My Latest Brush with the Corporate Internet: GitHub Has My Stolen Code
cheapskatesguide.org
cheapskatesguide.org
So GitHub follows the legal process set out for hosting services? Umm, yeah. No shit. They're doing exactly what they're supposed to.
> I do not even have the option of suing Mr-Steal-Your-Script to pay my lawyer's fees, because he is anonymous. As blatant as his theft was, I have to assume that he has covered his tracks well enough to remain anonymous.
GitHub should have provided you with his counter-notice including contact information. If they've accepted a clearly invalid counter-notice then you can sue them.
Otherwise, yeah, this guy has posted a copy of your code, and the only way to take it down is to sue him. That's how copyright infringement usually works - it'd be the same if he were hosting it in ISP-provided webspace, or his own personal site, or printed it out on a physical billboard he owns. I don't know why you see this as being about "the Corporate Internet" at all.
Too bad they haven't even gotten to that part, because i can't find[0] their dmca[1] or the counter notice
The underlying principle---legal representation costs money even if you're in the right---would still hold.
> I have to assume that he has covered his tracks well enough to remain anonymous.
No you don't. John Doe lawsuits exist. You would be on the hook for legal and possibly detective fees, but if you start a legal process GitHub can be compelled to turn over what records they have about the perpetrator.
> Thanks to my experience with Mr-Steal-Your-Script, I am seriously considering keeping any additional code that I write to myself.
That seems wise.
> If you have found this article worthwhile, please share it on your favorite social media. You will find links at the top of the page.
I'm not sure I want to risk it at this point. The article is copyrighted all rights reserved, and we've seen how the author feels about their publicly-posted information being shared.
Why?
Just not a person that I can assume won't slap me with a takedown notice if they don't like the context in which I share their work. I don't have time to want to bother to deal with takedown notices, and it's a wide, wonderful internet with all kinds of other information I could be sharing. The safest course of action for me is to skip it.
I understand the pain of the developer and the fact that GitHub is not doing anything. But, imagine if GitHub had to act on each of these disputes? Besides probably the sheer amount of requests, I can bet that at some point they would give side to the copier and then it would end-up on the news as well.
You do not have to hire a lawyer, you only have to start a lawsuit over the case.
a default in your favor because he failed to respond is likely how that process would go, otherwise he has to identify himself and you suddenly regain the option of suing for fees
side-edit: Ironically enough, if he had gone open source, he could get free legal help dmca'ing the repo in court for the removal of the copyright messages from the Software Freedom Law Center.
Edit: yep, that's it. Here's the commit that removes the "Sh*t Message": https://github.com/Mr-Steal-Your-Script/bwfForum/commit/184a...
I am not a lawyer, but it is my understanding that a DMCA counter notice asserts that - under penalty of purjury - there is a good faith belief that the DMCA takedown request is invalid. Once a host receives this, they wait 10-14 days and then must restore the hosted content. The only available next step in the process for the copyright holder is to use the court system.
"In order to protect against the possibility of erroneous or fraudulent notifications, certain safeguards are built into section 512. Subsection (g)(1) gives the subscriber the opportunity to respond to the notice and takedown by filing a counternotification. In order to qualify for the protection against liability for taking down material, the service provider must promptly notify the subscriber that it has removed or disabled access to the material. If the subscriber serves a counter notification complying with statutory requirements, including a statement under penalty of perjury that the material was removed or disabled through mistake or misidentification, then unless the copyright owner files an action seeking a court order against the subscriber, the service provider must put the material back up within 10-14 business days after receiving the counter notification.
Penalties are provided for knowing material misrepresentations in either a notice or a counter notice. Any person who knowingly materially misrepresents that material is infringing, or that it was removed or blocked through mistake or misidentification, is liable for any resulting damages (including costs and attorneys’ fees) incurred by the alleged infringer, the copyright owner or its licensee, or the service provider.(Section 512(f))." [1, Page 12]
You will have to fill DMCA and if they don’t take it down then claim github stole it.
And if you read the title very precisely, indeed it does say that. That said, it is baity AF with all sorts of rich, tasty read meat: “Corporate Internet”, “Github”, “stolen code”—all the things a good internet mob loves.
Furthermore, demanding (or even just assuming) that hosts can/should act as judges, juries, and executioners is itself an exceedingly slippery slope to hop on. I mean, just look at the Trump campaigns ongoing efforts to get Section 230 revoked because Twitter had the temerity to flag some of his posts as “may be disputed”. (Not even “liar, liar, pants on fire”, mind; merely “disputed”. Good Dog but that’s some thin skin.) Be careful what you wish for; laws of unintended consequences; roads to hell and the paving thereon; etc, etc, etc.
So this is not a “David vs Goliath” narrative, much as it might (accidentally or intentionally) resemble one from the OP’s take. It’s David vs another David, while Goliath very wisely—and legally—stays the hell out that particular boy-girl fight. See also:
https://www.eff.org/issues/cda230
.
Now, whether OP actually needs a lawyer or just legally worded letter to activate the next stage in a DCMA takedown, I’m not sure because US Copyright Law’s not my bullpit either. But, yeah, when someone chooses to violate your copyright, then legal-nastygramming the swine once asking them nicely fails to do squat is entirely up to you.
Considering you can already get yourself template-generated contracts, wills, and other common legal documents online for little or no payment, personally I’d investigate that road first before going straight to the dramatic internet swoon. But that’s just me.
Accurate title: "Someone shared my copyrighted code, and GitHub used software instead of a human to arbitrate".
Not as interesting or unexpected. None of the major platforms for user-generated content could possibly review every claim with human time.
If a website, even one like GitHub that posts others' submissions, had something I felt was mine and I had to go through a complicated process to get them to remove it, an adversarial process no less, I would describe that as a "brush."
If I felt that the process was made more difficult because the other party was a large corporation instead of a small group, and if I felt that there was a movement in the web in that direction, I would think it's reasonable to label the party "the corporate Internet." This kind of metaphor is certainly very common, where a journalist might label a practice by a company like like Facebook or Twitter as being done by "social media" writ large in spite of the fact that neither company is "social media," per se, but more literally a single entity in the large area that goes by that name.
And the statement "GitHub has My Stolen Code" is a very literal bottom-line summary of the source of the writer's contention. Its presence in the headline has the redeeming quality of removing the metaphor from the first half of the headline for readers who might want more specifics before they read the article.
1. GitHub did something special or intentional in this case.
2. GitHub is running the code.
In fact, when I saw the headline, my first thought was that GitHub was using someone's library in violating of the stated license.
It's also strange that this person published their source code along with the demand that no one reproduce it anywhere.
It's like if Twitter complained about people reproducing tweets. Sure, maybe they are violating your copyright in some way, but copyright is very, very difficult to enforce on a product that can be reproduced billions of times per second across the entire world.
Especially after seeing the code itself (simple forum software that runs on PHP 5.6, which has been unsupported for 2+ years) and that the author has no intention of monetizing it, it just sounds like they were looking for a sensational headline. There seems to be no actual harm happening here.
And as others have said, this is how we'd prefer the web to work: copyright holders have less power, not more.
For example, if I bought a phone on Craigslist and someone said to me, "You have my stolen phone," I would not assume they were accusing me of stealing their phone.
I think the main problem with this headline is that so many have read it as "GitHub has stolen my code," but that is hardly the author's fault.
Maybe he should have written it as, "Someone stole my code and posted it on GitHub" but that would disguise the author's main point, fleshed out in the article, that GitHub is not acting appropriately in this case.
You didn’t have your code stolen.
Your code was free and open, and the header he removed stated that fact.
What you had was a violation of your terms of use, and I while I agree the guy’s probably a scumbag, the only issue here is that he was seen doing it.
Rest assured, others have done it without being seen, it’s a fact of life for a public code repo.
I suggest you:
(a) change “copywrite” to “copyright” in your code, since a copywrite is someone who writes stories, and a copyright is a legal term claiming ownership;
(b) file a dmca takedown notice with github; I run a hosting service and when we receive those, we take action;
(c) move on. Life’s too short, and all he has to do is republish it to another repo and keep you angry and not working on your code.
(d) actually file a copyright with your code so that he doesn’t do it then sue you for using his code;
I feel for you, but scumbags are what they are and there’s not much you can do about it unless you spend a ton of money to find and file a suit against him that you will probably not win.
My condolences.
d: One does not need to file any documents in order to have a copyright over a work in the US, it is an automatic right given to creators over their original works. Authors do, however, need to file with the Copyright Office before suing for copyright infringement.
The header in the source code from the author's site says:
// This software is the beta version of bwfForum. It is free for
// you to use. You may not modify any of the PHP code without
// the author's permission. You may modify the configuration file
// as needed to get bwfForum to run as designed on your computer.
// You may not sell or redistribute bwfForum without the author's
// permission. If you would like to use bwfForum on your website,
While I do share the author's frustration with the fact that GitHub does zero fact checking, my concerns go entirely in the other direction: much of the internet now works in such a way that a DMCA takedown notice will effectively remove any content someone doesn't want out there.
I do understand why platforms do it like this, being in the business of arbitrating who is right and who is not is not feasible (and it's probably also not legal).
Criticisms of this process should be levied against lawmakers and the law itself.
However, to be perfectly frank, it's a good thing that hiring a lawyer to send this letter on your behalf is the minimum effort required to do this. Of course that doesn't solve malicious takedown notices sent by big law firms and corporations, but I do believe it limits the overall amount of letters that get sent.
Company's should be held responsible. If you are allowing a vehicle for theft, you need to have reasonable anti-theft procedures in place. We can't let corporations deny their own responsibility here.
What? He can. He even told us how to do it: hire a lawyer to draft a letter demanding it's removal.
Yes, that costs money. Welcome to the adversarial legal system in the Western world. But he has a path if he wants to take it.
Personally I much prefer this over GitHub unilaterally acting as judge, jury, and executioner.
It has flaws to be sure, but the next step for this complaintant is to follow it. They asserted copyright, the person who posted the code challenged their assertion, and their relief is in the courts.
I honestly don't know what remedy I'd have if this happened to me.
Did the author actually believe that his amateur licence terms allow practical reuse? This is effectively an "All rights reserved" notice.
This is an unhappy story, but really, how would you like things to work? Github isn’t in the business of adjudicating copyright ownership, nor should it be.
If you are a large corporation that doesn't have enough resources to do even this kind of bare-bones investigation because you have too many users per employee, you would probably come up with a process like this instead and lean on that process to guide you.
That would be reasonable in your situation, but it is perfectly fair for someone to say, "They should avoid getting themselves in that situation so that they don't have to make simple things so hard for individual people. The Internet is too dominated by ultra-scaled companies. It would be better if the companies operating in it were smaller."
I went to two colleges, one with tens of thousands of students and one with fewer than two thousand. When some paperwork issue came up, it was so nice to be able to go talk to someone in the accounting office and be treated like an adult instead of having to talk to a student working making barely above minimum wage who has to treat me like a stranger off the street because he deals with so many people. There are downsides to scale.
Safe harbor doesn't give much guidance to hosting companies about who needs to hire the lawyer, other than to note that if they try to practice law by adjudicating these cases themselves, they're on the hook to hire the lawyer.
The right approach in this case is not to waste money on a lawyer (or expect some lawyer to work pro Bono).
The right approach is to post about it publicly and bring shame upon GitHub for being the literal jar or of a Mr Steal Your Script. is
http://copyright.nova.edu/safe-harbor/
...and I think that if GitHub allowed them to post the content in the first place (ie it’s at the direction of the user, not GitHub’s moderators) and then when a red flag became known to them (for example via publicity) and they used common sense to ban that one repo, they would not lose their safe harbour they’d in fact be acting in accordance with it.
But like I say, I’m no lawyer.
It's messed up. I'm sorry your code got stolen.
The whole premise of this post makes no sense. He posted code on his site, that he wants other people to use, but they are forbidden from changing a single line. But he didn't want it on github, because that means that Microsoft stole it.
It is lame that someone copied it without attribution. But it is a pretty minor transgression in the grand scheme of things. Certainly no financial harm done and nothing has been taken away. You can't control bytes once they are out there. Information wants to be free.
If it bothers you that much, pay a lawyer. If it was too easy to get things taken down, it would be abused by wealthy corporations (even more), and youtube-dl would be gone for good.
If I got this upset about every perceived slight, I'd be waging battles dawn til dusk. Pick your battles, folks.
Is there any reason for him not just do it, or that you'd need legal counsel? Thinking it through, I suppose theoretically you might worry that if you did it wrong you could get in legal trouble, but a) this guy is positive he owns the copyright to this thing it's not any kind of grey area, b) even those who totally file DMCA takedowns under bad faith never ever ever get penalized for it, like nobody ever has been penalized for filing a DMCA in bad faith I don't think? (This is not a good thing, but is in this guy's favor here). And again, this one would definitely not be in bad faith.
Just fill out a DMCA takedown request and send it to github? It's not that hard, you can definitely find a template and fill it out within a very unhurried couple hours max with a couple coffee breaks in there. You don't need a lawyer.
I know HN loves to hate Github, but you can't get mad at them both for taking things down when those claiming copyright ask them to, and also for not doing so unless someone actually follows the proper (pretty simple and not very burdensome) procedure.
The OP sounds like he's mad that the world is not entirely arranged in his favor to cater to his personal needs, and this is somehow a new realization for him.
As I understand it (and I am not a lawyer, this is not legal advice), the only next step available is to use the US court system to sue for copyright infringement and perjury.
it is true that in past issues, the mob would be mad if Github did anything different.
Are we sure of that? GitHub publishes the notices and counter-notices. I can't find any notices there that appear to be for that repository, nor any relevant counter-notices.
I wonder if the author may have sent his request through some other channel than GitHub's DMCA takedown request form?
The "dancing baby" lawsuit ended in a settlement, so maybe? I can't find the details of the settlement.