Hacker News Reader

Comment by eminence32 | Hacker News Reader

Quoting from the linked torrentfreak article:

> If you commit or post content to this repository that violates our Terms of Service, we will delete that content and may suspend access to your account as well

My reading of this is that github wants to stem the flood of garbage pull requests to their [dmca](https://github.com/github/dmca/pulls?q=is%3Apr+is%3Aclosed) repo, which I guess is probably reasonable.

I don't quite see where github is banning certain commit hashes or tree hashes on sight.

I certainly respect the authors desire to not publish their repos to github (and indeed one of the nice things about git is how easy it is to self host). And I can understand not wanting others to fork the repos to github (due to objections about the company itself), but I'm not sure how I feel about adding deliberate boobytraps to repos that seems to be purely punitive.

View on HN

It's currently posssible to make a PR to the github dmca repo that merges youtube-dl, and so violate their TOS.

When you make that PR, you do not transfer any of youtube-dl to github. Their repo already has those objects.

So all you have done is pushed a repo containing a specific hash, which is now a TOS violation, in that specific case at least. I wrote "Certain commit hashes are rapidly heading toward being illegal" because of that specificity.

Thanks for clarifying. I do understand that these specific hashes are effectively forbidden in the dmca repo.

Are you aware of any specific instances where the presence of youtube-dl hashes in other repos have been found by github and used as the grounds for disciplinary action? That would be noteworthy indeed.

So, in addition to illegal primes, we are getting a collection of illegal random numbers?

(I wonder when illegal transcendental numbers will become a thing.)

What are the random numbers? Commit hashes are deterministic and based on the commit contents

I believe they were using "random" to mean "assorted" (which is perfectly cromulent).

edit- thanks commenters for the correction!

Git commit hashes are indeed deterministic, though it depends on the inputs.

From StackOverflow [0]:

Git uses the following information to generate the sha-1:

* The source tree of the commit (which unravels to all the subtrees and blobs)

* The parent commit sha1

* The author info (with timestamp)

* The committer info (right, those are different!, also with timestamp)

* The commit message

[0] https://stackoverflow.com/a/34764586/293064

Git commit hashes _are_ deterministic. Run `git cat-file -p <hash>` on your two hashes. The timestamp in the committer field will be different. That is why the hash changed.

It's deterministic, you've just changed the inputs. The "committer date" is usually excluded from logs so you don't see it, but it's the only missing input. Here is a demo:

    $ git rev-parse HEAD 
    78d66a4f169fec9cb9b3252f7a22bb020e967cd2

    $ git log HEAD      
    commit 78d66a4f169fec9cb9b3252f7a22bb020e967cd2 (HEAD -> master)
    Author: XXXX
    Date:   Mon Nov 2 20:44:04 2020 -0500

        temp2

    $ git reset --soft HEAD\^

    $ GIT_COMMITTER_DATE='Mon Nov 2 20:44:04 2020 -0500' GIT_AUTHOR_DATE='Mon Nov 2 20:44:04 2020 -0500' git commit -m temp2
    [master 78d66a4] temp2
     1 file changed, 0 insertions(+), 0 deletions(-)
     create mode 100644 b

    $ git rev-parse HEAD
    78d66a4f169fec9cb9b3252f7a22bb020e967cd2

Most so called “illegal primes” involve encoding some information (eg. encryption key, that is an random number) as a prime number with the idea that transforming the information into prime makes it into “mathematical result” or something like that. It is intended as an argument why there should not be any “illegal data” which I find absurd because the idea that such transformation is somehow relevant is even larger nonsense that the idea of making some kinds of information “illegal”.

That's not true. They are illegal primes because encryption keys are just pairs of prime numbers used for public key cryptosystems, so posting the primes that make them up is sharing the encryption keys and thus against DMCA. There is no transformation involved - it is not just encoding normal illegal content into a numeric form.

>One of the earliest illegal prime numbers was generated in March 2001 by Phil Carmody. Its binary representation corresponds to a compressed version of the C source code of a computer program implementing the DeCSS decryption algorithm, which can be used by a computer to circumvent a DVD's copy protection.[1][2]

https://en.wikipedia.org/wiki/Illegal_prime

> so posting the primes that make them up is sharing the encryption keys and thus against DMCA

Except it's not.

You can post the numbers alone, without including information (directly or by reference) to the application about which information is banned, all you want.

This is also my understanding, but certainly not what RIAA and folks do want because this loophole allows for much more efficient distribution of those illegal numbers. Therefore they are motivated to overblock, whether the number is accompanied with instructions or not.

If you distribute a number that represents something you're not allowed to distribute, without announcing this connection, you're not really making that secret information available to anyone. There's no loophole there.

You need to somehow include information on how to use the number, which is arguably easier to pull off, but still doesn't make it legal, just harder to find out.

How about if we first standardize a universal, generic encoding scheme which produces numbers? Then if you saw a random number somewhere, you'd know to simply try decoding it with this scheme to see whether it succeeds.

I didn't mean that a mere dissemination of numbers is illegal; rather, RIAA will try to make illegal and will penalize (not yet illegal) dissemination for any means possible exactly because of that. This has a huge implication both for who don't want get in trouble and for who want do the illegal thing.

So, if I understand correctly you could do the following:

1. Someone somewhere creates a numbered list of primes (so 1=1,2=2,3=3,4=5,5=7,6=11,7=13,8=17, etc etc) 2. You refer to "the [N]th prime" with a vastly smaller number, and people could fetch it from the list of primes. 3. They could theoretically ban the number N?

>with a vastly smaller number

Fun fact, there are a _LOT_ of prime numbers. There are about 10^22 prime numbers smaller than 10^24, so about every 100th number is prime. The ratio decreases the higher you go of course. The vastly smaller number is actually just a few bits smaller :)

If you could do that reliably, you'd obviate all compression algorithms. Unfortunately, primes don't compress like that.

Historically shared DRM keys are typically symmetric encryption keys, not asymmetric ones, and thus not primes. I am not aware of any instances of an "illegal prime" that was prime because it was the private part of an RSA-based DRM cryptosystem. As far as I know, all of them were either encoded as primes deliberately, or just coincidentally prime.

Edit: except for this one, I guess. This one wasn't about DRM, but rather just a locked down device. TI sent bogus DMCA notices for that one, but as far as I can tell there is no solid legal theory under which those primes were illegal, and nobody ever got sued, so we can file this one under "manufacturer upset they no longer control their users' devices throws a legally meaningless fit".

https://en.m.wikipedia.org/wiki/Texas_Instruments_signing_ke...

There are some encryption schemes that use raw primes as their keys.

But the first popular 'illegal prime' was a gzipped code that would defeat the DRM of DVDs. See https://en.wikipedia.org/wiki/Illegal_prime

It's what happens when computer programmers try to pretend the law is an algorithm... the law doesn't work like computers do. To a computer, every sequence of bits is the same as another sequence in the same order; the law, on the other hand, cares about the source of the bits.

There is a great classic essay describing this called "What color are your bits?"

https://ansuz.sooke.bc.ca/entry/23

There already are some illegal transcendental numbers. For example, you can't publish the transcendental number which is the circumference of a circle whose diameter in metres is 485650789657397829309841894694286137707442087351357924019652073668698513401047237446968797439926117510973777701027447528049058831384037549709987909653955227011712157025974666993240226834596619606034851742497735846851885567457025712547499964821941846557100841190862597169479707991520048667099759235960613207259737979936188606316914473588300245336972781813914797955513399949394882899846917836100182597890103160196183503434489568705384520853804584241565482488933380474758711283395989685223254460840897111977127694120795862440547161321005006459820176961771809478113622002723448272249323259547234688002927776497906148129840428345720146348968547169082354737835661972186224969431622716663939055430241564732924855248991225739466548627140482117138124388217717602984125524464744505583462814488335631902725319590439283873764073916891257924055015620889787163375999107887084908159097548019285768451988596305323823490558092032999603234471140776019847163531161713078576084862236370283570104961259568184678596533310077017991614674472549272833486916000647585917462781212690073518309241530106302893295665843662000800476778967984382090797619859493646309380586336721469695975027968771205724996666980561453382074120315933770309949152746918356593762102220068126798273445760938020304479122774980917955938387121000588766689258448700470772552497060444652127130404321182610103591186476662963858495087448497373476861420880529443

It's the DVD decryption key one of the first "illegal prime" https://en.wikipedia.org/wiki/Illegal_prime

It's not just the decryption key. It is a gzip file containing the full source code of the decoder!

Is illegal prime multiplied by 2 illegal too?

I don't know! Maybe the MPAA's lawyers can't invert that obfuscation function :-)

Law operates under the assumption that an idea called color exists. Computer scientists, for their job, generally must assume it does not. Color is a sort of Metadata property of something (an object, data), and in this case, the color of the illegal number pertains to how it was derived (where it came from). If the number is 'tainted' in its origin by having been influenced somewhere in its past by the offending illegal number, then it too can be illegal. A good explanation for this is below:

https://ansuz.sooke.bc.ca/entry/23

tl;dr yes. An illegal number multiplied by two is illegal. Randomly generating that number is not. The illegality is not strictly a property of the number itself, but it's color.

So too for addition then. An illegal number + 1 is illegal. An illegal number - 1 is illegal.

Therefore all numbers are illegal.

I believe you misunderstood my comment. Numbers who's origins are tainted by an illegal number can be illegal. Numbers who's origins do not have taint from an illegal number are not. It is not the number that is illegal, it is it's color. How it came into being, it's history, a permanent invisible mark that it carries with it, and transfers to whatever it touches.

You can't just dodge color by mutating the number via mathematical operations, color doesn't work like that. You can only get rid of the taint by using a fresh number without taint.

Yes.

If there's an illegal number X and I give you a number Y with the intention that you obtain X from it by some transform then Y is also illegal because I "tainted" it when I did the original transformation from X.

If I just need Y (or X) for some operation that's not related to the "illegality" then those numbers are not illegal.

The essay that droffel linked to explains this very well.

> Numbers who's origins are tainted by an illegal number can be illegal [..]

Two thoughts:

1. This appears to show a complete disregard for basic mathematics...

and

2. Do lawyers ever wonder why people make jokes about them?

It doesn't disregard mathematics at all. Quite the contrary — it separates mathematics from the intent of the mathematician.

The number itself isn't illegal, because it can come from any number of contexts. What's illegal is wilfully working towards generating that number while knowing its purpose as a key. It's just the principle of Mens Rea at work.

What about I randomly generate a number, add it to the illegal number to get a result. Is the resulting number illegal or not? (Thinking about it mathematically, the resulting number's distribution isn't really affected by the illegal number - Maybe we can practically find something by taking a lot of generated numbers and analyzing the apparent distribution)

Another idea is to generate a random number and multiply it with an illegal prime. If the illegal prime is a sufficiently large number; we can extract the original illegal prime with very high confidence by just finding its prime factors and picking the shortest one.

If you distribute a derivative of an illegal number, that derivative has the color of that illegal number. Whether anyone notices is a different question. The moment one of the intermediate steps involved the illegal number, the following steps gained it's color.

please explain; thanks in advance

this is one of the leaked DVD encryption keys (expressed, of course, in very funny way), which is used since eternity by pirats for DVD decryption.

Used to be illegal to have it in US and other countries, don't know status now

Not only by pirates. As a Linux user, I need it to watch my legally bought DVDs since there is no viable other way.

> this is one of the leaked DVD encryption keys (expressed, of course, in very funny way)

It's actually even cooler: store this prime in base-2 and interpret it as a gzip file, and it'll gunzip to a full working DeCSS (DVD decrypter) source code in C :-)

Excellent. Can we now please also have an illegal (proper) surreal number? ;)

No; by law there must be a set of illegal numbers. As a proper class the surreals are simply too vast to be outlawed.

I appreciate that it's in metres. Does it need to be?

Nope, pi has no units.

But circumferences and diameters have units (of distance)

https://primes.utm.edu/curios/page.php?number_id=953

This is a bit ridiculous. Every movie file or image file is technically just one long number. Or if you take a book and convert each character to Ascii and make that into one long number. It's all about how you interpret the number. While the fact that the DVD decryption program when arranged as a number happens to be prime is cool, the fact it is "illegal" is a dubious claim at best.

Ha! - but I don't think it is physically possible to publish a transcendental number, is it? (Nor any other non-rational real?)

Depends what you mean. If it can be specified by a finite sequence of operations, I’d say it’s publishable.

If you’re going to restrict “publishing” to binary fixed point, arguably 1/3 is unpublishable.

The real (no pun intended!) distinction is between computable and noncomputable reals, as first identified by Alan Turing in "On Computable Numbers".

The integers are a subset of the rationals, which are a subset of the algebraic numbers, which are a subset of the computable numbers, which (most mathematicians would accept) are a subset of the reals.

There are lots of subtleties about this. In fact Scott Aaronson just started a series that is in some sense about some of those subtleties, which I hope to be able to understand some day!

> If it can be specified by a finite sequence of operations...

Hmm... are you saying that, for example, pi is the one-step sequence of operations of dividing a circle's circumference by its diameter? But first, you have to get both those values...

An algorithm for computing pi would be a finite sequence of operations. Even if the operations include "do an infinite loop".

Pedantically enough, by formal definitions algorithms have to finish. See eg https://en.wikipedia.org/wiki/Algorithm

In practice, speaking informally, people talk about programs that may run forever all the time.

People have developed lots of theory around those as well. Of specific interest here would be the class of programs that provably only runs for a finite time before it produces the next bit of output.

You need that latter class of programs to talk about producing digits of pi, or running the main loop of an OS.

Then, I would say, you would be publishing a fact about pi, not pi itself. These facts do not yield pi in any finite time.

There are simple formulas for computing Pi. For example Pi can be computed to arbitrary precision as 4 * (1 - 1/3 + 1/5 - 1/7...).

I'm confused by how you could specify a transcendental number using a finite sequence of operations. It's sort of in the very definition of transcendental numbers that you can't.

You could just write down a Turing machine.

That captures all of the transcendentals we care about. The remainder (to be fair, almost all of them) aren't computable at all, even in principle.

Gödel encoding expands your options considerably.

Primes are very common. So as long as you have a few bits to fiddle with in your file, you can probably make it a prime very quickly.

Given an arbitrary stopping point x, you have approximately x / log x primes between 1 and x.

In other words, for a file of length n, you have to try about O(n) slight variations to find a prime number.

A nice example are the drawings using prime numbers. For example see

"The Trinity Hall Prime - Numberphile" https://www.youtube.com/watch?v=fQQ8IiTWHhg

"The Emerging Art of Drawing in Prime Numbers" https://www.popularmechanics.com/science/math/a28649996/the-...

Every file stored and processed by computers is just a really big number. Information theory seems to agree. It's all just bits.

When framed this way, so many laws become ridiculous. Copyright is about establishing a monopoly on numbers. It's illegal for normal people to know certain numbers because they represent classified information. People go to jail because of numbers stored in their hard drives.

Maybe. Numbers in real life — the domain of the legal system — tend to be either for counting or measuring.

Numbers that are huge and precise are data, information, something quite different.

The thing with illegal primes is that they are small enough to really feel like numbers rather than a concatenation of things forced to look like a number (“the shape of my bedroom is 201809!”)

What is the ontological status of "the smallest number which is outside the domain of the legal system in this sense"?

I don't think it exists because you can always copyright some piece of self-created digital art so that it hashes to the number (if the hash maps to enough bits to represent that number).

I think there is a biggest number though, and it should be higher than 64bit-1 because your processor would otherwise occasionally handle illegal numbers, thereby (probably) making it illegal as well.

My point is rather than if we agree that large-enough numbers can be data, then there is a number at which they start to be data, N say, then "all numbers greater than or equal to N are data" uses N not as data, but as "counting and measuring". So this distinction is self-contradictory, so incoherent.

You could just say "greater than N-1" to avoid this problem, so this doesn't seem like a very strong argument.

I think the better point to make is that the law will never actually produce a concrete N, preferring to leave itself vague so that it can criminalise things at a whim. This is what makes it a farce and why such notions need to be purged from the law.

How can you subtract 1 from data?

You don't. That was subtraction on a meta level. You name the largest non-data number instead of naming the smallest data "number".

the fact that you cannot identify the exact number of sand grains that make a collection into a heap of sand does not mean heaps of sand do not exist

At least in the case of sand you can give examples of numbers of grains that don't constitute a heap, and numbers that do. And numbers smaller than the former will be non-heaps and numbers larger than the latter will be heaps.

For natural numbers, the lawyers seem unable to do even that. Sure, they might want to name some of the "illegal primes" mentioned in this thread as examples, but what will they say about those numbers +1? They're gonna paint themselves into a corner of ridiculousness nomatter what.

N = 10^85

You’ll know it when you see it.

> Numbers in real life — the domain of the legal system — tend to be either for counting or measuring.

What does "in real life" mean? You and your brain presumably exist in real life. If you brain can construct any natural number, then do they not exist just as much as the ones that happen to appear as counts of rice or the price of beer?

I think any number whose information density is more than could be memorized becomes data, and no longer counts as a real life number.

One might stretch the definition to allow numbers that you could read on a postcard in one go to still count as numbers, but it’s a big stretch. If there’s a more understandable representation of the number — especially if there’s a more understandable representation — then it’s data and not a number.

Beyond a certain amount of information content numbers just become data. Certainly at the point where counting the number of digits is non trivial. (There are notations to make magnitude easier to see, but these purposefully delete information content.)

And you get into pretty absurd situations: Whatever the status quo on this matter is, I think we all agree that the integer 0 is in the public domain. And also the following algorithm: (0) let n = 0. (1) Increment n. (2) Go to (1).

But this will, in time, generate every copyrighted material.

Indeed. The only possible conclusion is that all copyrighted material already exists since all numbers already exist. Artists are just people who discover interesting and really big numbers through the convoluted process of "creation". After the number is found, all bets are off.

It's fun to think about, but any digital file is just a big long number. And prime numbers are surprisingly common.

So finding a variant of one offending digital file that's also a prime is a rather straightforward process.

What fascinates me more is all the illegal bits people put into the bitcoin block chain; and how bitcoin people deal with that.

Especially since you can make random looking strings illegal after the fact:

I have an illegal file A. I produce a random binary file R of the same size as A. I publish (R xor A) and R in two different venues, both mathematically-perfectly random files on their own. But together, they produce illegal file A.

How do the bitcoin people deal with it? I thought they just accepted it as a fact of life?

The blockchain has been illegal for years, hasn't it?

Not sure. See https://www.abc.net.au/news/2018-03-21/bitcoins-blockchain-h... for an article.

That seems quite naive. I don't think "I just accepted child porn had to be on my computer as a fact of life." would go down well in court.

It looks like they didn't solve it and just left it there. So I'm afraid a lot of bitcoin users are that naive.

I find those pull requests absolutely hilarious, but my sense of humor is lowbrow childish.

https://github.com/github/dmca/pull/8210

https://github.com/github/dmca/pull/8207

https://github.com/github/dmca/pull/8203

https://github.com/github/dmca/pull/8202

DMCAs would be much better served OwO'ified.

https://github.com/github/dmca/pull/8214/commits/65ec4b0dc45...

It is wonderful to see GitHub being a victim of their own refusal to implement a feature to disable pull requests on a repo.

> I'm not sure how I feel about adding deliberate boobytraps to repos that seems to be purely punitive.

It also feels like it would violate the license of the repository. I see that one of the author's repos is LGPL [1], which allows redistribution of the source. Restricting how that source is distributed seems to me like a violation of that license, if not in letter at least in spirit.

(Of course, it goes without saying that I'm not a lawyer, which is why I said it feels like a violation.)

1: https://git.joeyh.name/index.cgi/haskell-mountpoints.git/tre...

Would you please kindly delete your comment before corporate lawyers get any funny ideas.

Can’t delete a HN comment if there is a reply to it :)

You can't force somebody else to host your GPL code if they are not a party to the license.

He's not restricting GitHub from hosting it, he's just using an artifact of GitHub's implementation (or, well, a hypothetical GitHub implementation - I'm not sure GitHub actually blocks submodules that reference the relevant commit hash?) that happens to make GitHub refuse to host it.

GitHub is free to change their minds about the implementation and start accepting those commits again. That is, you, as a recipient of the code, are free to ask GitHub to host it, and to offer them a license under the terms of the GPL; GitHub is free to accept or to decline, same as if you sent me the code, I am free to host it on my personal website but I'm also free to not host it.

(It would feel more like violating the spirit if it, say, prevented you from uploading it to a GitLab instance you self-host... but since you self-host it, you could just patch out any suppression code, so that case can't come up.)

I don’t even think it’s an in-spirit violation. You have to offer to distribute the source. That doesn’t have to be from any particular hosting provider; it just has to be reasonable.

(The license is ~14 years older than git itself. There’s no way distribution using a specific git hosting service is required under the license.)

Making a repo that is incompatible with another hosting system is not a GPL violation.

There are all sorts of compatibility issues that can arise from platforms doing dumb things. For example, a repo with the files README.md and readme.md in the same directory would break on certain Windows machines due to case sensitivity problems.

If a country now decided that the Linux kernel violates law and bans it I don't think the kernel would violate their license just because it's now illegal to distribute it in that country.

GPL doesn't require you to provide a git repository, a tarball is good enough.

It's a way of proving a point.

"Hey, GitHub has stupid practices which are just terribly harmful for the community. Also, here's my source code."

Someone comes along and pushes that same repo to GitHub. GitHub bans them. This is exactly what you'd been warned of!

I'd find it incredibly childish and needlessly divisive to make your repo impossible to host on a given provider just because you don't like the provider. This does nothing but make the tech community worse for everyone and less accessible. Newcomers shouldn't have to navigate petty politics to get started with tech and people already here shouldn't have to have their time wasted with it when they're just trying to be productive.

Would you say the same about code that, for example, is designed to fail when used in a missile? E.g. navigation code that deliberately pilots into the ocean if onboard something going faster than Mach 3?

That would be outrageously unethical code to write, tantamount to criminal negligence.

I think the poster meant navigation code that was not intended to be used in a missile, being used in a missile. Consumer grade GPS units do exactly that; they intentionally stop working above a certain speed or altitude, so that they can't be used to build missiles.

There’s a big difference doing that in a consumer grade device and an open source project you publish for the world to use; i.e. when someone decides to use it in a hypersonic passenger jet

What is the difference? I don't see it, besides one having a warranty and the other explicitly stating that it offers no guarantees or support.

Just stating you don’t have a warranty doesn’t absolve you of all ethical considerations. You can’t just publish something littered with poorly thought out booby traps and then absolve yourself with a license file! If you’re not interested in people using your code for specific purposes, maybe don’t publish it for all to use?

It's perfectly ethical to write open source code that will crash a passenger jet if used in such a manner. It's unethical (and probably criminally negligent) to include it in a passenger jet.

It's perfectly ethical to write open source code that will crash a passenger jet

Really?

We’re not talking about bugs here, we’re talking about the deliberate inclusion of dangerous logic traps based on assumptions that could be wrong.

In engineering terms, this is trying to solve the problem at the wrong level of abstraction. Maybe you don’t like the thought of your code being used in weapons; that’s perfectly reasonable. Maybe you want to rid the world of such weapons; also reasonable. My advice would be that open source is not the right model in those circumstances, and that to really solve the problem you’ll have to be politically engaged.

Littering code with booby traps and publishing it is an absolutely awful idea, one that should not be acceptable to us as a professional community.

Newcomers have to navigate the copyright politics whether they like it or not. The amercian copyright laws have created this mess not the op.

> I'd find it incredibly childish and needlessly divisive to make your repo impossible to host

If only it was! In that case, it is github who is allegedly making the repo impossible to host. It is, thus, github who is acting in a childish way. The repo author is only adding some silly hashes.

By the way, the real "childish" behavior is believing that speech can be censored by technical means alone. This is impossible, there are always technical means to circumvent it. Speech can only be effectively censored by means of armed police action.

That's a pedantic distinction. If github won't allow hash X and you put in that has on purpose just so github won't allow it then obviously the intent was on your part.

Reply on news.ycombinator.com