Hacker News Reader

Comment by vinylkey | Hacker News Reader

So, in that blog post, they state: "We asked them 24 days ago to remove functionalclam[.]com on the original commit."

Their request is here: https://github.com/easylist/easylist/commit/1ba8d4afeec6d562...

And was made by this account: https://github.com/dmcahelper

So, they made a github account the same day they made the "request" with an account that in no way indicates where the request is coming from? The github profile bio reads "Help all parties understand and resolve DMCA issues efficiently and effectively to minimize file and repository impacts."

Perhaps they should have used a bit more transparency when asking for the offending url to be removed from the repo, instead of acting like a spammy copyright boogyman, then immediately resorting to a dubious DMCA takedown request.

View on HN

It may not be a bad idea to report this user via GitHub's "block or report" feature when viewing that account: https://github.com/dmcahelper

That type of behavior can only be bad for open source software. Threats like "to minimize file and repository impacts" are going to push more folks toward private repositories if they don't understand that it's not an actual authority pressing them into making changes on a given platform.

Additionaly, this account is borderline with regards to GitHub's TOS¹: “While using GitHub, you agree that you will not under any circumstances: […] impersonate any person or entity, including any of our employees or representatives, including through false association with GitHub, or by fraudulently misrepresenting your identity or site's purpose”. They haven't explicitly impersonated GitHub, but I bet I'm not the only one to have wondered for a few seconds whether this was an official GitHub account or not and I'd hardly believe this wasn't intended.

¹ https://help.github.com/articles/github-terms-of-service/#3-...

I just filled a complaint, they have a "report this use" link. Took only a minute, whatever it takes to keep people from abusing people and collaboration, especially using the ugly DMCA hammer.

Agreed. I just reported that account (https://github.com/dmcahelper) for submitting spurious DMCA takedown requests. GitHub personnel responded promptly:

  Hi Justin,
  
  Thanks for writing in. We're looking at the account.
  
  All best,
  
  (GitHub employee name redacted)

GitHub is listening. Please consider reporting this account, which can be done via the link above. Look for Block or report user link under the user description at left.

How does that non-response (the same one they pasted to me) give you the impression they're listening? For one, they have done nothing to address the issue of flagrant DMCA abuse. For two, the account is still active. For three, the commit hasn't been reverted.

This is not the first time this has happened.[0] GitHub's response has been woefully inadequate and OSS maintainers should consider using another platform. Everyone using GitHub is vulnerable to suddenly and arbitrarily losing their repository.

[0] https://news.ycombinator.com/item?id=5331766

The beauty of git and similar DVCS's is that you essentially can't lose the repository. You can only lose the github namespace for that repository. And using a different platform has the same effect. If you are worried about losing the Github namespace for the repository then moving to a different platform doesn't seem like a solution.

Not true. Issues, pull requests, deploy keys, access control...

issues, pull requests, deploy keys, access control. None of those the repository. They are associated with the repository and it would be annoying to lose them But with the exception of the issues all of them are replaceable with mostly minimal effort unless you did something really wrong.

And again switching to a different platform doesn't solve that problem either. You'd still lose the issues that are in github.

Reported.

edit:

Response from support: "Hi xxxxx. This account is not affiliated with GitHub and we are looking into it."

Reported. I think at one pooint GH has to make a decision if they want to kick him out or not, especially when paying members are reporting

> That type of behavior can only be bad for open source software.

Using github is bad for FLOSS.

How so?

Mismatching or contradictory incentives.

Seems kinda vague.

Probably because github is closed source.

I wonder if folks could get sneaky and change the design from a literal url to a regular expression tailored to single out that url but would also include additional sites that are just gibberish and could be relaxed if useful sites ever do fall into the URL overlap. This might be a new line of research to craft regExs to filter out a specific string while also throwing out a bunch of sister gibberish strings that would be unlikely to be adopted simply by virtue of language.

I'd rather just go a level up... You don't want users to tamper with your ads? Ok, we'll block your entire site. No tampering.

I like your style- maybe hard initially but if we could just stop using pages with intrusive ads, firms may finally listen and stop using those ads

If it turns out that this type of DMCA use is legally valid, adblockers could be modified to reject pages that embed URLs that have filed such requests.

So if a particular site uses admiral to protect its ads, it loses traffic.

> I like your style- maybe hard initially but if we could just stop using pages with intrusive ads,

Why stop at intrusive ads ? Just block everything that features commercial ads.

Though the real issue is not ads per se but the tracking that tags along.

That would be neat as an experiment. Like, see how far you can go and what you can get to with a "total blocker."

I've done this with FB.

users of your list will not get this. And will stop using your list. This ending up not serving your purpose nor theirs.

For instance, let me go out on a limb and point out how some distros of linux insist on shipping without any non-free software. So, a user ends up having to go through hoops to just get an audio of video file playing. I think the analogy Im going for is, you don't want to play by our rules (our license, etc), we'll not use your software (or correspondingly block your site).

I'm trying to point out what I think is likely consequence of such an action

/impassionate comment

> users of your list will not get this. And will stop using your list.

I don't think that's universally true. For me, if a site is broken because blocking ads also makes the content inaccessible, I just close the browser tab and move on with my day. (For a while the LA Times was blocking content in this way, so I just refused to visit their site. I guess it worked; they don't do this anymore.)

I don't claim to be the common case, but frankly I don't know what the common case is, and I suspect you don't either, so it could go either way.

You're definitely right. Our ability to ignore our ideals when we're slightly inconvenienced is why content paired with invasive ads is so effective in the first place.

> users of your list will not get this. And will stop using your list. This ending up not serving your purpose nor theirs.

I disagree. Users use adblock lists to protect themselves. This company has proven that they are actively hostile to users. Blocking their entire site, all of their domains, etc, is a sensible precaution for users to take. I have no doubt that this company serves JavaScript (i.e. executable code) that serves their purposes, not users'. And any other sites that insist on using their services are also hostile to users, and blocking them is sensible as well.

If some users just have to see that site, they can either find another list (who cares, no one's doing this for Internet Points), or they can click the "Add Exception" button.

We need not submit ourselves to be effectively held hostage by hostile content providers. It's just content.

What common audio/video codecs/formats require non-free software to play?

DVD, MPEG-2, Flash, MP3 (at least, until all of its patents expire by the end of the year).

What non-free code is required to play back DVDs or MP3s?

Flash I will give you, though it has been an irrelevance to me since YouTube went HTML5.

I believe he's talking about this[1]:

> Many GNU/Linux distributions do not contain libdvdcss (for example, Debian, Fedora, SUSE Linux, and Ubuntu) due to fears of running afoul of DMCA-style laws, but they often provide the tools to let the user install it themselves. For example, it used to be available in Ubuntu through Medibuntu, which is no longer available.

[1] https://en.wikipedia.org/wiki/Libdvdcss#Distribution

Perhaps, but I think it's important to note that libdvdcss is perfectly free software.

You probably did not understand the issue. The domain in question is a part of a copyrigth protection scheme. Blocking access to it is a circumvention of copyright protection scheme and it is illegal under DMCA. No, you cannot block hosts that are a part of a copyright protection scheme and you cannot distribute the software that does that.

How you block the domain - with a simple string or an automatically trained neural network - doesn't matter.

I can block anything I like. And I can do whatever I like to help others do that. And I'll make sure that nobody can stop me, or them, or threaten me about it.

Well, if you do not live in the DMCA country then you are correct.

I make sure that nobody knows who I am, or where I live in meatspace.

> The domain in question is a part of a copyrigth protection scheme. Blocking access to it is a circumvention of copyright protection scheme and it is illegal under DMCA.

You're asserting things to be true that are very much in question, and the assertion borders on the absurd.

Is it also a DMCA violation to add firewall rules to ones own network equipment?

How about having EasyList clients fetch the whole history of the repo?

That way any domain that was ever added would be in the blocklist. True negatives should be pretty low.

Then they would purge it from the repo. In fact, it's questionably the case that they have abided by the DMCA order, for the very reason that it still exists in the repo history. As far as I know, DMCA takedowns normally lead to closing the entire repo.

How about don't host the code at a location which has such hostile laws?

This isn't a legal issue in that the laws are bogus (I mean, they are but it is not the issue here). The real issue is that this company is bully and using the legal system as a bludgeon. These abuses should be penalized and they would happen less.

This IMHO is the most sensible thing. There I think are a gazillion ways of serving your list which are out of reach of such laws (not necessarily US laws)

That actually made me think -- is there such location?

This is a good question. At least at a location where the US does not have an immediate jurisdiction. It's kinda lame, really, that the whole world has to bend over because all of these services are right there in the US. Make them work, at least. Germany, Sweden come to mind.

*edit: removed a redundant word

I concur, I think until the world catches up with the innovation happening in the US (I'm guessing that's why this content is hosted on US services), we'll have to put up with this

Edit: libertarianism anybody ? :D

The DMCA is a US law, so, anywhere outside jurisdiction of US law. GitLab on a C1 Scaleway instance would probably get you pretty far along the way. The lists really aren't that large in size but there are so many requests. It may be better to build in something like [WebTorrent](https://github.com/webtorrent/webtorrent) to propagate updates.

IPFS

Well, https://ipfs.io/ will block stuff. But then you just use a different gateway.

Botnet operators seem to manage it well enough. I'm guessing that something on HostSailor would be hard to take down. Or maybe China.

The downside is that some sites/patterns are removed from the list for legitimate reasons (for example, in the case where a rule is overly broad and breaks sites that it shouldn't). If you can make the software distinguish between "good" and "bad" old rules in the history, then you absolutely have not complied with the DMCA takedown notice anymore.

Or hashes.

Which will make administration rather more complex.

Why not just use a base 64 representation?

How would this help in the long term?

Why is it that the tech set always forgets that CS pedantry != legal pedantry? Have we forgotten about intent? You can't just change the line to a regex that /just happens/ to match that URL and go "neener neener neener it's not the same!" Are you willing to argue in court that that line was changed and it /just so happened/ to match the domain from before? Do you have a plausible explanation for why that change would've been made that doesn't involve "well, we were trying to creatively skirt a DMCA takedown request"?

I'm not sure if its a matter of forgetting but about not knowing the contours of the boundaries of what's permissible and seeing a straightforward workaround as a proposition which also serves to give feedback regarding why or why not the proposition would be tenable. Evaluating a concrete technical solution in light of some legal matter should do well to illuminate and draw attention to the crux of the problem.

I guess the bottom line is whether one is forced to blacklist/whitelist a site and what means are permissible. If its simply about the site name appearing literally then a workaround would seem easy enough and one couldn't claim uniquely singling out because the filter applies more broadly. Of course the intent is the same in both, but I'm not versed enough on DCMA issues to know how intent plays a role in this field. Your point actually makes me curious about the legal field more generally and just how pervasive intent is and what areas of law it plays a role and which is does not.

It's not specifically about the DMCA; it's about legal issues in general. Intent matters in the vast majority of law. You'd be hard-pressed to argue in front of a judge that your intent wasn't to block this specific site, based on the sequence of events:

1. Site added to block list.

2. Site removed from block list due to DMCA takedown request.

3. Site block by new rule added that doesn't target it directly.

I can't imagine any judge or jury looking at that sequence events and then taking you seriously when you say "I didn't intend to block the original site".

The parent's point was more along the lines of: people in the tech world need to stop looking for technical solutions to all problems. Some problems are social problems, or legal problems. They should be solved directly, not with awkward (or possibly illegal or at least tort-worthy) workarounds. We talk about chilling effects and corporations engaging in anti-social behavior when they threaten open source and the open web in particular, but attacking social/legal problems with technological workarounds is itself also anti-social.

Not saying that technological solutions are not useful sometimes. In the short-term, you can often make a bad social or legal problem less bad by using a tech workaround, while simultaneously taking the long slog toward fixing the root of the problem. But putting tech band-aids over our problems and then walking away will only hurt us in the long run.

This is one of those areas where I'd say it comes down to your lawyer. I agree with the general premise being presented, that sometimes the tech community tries to use technology to circumvent problems that aren't technological. That being said, in this specific instance the most effective defense would probably be something to the extent of "Your honor, based on the advice of my legal staff and my own understanding of the law, I was not in direct violation of the DMCA. For this reason, it seemed only logical that the issue must have been that the manner in which I was operating was the problem and not the outcomes of my operation. For this reason, in an attempt to comply with the notice I received, I revised my software to remedy what I understood to be the problem."

I think it's about what exactly is the DMCA used against. My first thought was as well that they claimed the act of writing down the domain name somehow violated the copyright of their domain. That sounds kind of silly and if it were actually the case, I think a hash/regex solution would make sense.

However I think what actually happened was that the business is operating paywalls/"anti-adblocker-walls" for other sites - so they claim that blocking them constitutes "circumvention of protection devices" for their customers - which indeed would be far severe for adblockers if confirmed by a judge.

(That's my understanding, though I might have gotten it wrong)

OK, why not circumvent the "argue in front of a judge" aspect? Instead of a list hosted on GitHub, put it on some server that's very hard to take down, leased anonymously. You could get EasyList, and then add back whatever's been removed. And make sure that no logs are retained concerning user input.

Because that means you have lost and agree that you don't have a right to block ads.

You have it backwards. Being able to do it freely means that I have the right.

Well, first of all, blocking a URL is not against the DMCA.

So one argument to do is this is because it is NOT illegal, and the purpose would be to stop frivolous lawsuits.

So yes, it would be trying to creatively skirt frivolous lawsuits.

Another legit reason though, is obfuscation. The company that tried to threaten this frivolous lawsuit may have not even noticed, if it was some weird regex. And they'd either not complain, or have to spend a bunch of money tracking down the problem. Both are wins, in my book.

Blocking a URL is, in and of itself, not illegal, sure.

Blocking a URL that allows you to break a copyright-protection mechanism[1,2]? Well, that's not so clear. It's also unclear whether or not Admiral falls under the umbrella of a copyright-protection mechanism.

I really really really want EasyList to be in the right here, and be able to re-add the block without fear, but it's far from clear what all the implications of this are. I'm glad the EFF has stepped in to help them out; I'm content to wait for their opinion (or the opinion of an actual lawyer versed in the subject at hand) on this.

In the end, this is just another example of why the DMCA needs to go.

[1] Yes, you could say that this is bad design that the mechanism can be broken so easily, but that's not the point: the DMCA doesn't care how good or bad the mechanism is. If you break it, you're in violation.

[2] I suppose there's another point to be made: DMCA takedown notices are only for removing content or links to content that contain actual material where copyright has been infringed, not for removing circumvention tools.

> I really really really want EasyList to be in the right here

Well, they're obviously in the right :)

> and be able to re-add the block without fear

They could fix that by improving their OPSEC. So as to not be so easily threatened.

>Well, first of all, blocking a URL is not against the DMCA.

But you'd significantly help the legal case of those claiming it is by trying to obfuscate that you're doing so; they would argue in court it's an implicit admission you "knew it was illegal."

> they would argue in court it's an implicit admission you "knew it was illegal."

So you'd argue in reply that although you maintain that it's legal, you knew that it'd likely be something that bad actors would file frivolous suit over. Even when you win, being hauled into court is incredibly disruptive.

How about using ROT13 encryption for the list and then go after them if they circumvent your content protection scheme.

That's a funny thought, but the company making the complaint could probably prove that the ad blocker was interfering with their ads even without looking at the source code.

Moreover, the DMCA covers unauthorised access to copyrighted content, and the ad blocker cannot claim ownership of the ROT13'ed domain name, just as the domain name itself is not copyrightable.

In theory the ad blocker could use a more complicated scheme to obfuscate their source code, but I'm not sure whether they could combine a "do not de-obfuscate this code" rule with an open source / Free Software license.

This is a crucial point: the software is not blocking their ads, neither are the software's authors--the users of the software are. And the users have every right to not connect their computers to any other computer they please.

It's interesting to compare this to Second Amendment arguments. Do ad blockers block ads, or do users? Do users have a right to keep and bear ad blockers? Of course it's silly, and ad blockers are passive tools, but there are some striking parallels.

Not looking up a domain name cannot constitute circumvention.

Imagine a DVDCSS-like system that used remote servers to convey permission and defaulted to ALLOW. Would users who unplugged their DVD players from the Internet be guilty of circumvention? Now imagine that DVDs for said player were handed out freely on the street, stuffed into people's mailboxes, etc. Would people who played those DVDs without connecting their players to the Internet be guilty of circumvention?

That's the same thing, in principle, that's going on here. Claiming that it's circumvention (whoever makes that claim; I don't know if you are) is preposterous. This is obviously an abuse of the DMCA (not hard to do, considering the DMCA itself is an abuse, but I digress).

The claim is about copyrighted material thus DMCA, right? the only reason that string appears is for matching. The intent is for identification, not stealing someone else's copyrighted material. If there's a better way to match than comparing to a literal copy then we should do that. Ideally, one regex that matches all offending domains and no others.

They're not claiming copyright on the domain name. They're saying that by blocking it, they're violating the anti-circumvention clauses of the DMCA.

Since when does the anti-circumvention section of the DMCA have anything to do with the notice-and-takedown section of the DMCA?

Does it really matter? If they cannot send takedown notice they still are allowed to sue Github so Github might want to remove the offending code rather than enter a legal battle with unclear consequences.

The admiral website has a copy of a notice [1] if you are interested.

[1] https://blog.getadmiral.com/dmca-easylist-adblock-copyright-...

It doesn't, legally. It does in this case though, because GitHub says to use the same mechanism for takedowns and anti-circumvention requests.

Oh, that's way more interesting. So they have standing? I can see the argument that altering the execution of the program sent to the users computer is a DMCA violation (i vehemently disagree, but i can see it). But i don't think they didn't actually wrote the page that's delivered to the user.

I'd imagine it would technically need to be the publisher or the agent that took legal action. This was clearly an experiment though. Expect much more widespread use and, I'd assume, a court case soon.

We wish they claiming copyright on the domain name.

In that case, we are legally require to update all DNS servers' entries to remove that name permanently. :-)

Or alias it to 0.0.0.0 !!!

Except it's not the list which is blocking it, it's the browser plugin...

so use legal pedantry?

instead of blocking requests, replace the domain name with something funnily invalid, with a play on words on each original domain. then in case of any dmca, claim satire fair use.

it would make patchs review much more fun too!

The DMCA request itself seems to be here: https://github.com/github/dmca/blob/master/2017/2017-08-02-L...

I've done a bit of research, now. You can trademark a domain name, but it appears they can't be copyrighted. I am pretty sure the DMCA is silent in regards to trademarks.

Hmm...

To reply to myself, I need to first state that I am not a lawyer. I have, however, taken a number of courses on both law and procedures. Please keep that in mind.

I have also now spent more time on this than I'd expected.

One of the DMCA provisions, is that (as others have mentioned) that software to circumvent copyright is also prohibited.

I do not believe that EasyList meets the legal definition of software. It's not software, I don't believe. It is a list used by software. Basically, it is a configuration file. By itself, it performs no functions.

Its pretty much a 'dumb' plain text file. It is not executable, in and of itself. By itself, it does exactly nothing except take up space.

Computer software is defined in 48 CFR 2.101 and, unless my reading is incorrect (and it may be), this doesn't enable a program to be produced, created, or compiled.

I can find no rulings on this subject, however.

I am not a lawyer, this is not legal advice, and you should check with a qualified legal professional in your jurisdiction before acting.

That said, this does make for a potentially interesting case. It's probably a good thing to get some decision handed down. That and, well, it'll be pretty easily circumvented regardless of potential rulings.

By itself, any software performs no functions. Software is just instructions, and a config file is, too, just instructions. Sure, a difference is whether it's instructions for hardware or instructions for other software, but that doesn't sound material to me. Especially when hardware can be emulated by software.

However, circumvention tools (software or otherwise) require suing, not merely issuing a takedown notice, as another commenter pointed out.

I'm not sure it meets the definition of a circumvention tool, which appears to be a reference to 'computer software.' As in, the legal definition for such. The courts use a specific definition, found by the entry in the above reply. The few cases I found made use of the specific terminology.

IANAL :-)

>ads themselves could be the “copyrighted content” in question

Ok. We do not want to copy your add. We just want to get rid of those by putting them in a filter. How on earth this can come under DMCA?

Reply on news.ycombinator.com