Hacker News Reader

Comment by javagram | Hacker News Reader

I was going to say this isn’t a big deal but copying and uploading the libraries is actually illegal (copyright violation) and users likely can’t even consent to this even if it is in the Facebook ToS as many android phones contain proprietary libraries not licensed for redistribution.

The creators of those various libraries should have a valid legal case against Facebook here, if they want to exercise it. I doubt any users are being harmed by this but it’s a violation of the software creator’s rights.

View on HN

Some older android devices running newer lineage/AICP/etc builds include a few libraries I wrote (in their entirety) for compatibility of old vendor prebuilts with new android versions - libdgv1 & libdmitry. Maybe I should C&D FB for laughs?

Yes please!

Absolutely!

Are they closed source? I.e. does facebook not have a license to make copies of them?

source avail != anyone can make copies of the binary

Sure, by closed source I meant "not licensed under a typical open source license that gives you that right" rather than "I literally can't find the source via google".

Even with a “standard” open source licence the copyright notice probably isn’t being included in the upload making it a violation of most licences.

Go for it bud!

Edit: CANCEL MY KNEE-JERK REACTION TO A KNEE-JERK REACTION! A few tweets down (good [deity] twitter is a terrible way to transmit information, this is why I don't generally bother with it) she does say the full library is sent.

--------------------

> copying and uploading the libraries is actually illegal (copyright violation)

That isn't what is happening here - the headline is misleading.

Further into the tweet (FFS, it is a tweet and people aren't reading it all before reacting!) it clearly says "It periodically uploads metadata of system libraries to the server".

Basically that means they are sending and storing what versions of what things you have, not the code or other data in the libraries themselves. I'm pretty sure there is no reasonably copyright on the name and version number of a library in this context.

If it is being done for fingerprinting purposes then there might be an unreasonable tracking claim by the users, but not the library copyright holders.

The less worrying explanation is that it is being used for problem analysis: if a new version crashes a lot but only on devices with a specific version of a specific library, that makes tracking down the bug and implementing a workaround or fix much quicker. Of course this is facebook so if it is for the issue analysis (which it almost certainly is) but can also be used for fingerprinting as well, you can bet your bottom dollar that it will be used for fingerprinting as well.

Even further into the tweets it says:

"Facebook can upload the entire files of all system libraries to their server through their Android apps"

and

"I found they have already collected metadata of 2233 system libraries from my phone, in which 1162 system libraries are pending to be uploaded"

So they've already uploaded the metadata and are in process of uploading the whole files.

Are you sure it’s not the metadata that is pending to be uploaded?

Or the person misspoke.

What about finishing the thread? https://twitter.com/wongmjane/status/1167463077748436993 seems to imply entire files are uploaded.

It appears, that FB app indeed uploads copies of specific system files: https://twitter.com/wongmjane/status/1167463077748436993

At first glance, the amount of damage being done is close to nil — even if they reverse engineer received files to steal trade secrets therein (lol), it is hard to pinpoint specific amount of harm, dealt to the copyright owners.

But actually... why are Facebook people doing that? If I were to wager a guess, Facebook needs those files to create exact copies of user systems to debug. In other words, they are trying to save up on buying real devices for their test lab! Using "pirated" copies of libraries to spin up testing VMs is most likely cheaper than owning lots of real smartphones with all available firmware versions. And also illegal.

I wonder if they gauged possibility of being sued for this along with possible legal expenses and found that it is still cheaper than buying those devices themselves.

> copying and uploading the libraries is actually illegal

Is it through?

If I'm uploading a library to virustotal to check if it's a known piece of malware, am I breaking the law if it was clean?

I seem to remember a case where files were being uploaded to a server where they were only retained in memory and that qualified as a copyright violation, but I'm having trouble actually finding it.

There’s a good discussion of the legality of RAM copies here http://digital-law-online.info/lpdi1.0/treatise20.html

Note that there is an exception for such a copy when it’s necessary to run the program, I believe this exemption was added because otherwise running an executable on a personal computer would have been a copyright violation.

https://www.copyright.gov/title17/92chap1.html

> a) Making of Additional Copy or Adaptation by Owner of Copy.— Notwithstanding the provisions of section 106, it is not an infringement for the owner of a copy of a computer program to make or authorize the making of another copy or adaptation of that computer program provided:

> (1) that such a new copy or adaptation is created as an essential step in the utilization of the computer program in conjunction with a machine and that it is used in no other manner, or

> (2) that such new copy or adaptation is for archival purposes only and that all archival copies are destroyed in the event that continued possession of the computer program should cease to be rightful.

That must be what I was thinking of, thanks!

In the US there is a legal doctrine called fair use, which limits the extent of copyright. There are a number of factors but one of the most relevant here is the purpose and character of the use. If you're using the work to create an analysis of it, that's often covered under fair use as it is not a simple reproduction of the original. (not legal advice).

There are numerous exceptions to the exclusive right to copy works of authorship, of which Fair Use is only one case, actually an "affirmative defence" (that is: not a preclusion to civil or criminal proceedings, but a defence which may be presented), based on a four-part test.

There are additional excemptions, including copying which is required in the normal use of software, and possibly other information, on electronic systems. Whether copying to a malware-scanning service may or may not be included in that, though it would seem a fair argument that it should be (transformative, doesn't impact market, does affect the whole work, purpose is constructive and not otherwise served, context is specific to the nature of the work).

Not under US Copyright law, but that's because you have a licence to the software which means you have the fair use right to take this security measure.

Absent a rather dubious user agreement allowing Facebook to copy all the data off your phone, Facebook does not have that fair use right. Nor is it likely even remotely ethical to be doing this without explicitly notifying the user. So, illegal and unethical, but I guess unless some PR firm is paying the news media to be outraged about it, they're not likely to care.

> The creators of those various libraries should have a valid legal case against Facebook here, if they want to exercise it.

Perhaps, but sadly, I don't actually foresee vendors wanting to exercise that right. From a business perspective, why bother?

From a business perspective, why bother?

Maybe in jurisdictions like the US, where the copyright lobby has been very effective in getting aggressive anti-piracy legislation with huge penalties enacted, the statutory damages alone could be astronomical? Since Facebook could still afford to pay them, it might also offer to settle for a very worthwhile sum without even the risk of going to court.

I'm generally not a fan of hugely disproportionate penalties for copyright infringement, but this isn't some normal person falling victim to opportunist lawyers engaging in a form of barratry, this is a huge company with its own legal team who should know better than to wilfully infringe copyright.

The owner of a specific library might or might not.

They could potentially have ... friends ... who would have an interest in seeing a case brought, though.

(And since Bollea, barratry seems acceptable.)

Looks like it's only uploading the name and a hash.

Read down the twitter thread, looks like they can/are uploading the contents of the files too.

Video game anti-cheat software has done this for ages.

Reply on news.ycombinator.com