me/ does not. My guess is that arciszewski.me is not on the certificate because it is not meant to host web content, only the subdomains do.
  - sarciszewski 11y ago
    Oh, right. I had SSL on both endpoints and the main site was intended to be just a list of family members' domains I hosted (and by that, I usually mean "reverse proxied" because I don't trust them).