Hacker News Reader

Is your position that centralized services can out survive distributed ones? Because user IP's are less observable? The past 25 years of cyber/cypherpunk software and legal battles say otherwise. Decentralized solutions outlive centralized ones not because there is "no one to shut down" it's because there's too many people to shut down. Enforcement processes don't scale, especially when it comes to speech.

>Centralized and non-distributed video platforms have one critical advantage over distributed

A more compelling argument:

>>You will not find a solution to political problems in cryptography. > > >Yes, but we can win a major battle in the arms race and gain a new territory of freedom for several years. > >Governments are good at cutting off the heads of a centrally controlled networks like Napster, but pure P2P networks like Gnutella and Tor seem to be holding their own.

https://www.mail-archive.com/cryptography@metzdowd.com/msg09...

You're thinking about this from a pirate's point of view: "they can't sue all of us", and that's entirely correct. But it's also not what I'm worried about. People who know they're breaking the law and don't give a shit will take steps to protect themselves from legal prosecution. People who just see "oh hey free movies" will wind up using insecure services that get them lawsuits. This is what happened with people who used Gnutella and KaZaA back in the 2000s, or people who pirated fake porn from Strike 3 Holdings, or people who use Popcorn Time now. The more accessible an infringing service is, the more likely people will get legal nastygrams in the mail.

Imagine you're an average Internet user, you follow, say, a YouTuber that reviews movies. They say that their latest review isn't on YouTube, but on their website. You go there, watch the review, laugh, and move on with your life. But then you get a nastygram in the mail a week later. Turns out that particular YouTuber didn't have great copyright hygiene, and used an unlicensed music clip. Them moving it to PeerTube means that instead of their video getting taken down, the copyright holder has to sue the swarm - and they do. You get caught in that dragnet, and now you have a nice fat $10,000+ settlement you have to pay for watching a video, because PeerTube puts you in the chain of copyright liability.

>You're thinking about this from a pirate's point of view

I'm thinking about it from a cost / enforcement point of view.

PGP survived outright, explicit ban by the most powerful government with some of the most powerful cryptanalysis agencies in the world at the time not because "a company hid people's IPs". Your argument is: some users will be attacked for using applications for which lawyers have cheap attack costs/enforcement. It does not follow that, some agents being unable to survive their strategy results in an alternative strategy dominating.

Let's be real: legal systems that have the power to demand IP records subpoenas also have the power to demand logging, so you're argument that white-market companies can somehow provide anonymity, or shielding from culpability, to users doesn't hold water. One might interpret the outcome of the PGP battle happened because of some advanced concept like free-speech rights but the unavoidable reality is, attackers have limited resources and if the benefit is less than the attack costs, the attack won't survive.

these days people get music from spotify ($$) and similar services, not from torrents ($free). I'd say centralized won.

When I did torrent, I would frequently get warnings from content owners by way of my ISP, so at least identification of offenders seems to have scaled. They didn't take me to court personally, but some other end users were compelled to settle, and even the threat of punitive measures should be enough to discourage many others. So overall I don't agree with your characterizations.

Spotify still isn't accessible where I live, so music piracy is live and well.

On the other hand steam is so game piracy is almost nonexistent.

It's mostly about convenience, since centralized app if designed with users in mind can be more convinient.

More and more people are pirating tv shows aswll, since pirates have the only solution that has all the content in one place.

>these days people get music from spotify ($$) and similar services, not from torrents ($free). I'd say centralized won.

My point is less about what content delivery systems are most prevalent at the present moment, more so about which are more survivable. Protocols and physical media outlive centralized content delivery because they are more fault tolerant. One doesn't need the commercial and technical apparatus of Amazon Inc to pick up a physical book and read it. The market trades convenience for future performance default.

TCP/IP will outlive your national-post service.

It wouldn't matter if your IP is observable or not. It is not illegal in the US to download material even if you know the uploader did not have the rights to it. But uploading/sharing as in the case of peertube is illegal if the uploader did not have the rights

Source for this? I've heard it said a number of times but haven't looked into it. It makes sense, but I know many countries have laws about possession too.

"Copyright" means the rights holder has the following exclusive rights. The right to reproduce and make copies of an original work; The right to prepare derivative works based on the original work; The right to distribute copies to the public by sale or another form of transfer, such as rental or lending; The right to publicly perform the work; The right to publicly display the work, and The right to perform sound recordings publicly through digital audio transmission.

Someone uploading a file, or downloading a file on a peer to peer website that also involves uploading a file is violating a number of these rights. Downloading a file(not on a peer to peer site) is not a violation of any of these exclusive rights. This is analogous to an unauthorized public screening of a movie. The the person who displayed the movie without permission is infringing on the rights holder's copyright, the people who are watching are not.

The uploading (in a peer to peer sense) I've always found interesting. Because most of the time, a casual downloader who doesn't seed, but only uploads for the duration of their download, would actually upload very little. How much do they need to upload to be in violation of copyright? Does any part of the upload need to be convertable into part of the original work?

For instance, let's say the bittorrent protocol was altered such that instead of pieces, you're assigned random bits to upload that are never enough to be assembled into any part of the original file in human watchable form. Have you actually violated copyright if you upload some of these bits?

Eg what if you uploaded a single bit (a 1 or a 0). Clearly not in violation. How many bits do you need to upload to be in violation?

The RIAA has unsuccessfully tried to claim that "making available(for download)" is infringement. So there would need to be some amount of actual uploading to prove this as a civil case.

But even if you only seed while downloading it is likely even the relatively small amount uploaded would meet the legal requirement, the law does not require that you distributed a full copy of a particular work. Ultimately whether a specific amount would be enough would come down to the judge or jury.

Don't you have searchable law texts in US? This info should be a single Google search from you.

You can't find a negative value, or a lie, in a text search, which this is.

You should be able to find the section that covers the issue and literally just read if it contains the thing or not...

I am really curious what would happen if a case like this ever made it to court. Copyright law was designed when copying was a difficult and intentional act; how that computers are ubiquitous, that is very much no longer the case.

Sure, there have been lots of successful lawsuits against BitTorrent users, but the level of sophistication involved with using BitTorrent in the traditional way is high enough that it's pretty clear it's being used intentionally. But if you showed a jury what the purported infringement consisted of with a PeerTube video (clicking play on a video in a webpage, something that almost all of us do every day)... do you think they would convict?

If that ever did make it to court, and someone did end up losing a suit after playing a video, I would hope it'd make the news and that we'd get new legislation that reflects the reality of the internet today.

Copyright is a strict liability tort. That means considerations of intent or knowledge don't matter. The legal arguments for taking down a sophisticated BitTorrent piracy operation map one-to-one with suing individual PeerTube users.

There is a legal defense called "innocent infringement", but it's very limited. You have to be in a situation where it wouldn't be possible or reasonable to know about the copyright status of a work, not just be ignorant of the law. As an example of how fragile this is, merely putting the words "All Rights Reserved" on a work will generally prohibit defendants from using this defense. It also only disclaims statutory damages down to about $200, if the judge is okay with that. If the plaintiff can convince a court that you caused more than that in actual damages, then this defense won't do much, if at all.

In 2015 in Germany, popcorn time users received ~$1000 fines. The use is similar to peertube, many users were not aware these files were shared with other users as well but they were still in violation of the law.

I can't imagine this flying in the US

In the land of lawsuits? You really sure about that?

Yes I'm sure because these people clearly weren't intending to pirate anything.

>Centralized and non-distributed video platforms have one critical advantage over distributed: it's harder to sue users. That's because you'd have to first sue the host to get logs, which requires at least some legal adjudication of the merits of any underlying copyright claim.

In Germany at least as of a few years ago it was exceedingly common for people who seeded torrents of movies/tv shows etc to receive copyright infringement notices which were sent out on mass, which is why pretty much everyone used a VPN.

Not sure what exactly the legal situation was but I think they simply relied on third party services who would host/scan for copyright infringement, colllect a ton of IPs, then go to a court, and thus you pretty easily circumvent any individual issues because you just do it in bulk.

Don't burn me at the stake... but what if we could solve user liability with DRM? Hear me out:

What if all video was encrypted with DRM by default, and viewers/peers only shared DRM-encrypted data? This would still enable the biggest benefit of PeerTube: viewer/peer bandwidth sharing. But now we've (arguably) reduced the scope of 'publishing' -- for the purpose of legal liability -- to only those PeerTube instances that provide the DRM key. That is, just sharing the encrypted video data no longer carries the legal significance of 'publishing' it, because the data is useless without the key. Wield the media companies' own DRM as a legal shield to limit user liability.

Now to be clear, I'm not an attorney, so I'm not making any kind of legal claim, or saying that this is an argument that a court would find convincing. But I think there's a chance this could work out because I'm pretty sure this strategy where the DRM key is more protected than the video data is utilized in the video distribution industry today, and considered to be an ok solution.

If DRM is used, the encryption key itself becomes the unit of publishing. How keys are distributed between instances is not limited at all, maybe by default the key is shared with all the other instances in its federation. Also, now instances have an instant way to "unpublish" a video in case of DMCA: just stop sharing the key. And since no users share the key with each other, even if they are unaware of their instance taking down a video that they watched and are still sharing it, downloading peers still won't be able to view it.

This idea isn't perfect of course. All viewers would still need to connect to a central/federated instance to get the key, but compared to sharing the actual video data this is much more reasonable to scale. Also, getting access to DRM itself is still pretty centralized today, so it might take significant effort to implement.

What do you think?

DRM is unnecessary - what you're describing sounds like a variation on FreeNet, MUTE, WASTE etc. Contributory liability would still be present if movie companies could prove you were distributing encrypted copies of their films. The main problem I would foresee is swarm security. If you're sharing your videos out to a wide audience, then the encryption isn't going to help. Your adversary isn't a passive deep packet inspection filter, it's copyright owners joining a swarm through normal means in order to IP addresses of people who are distributing content.

The no-sharing-keys property isn't useful either. Presumably someone is going to want to archive PeerTube content (P2P swarms tend to archive poorly), which means modifying PeerTube or a browser to scrape keys. If an archivist can do this, so can a copyright enforcement bot.

What you would really want is something more akin to Tor, where both ends of each peer connection don't know who each other are. The way this works is by using multiple layers of encryption, so each link in the chain just knows where to send which packets of nonsense. You can do this today, actually, but BitTorrent-over-Tor is heavily discouraged as speeds are slow even at low hop counts. There's also the problem of accidentally leaking your own IP address over Tor. This is why, for example, most VPNs ship browser extensions that disable P2P features such as WebRTC.

Wouldn't I , as a user, have the same DMCA safe harbor as long as I stopped streaming the video if I were to receive one of those letters?

To have the DMCA safe harbor you have to submit a form at the copyright office and follow certain procedures. It's not automatic the way copyright itself is.

Yet another way that legislation creates monopoly-like pressures on the market, and makes it more difficult for smaller players to get in and compete.

Definitely sounds like PeerTube needs a discovery mechanism for users so you don't serve content out of certain jurisdictions.

The DMCA does not allow you to disclaim liability for your own infringement. It only covers specific kinds of contributory liability that other people do using your online service that you do not have actual knowledge of. This is fragile enough that having human curators prevents you from using your safe harbor for anything they touch. (See Mavrix v. LiveJournal)

What if some company decided they just wanted to bully you?

We’ve been there before:

https://www.afterdawn.com/news/article.cfm/2008/12/02/riaa_s...

https://betanews.com/2005/02/04/riaa-sues-deceased-grandmoth...

Remember a lot of people try these options because they post or watch controversial content. Now what happens when dissidents, or anti-dissidents, whatever all share their IPs with the world.

The privacy scare that Snowden brought to our attention is kind of abstract--"someday a different regime may use this data against me". But some lunatic who tracks you down because of an ideological dispute is a very real and physical threat.

> Distributed systems shift that legal liability directly to viewers.

For what it's worth:

France tried suing people using bittorrent to download illegally with the Hadopi law from 2009 to 2020 (it was ruled unconstitutional in May, because of a lack of judiciary oversight).

It cost between 5 to 10M€ every year, and resulted in only 87k€ in fines total. So not a huge success.

In America, we had a company whose business model was to make fake porn, upload it to BitTorrent, and then sue anyone in the swarm. It actually worked for a while - the only illegal part of this is that they lied about uploading the content to get around implied license arguments. (That and the fact that they made their lawyer drink himself to death, but that's not material to the scam.) There's other companies clogging up court dockets with similar infringement lawsuits against John Does to get access to expedited discovery. This shit is profitable enough that any video sharing service needs to either avoid legal liability for it's users or find a way to prevent copyright holders from gathering evidence from them.

Does it matter for the video sharing sites in the US? DMCA gives them a pretty good format - immediate block and forward the notice to the uploader and they're free of pretty much any responsibility.

Any CDN is bound to run into thousands of such issues, and yet they survive. What is the difference between tracing a video to a CDN and to a user? In fact, the former should be more straightforward to prosecute, as CDN’s IP is CDN’s, while a physical person is likely to share an IP with others behind the same router, no?

You're entirely correct, and that's why the DMCA notice-and-takedown procedure exists. It's the only way to disclaim contributory liability for copyright infringement as an online service.

An individual user watching a PeerTube video would not be able to do the same thing. The DMCA only protects against infringement liability that other people cause. If you watch an infringing upload, well, that's your liability.

Interesting. I also wonder how would the exact video can be detected, if the viewer serves it to other viewers over encrypted channel.

Edit: besides traffic being (hopefully) encrypted; let’s say someone files a takedown for video page X—if I am viewing a video from page X, and stream comes from peer A, how does a third party arrives at a conclusion that the stream coming from peer A corresponds to page X (presumably required in order to sue the physical person behind A)?

Encryption is useless in open peer-to-peer networks if you can join the swarm. Everyone in that swarm will fall over themselves to hand out legally-compromising evidence of their infringement. The idea is that "Peer A" in this scenario is actually a copyright enforcement bot logging evidence that you are sending it the infringing content. This is how BitTorrent copyright enforcement works.

In my example peer A is serving the video to me; a conclusion that I am serving the stream anywhere would be unwarranted and must be easy to debunk in court.

You have it backwards. You're Peer A in the example. The copyright owner joins the swarm, pretending to be a normal peer, and starts downloading the file from participants to prove that an infringement occurred.

This works because most P2P systems have a way to enforce that swarm participants contribute upload bandwidth, which also puts them at risk of a copyright lawsuit. PeerTube specifically uses WebTorrent, a WebRTC-tunneled version of BitTorrent, so it has tit-for-tat rules. Someone using a modified download-only client in the swarm will get a terribly slow experience unless the swarm is absolutely massive.

Right, makes sense.

Well then, there’s still a major difference from BitTorrent: the fact that as soon as I stop watching and close the tab, the video is gone from my system and I’m no longer “distributing” it.

When I’m watching a video for the first time, I have no way of knowing it’s infringing. Once I’m finished—subpoena all you want; all I’ve got to do is remember to not watch that particular video ever again.

I could be in trouble if I’m seeding the video on purpose, presumably if I’m its creator.

Which on balance could actually be more reasonable than status quo: I reckon %CORP% would be compelled to do their homework before going after some poor individual. If it turns out to be a frivolous lawsuit and the work is fully original, that’d actually backfire—something they clearly don’t have to fear with their shotgun automated DMCA takedowns and overly zealous detection algorithms.

The stakes are higher for producers, but a legitimate creator confident in their work may well prefer that to the uncertainty and constant fear that %PLATFORM% mistakes your original work for something random and pulls the rug from under you.

I think there’s a parallel to be drawn between YouTube and Amazon. Apparently, the latter is leaking legitimate sellers and becomes a haven to fly-by-night shady sellers due to its ease of setup but unpredictable enforcement[0]. Not unimaginable YouTube will trend the same way—remain the platform for algorithm-favored provocative, controversial, hateful videos that tread the line of legality, and lose authentic artists.

[0] https://news.ycombinator.com/item?id=24177200

How much has to be shared before it's a copyright infringement, ie three sequential bytes, three non-sequential bytes?

Or, alternatively, you just stay connected to a VPN when you browse the web, and stop worrying about this aspect. (yes, I know, VPNs are not the silver bullet they are advertised to be, but in this particular case they are helpful).