4 ms·

Just because code/webpages are delivered to you over the web doesn't mean you can take them and republish them somewhere else.

jimrandomh 11y ago
Just because fingerprints were found at the scene of the burglary doesn't mean you take them and republish them somewhere else.
- errtnsd 11y ago
  Doesn't that fall under vigilantism? Publishing fingerprints might get you in trouble. In most countries you are forbidden to take photos in a private setting without permission, and in some even in public. wvenable's comment is on point. Just as public websites aren't public domain, publishing information delivered on request might not be legal.
  - 0xdeadbeefbabe 11y ago
    It may not be legal, but I'm not sure it is wrong either (the web stuff and not the burglary)
- ars 11y ago
  Fingerprints are not copyrighted, code is. You might claim fair use if you published it as part of an article, but probably not on GitHub which is intended for using and editing code.
  - shmerl 11y ago
    Publishing research on malware should be perfectly legit.
    - wvenable 11y ago
      Publishing a book report is very different than publishing the book itself.
      - shmerl 11y ago
        If that book is malware itself? It should be OK, because it's security research and exposure of that malware. It should be covered by fair use.
  - DrJokepu 11y ago
    But fingerprints are personal data and at least in the EU the handling of personal data is very strictly regulated. It's not the same thing at all, but still the analogy works I think.
    - ars 11y ago
      Personal data and copyright are completely different things. The analogy doesn't work at all. For example, even if you are worried about personal data, you can still publish a fingerprint if you don't identify the individual.
  - jimrandomh 11y ago
    That was a very imprecise analogy. What we actually have here is the intersection of copyright, digital forensic evidence, three jurisdictions, and facts and circumstances that are in dispute. Figuring out what the law actually says on this matter would be a sizable project for a law firm, and probably can't be settled without a judge.
  - Steveism 11y ago
    What about the copyright of the webpage whose code was altered with these injected ads? It's ironic that a company whose product disrespects the copyright of others would be so sensitive to the issue.
shmerl 11y ago
Is illegal code (i.e. malware) protected by the copyright to begin with? If it is, then all antiviruses blatantly violate copyright. But something tells me they don't need to ask any permission from malware authors.
- wvenable 11y ago
  It seems like illegal works should be protected by copyright[1] But that begs the question, as ad injectors are probably not illegal. [1] http://www.cardozo.yu.edu/sites/default/files/Eldar%20Haber,%20Wrong%20Copyright.pdf http://www.cardozo.yu.edu/sites/default/files/Eldar%20Haber,...
  - shmerl 11y ago
    I'm not sure they are not illegal. At least they shouldn't be any less illegal than many other types of malware. But I'm not familiar what laws that falls under.
    - wvenable 11y ago
      Injecting ads into content has been what television stations have been doing for decades. Users of the network service may even have agreed to this in the terms of service for using the network. It's a crappy thing to do but not all crappy things are illegal.
      - shmerl 11y ago
        This example was not about injecting ads. It was about collecting data about users which is violating their privacy (i.e. it's malware).
        wvenable 11y ago
        What are you basing this on? Flash Networks said "The javascript mentioned does not collect or store any user data but is used to deliver user messages." and I haven't heard anything to contrary. In fact, it doesn't sound like it was even going to be used to inject ads except for offering users to upgrade to larger plan when they were near their data expiration. I agree that any code injection is shady and unwanted but you're just making stuff up.
derefr 11y ago
"Just because", no. But: 1. The server has no access restrictions for the Javascript URL, presumably. So, if you trust the server's configuration to match the owner's intent, then the owner was saying "this page is intended for public consumption." Which is to say, importantly, not only for their customers to view in exchange for their subscription fees (which would put the ad-injector script under license of whatever TOS the customers agreed to), but rather for anyone to view who has no prior relationship with them, for any purpose. This is the "reproductions are allowed of works of artistic craftsmanship (buildings, sculptures, etc.) that are permanently situated in a public place or in premises open to the public" argument. 2. The owner never put a copyright claim against anyone else making copies of this work. Like the Internet Archive's copy of their website, say (if there is one.) That would suggest this takedown notice is a motivated use of copyright law to attack someone, rather than business-as-usual of them enforcing their IP. Judges don't like it when you have a history of not caring about people doing something you could have complained about. They take that as evidence you don't care. 3. Fair use! This is a: • transformative use (it's visible source code, not an executing program!), • of a small part of their copyrighted work (it's just the Javascript!), • intended for a purpose that could be said to be both parody (revealing a previously-unnoticed essence of the original work through transformation) and edification (teaching people that the network is doing this thing.) There's probably even more arguments than these. I hope the poster takes some of them to Github with a counter-takedown to get their repo back up.
- wvenable 11y ago
  > The server has no access restrictions for the Javascript URL, presumably. So, if you trust the server's configuration to match the owner's intent, then the owner was saying "this page is intended for public consumption." That argument did not help weev with AT&T. If they are distributing the code, they are allowed to do that as the copyright owner. That's why it's called copyright. But that doesn't grant anyone else the right to distribute the content. By your argument, any content posted anywhere publicly on the Internet is not subject to copyright restrictions. Which is clearly not the case. > The owner never put a copyright claim against anyone else making copies of this work. It's unlikely they are aware of anyone else distributing their work. This may be the only unauthorized distribution of this work so far. > transformative use (it's visible source code, not an executing program!), There is nothing transformative about this. > of a small part of their copyrighted work (it's just the Javascript!), It must be very small; an excerpt. This is not an excerpt of the program. > There's probably even more arguments than these. If they're of the same quality they're unlikely to make a difference. These are poor arguments. Fair use never* applies to copying a complete work. * It's perhaps possible; but this case certainly doesn't qualify.

jimrandomh 11y ago

Just because fingerprints were found at the scene of the burglary doesn't mean you take them and republish them somewhere else.

errtnsd 11y ago
Doesn't that fall under vigilantism? Publishing fingerprints might get you in trouble. In most countries you are forbidden to take photos in a private setting without permission, and in some even in public. wvenable's comment is on point. Just as public websites aren't public domain, publishing information delivered on request might not be legal.
- 0xdeadbeefbabe 11y ago
  It may not be legal, but I'm not sure it is wrong either (the web stuff and not the burglary)
ars 11y ago
Fingerprints are not copyrighted, code is. You might claim fair use if you published it as part of an article, but probably not on GitHub which is intended for using and editing code.
- shmerl 11y ago
  Publishing research on malware should be perfectly legit.
  - wvenable 11y ago
    Publishing a book report is very different than publishing the book itself.
    - shmerl 11y ago
      If that book is malware itself? It should be OK, because it's security research and exposure of that malware. It should be covered by fair use.
- DrJokepu 11y ago
  But fingerprints are personal data and at least in the EU the handling of personal data is very strictly regulated. It's not the same thing at all, but still the analogy works I think.
  - ars 11y ago
    Personal data and copyright are completely different things. The analogy doesn't work at all. For example, even if you are worried about personal data, you can still publish a fingerprint if you don't identify the individual.
- jimrandomh 11y ago
  That was a very imprecise analogy. What we actually have here is the intersection of copyright, digital forensic evidence, three jurisdictions, and facts and circumstances that are in dispute. Figuring out what the law actually says on this matter would be a sizable project for a law firm, and probably can't be settled without a judge.
- Steveism 11y ago
  What about the copyright of the webpage whose code was altered with these injected ads? It's ironic that a company whose product disrespects the copyright of others would be so sensitive to the issue.

shmerl 11y ago

Is illegal code (i.e. malware) protected by the copyright to begin with? If it is, then all antiviruses blatantly violate copyright. But something tells me they don't need to ask any permission from malware authors.

wvenable 11y ago
It seems like illegal works should be protected by copyright[1] But that begs the question, as ad injectors are probably not illegal. [1] http://www.cardozo.yu.edu/sites/default/files/Eldar%20Haber,%20Wrong%20Copyright.pdf http://www.cardozo.yu.edu/sites/default/files/Eldar%20Haber,...
- shmerl 11y ago
  I'm not sure they are not illegal. At least they shouldn't be any less illegal than many other types of malware. But I'm not familiar what laws that falls under.
  - wvenable 11y ago
    Injecting ads into content has been what television stations have been doing for decades. Users of the network service may even have agreed to this in the terms of service for using the network. It's a crappy thing to do but not all crappy things are illegal.
    - shmerl 11y ago
      This example was not about injecting ads. It was about collecting data about users which is violating their privacy (i.e. it's malware).
      - wvenable 11y ago
        What are you basing this on? Flash Networks said "The javascript mentioned does not collect or store any user data but is used to deliver user messages." and I haven't heard anything to contrary. In fact, it doesn't sound like it was even going to be used to inject ads except for offering users to upgrade to larger plan when they were near their data expiration. I agree that any code injection is shady and unwanted but you're just making stuff up.

derefr 11y ago

"Just because", no. But: 1. The server has no access restrictions for the Javascript URL, presumably. So, if you trust the server's configuration to match the owner's intent, then the owner was saying "this page is intended for public consumption." Which is to say, importantly, not only for their customers to view in exchange for their subscription fees (which would put the ad-injector script under license of whatever TOS the customers agreed to), but rather for anyone to view who has no prior relationship with them, for any purpose. This is the "reproductions are allowed of works of artistic craftsmanship (buildings, sculptures, etc.) that are permanently situated in a public place or in premises open to the public" argument. 2. The owner never put a copyright claim against anyone else making copies of this work. Like the Internet Archive's copy of their website, say (if there is one.) That would suggest this takedown notice is a motivated use of copyright law to attack someone, rather than business-as-usual of them enforcing their IP. Judges don't like it when you have a history of not caring about people doing something you could have complained about. They take that as evidence you don't care. 3. Fair use! This is a: • transformative use (it's visible source code, not an executing program!), • of a small part of their copyrighted work (it's just the Javascript!), • intended for a purpose that could be said to be both parody (revealing a previously-unnoticed essence of the original work through transformation) and edification (teaching people that the network is doing this thing.) There's probably even more arguments than these. I hope the poster takes some of them to Github with a counter-takedown to get their repo back up.

wvenable 11y ago
> The server has no access restrictions for the Javascript URL, presumably. So, if you trust the server's configuration to match the owner's intent, then the owner was saying "this page is intended for public consumption." That argument did not help weev with AT&T. If they are distributing the code, they are allowed to do that as the copyright owner. That's why it's called copyright. But that doesn't grant anyone else the right to distribute the content. By your argument, any content posted anywhere publicly on the Internet is not subject to copyright restrictions. Which is clearly not the case. > The owner never put a copyright claim against anyone else making copies of this work. It's unlikely they are aware of anyone else distributing their work. This may be the only unauthorized distribution of this work so far. > transformative use (it's visible source code, not an executing program!), There is nothing transformative about this. > of a small part of their copyrighted work (it's just the Javascript!), It must be very small; an excerpt. This is not an excerpt of the program. > There's probably even more arguments than these. If they're of the same quality they're unlikely to make a difference. These are poor arguments. Fair use never* applies to copying a complete work. * It's perhaps possible; but this case certainly doesn't qualify.