Hacker News Reader

Comment by toomuchtodo | Hacker News Reader

Github needs to go on the offensive and begin to take action against fraudulent DMCA notices, including justification to seek damages for these claims.

View on HN

IANAL, but I am pretty sure Microsoft has little recourse here. The requests would need to be knowingly fraudulent for recourse and that is a huge hurdle to prove that the MPA is knowingly acting in bad faith rather than just being overaggressive.

The DMCA desperately needs to be reworked at the very least.

If they can be sure there is no copyright violation, then what would the downside be? By not acting on the DMCA notice, they would lose their safe harbor, which would be inconsequential.

>If they can be sure there is no copyright violation

Will they think that, though? I doubt they would take the risk.

The downside is that the safe harbor protections apply to the entire site. Even if this content is fine, there is certainly some content on GitHub that violates copyright and Microsoft would want safe harbor protections in those instances. They therefore can't completely abandon the DMCA.

My understanding is that in order to continue participating in the DMCA the recipient needs to act on all requests. That doesn't necessarily mean they need to take down the content, just that they need to respond to requests.

There is also no penalty setup within the DMCA for sending a request in which the response is that the content is not in violation. The only part of the DMCA that sets up penalties for the requester is if the requests are made in bad faith. That basically would require Microsoft to show the MPA is malicious in their requests rather than incompetent. That can be difficult to prove.

>> The downside is that the safe harbor protections apply to the entire site. Even if this content is fine, there is certainly some content on GitHub that violates copyright and Microsoft would want safe harbor protections in those instances.

Hey! Finally a legal reason not to have massive centralization! OK my enthusiasm is exaggerated.

Well the material in question here is without a doubt not copyrighted by the MPA.

And the safe harbour provision only protects Github from hosting or referring people to infringing material, or material that's "subject to infringing activity" (which is different from what's being claimed here as nyaa is very clearly the object).

That said the DMCA contains all kinds of vague phrases, such as

> linking users to an online location containing [...] infringing activity

whatever the hell that may mean.

You don't go after the MPA. You bring charges against their lawyers who are acting in bad faith and submitting fraudulent documents.

Microsoft would never do that unless their hands were forced. Too much potential business with them.

We could try forcing their hands by removing all our code from Github?

I use gitlab, myself.

More effective would be those who are at orgs paying for Github Enterprise to express to their account managers they'll take their business elsewhere if Github is unable to defend it's platform from malicious actors.

Github don't care if you take your code elsewhere. They most definitely care about revenue (and developer mindshare a somewhat close second).

Such a claim is pretty weak, actually. MS would not be held responsible for code in someone's GHE instance any more than they would for a movie stored on an NTFS file system.

So the sales rep is likely just going to be confused by the attempt to use unrelated leverage.

No, but GHE is paid software. And not like it's impossible to migrate, it's just a fancy git frontend after all. Gogs/Gitea/Gitlab CE is completely capable of doing what it does.

Cost of migrating from GHE to something else usually exceeds the cost of GHE itself.

Migrations generally are non trivial. They don't generally happen just to push one's principles.

Depends on how you do it. Of course if you want to move instantly then that's gonna be hard. But slowly moving isn't that bad, or creating new projects somewhere else and slowly porting old ones.

Even then, it's possible that just companies that planned to buy GHE will simply not buy it and use something open source instead.

> Microsoft would never do that unless their hands were forced. Too much potential business with them.

The upside of Microsoft's acquisition of GitHub (and the entire strategy that resulted in the acquisition) is that Microsoft has created incentives for themselves to have GitHub being regarded as a truly open platform that you can depend on. Having repositories exposed to flimsy DMCA takedowns is not part of that.

Microsoft, very transparently, wants to make money by being important in how people develop software. If exposure to flimsy takedowns is a part of GitHub, then people will be more motivated to send their money to GitLab, Atlassian's stuff, or a bunch of other options. They have legitimate competition here.

Developer's opinions of GitHub and Microsoft in general may be of more longer term importance to them than the MPAA's opinion of them. I'm not saying that that is definitely the case (maybe they're still getting there), but it's worth acknowledging that Microsoft has legitimate actual cold money reasons to fight this. No need to rely only on personal convictions of the people at GitHub.

I bet Microsoft can have it's cake and eat it, too. If enough github users are willing to defend them, they can placate both parties.

Microsoft should be paying us to use github.

Indeed, as always competition benefits the costumer

The occasional prominent developer has left GitHub for GitLab, but it hasn’t made much of a difference. I don’t see organizations moving off GitHub if they’re already using it. I think GitHub is independent enough from Microsoft that the two could take different stances on these disputes. Certainly I’d expect a DMCA takedown of content on a Microsoft service like OneDrive to be ultimately handled differently from a takedown aimed at source code on GitHub...

Github is as independent from Microsoft as WhatsApp is from Facebook.

Thankfully I am not yet required to sign on to github using 2FA that can only be confirmed on a Zune. Microsoft has been pretty good at leveraging github for the publicity of supporting developers (hosting informational streams and the like) while leaving the platform pretty independent.

I wouldn't be surprised if Microsoft viewed Github like McDonalds views the Ronald McDonald House - a long term PR investment that's well worth the marginal cost.

> Thankfully I am not yet required to sign on to github using 2FA that can only be confirmed on a Zune.

Strawman: Microsoft doesn't require you to come from their hardware for any of their properties, and of course Zune is a dead platform.

Except that Facebook has been integrating their sign on service into various acquisitions - using Zune (or any hardware) was quite hyperbolic of me. For a more even handed comparison: I'm not required to use a Live login to authorize with github.

Mojang acquired by Microsoft: 2014 (https://en.wikipedia.org/wiki/Mojang_Studios )

Mojang users required to move to Microsoft (formerly Live) accounts: 2021 (https://www.theverge.com/2020/10/22/21527647/minecraft-micro... )

I expect the same will happen for github eventually. Given the were acquired in 2018, by this timeline, I'm guessing by 2025.

I'm a bit doubtful of this. It's possible but Microsoft uses Live for both business and gaming, but they've only had a track record of forcing Live account adoption onto users in the gaming sphere. It may happen, sure, but I don't think it's likely.

That all said I didn't think it was likely that Minecraft would switch over to using Live accounts since Minecraft is so famously cross platform and Live accounts have struggled with that in the past.

They're also boiling the frog on Windows local accounts at the moment. It's no longer possible to set up a new install of Home, or Windows 10 (any SKU) in S mode with a local account without either disconnecting internet during installation or going back and converting to a local account after

Wrong, Microsoft’s internal incentives are aligned with GitHub remaining independent and building developer mindshare. The, relatively, minuscule business they get from MPA (No Azure, Office subs, Windows subs) is extremely fringe in comparison to losing long term developer mindshare. Even if you thought of representative companies in the MPA,e.g., Netflix, Warner, etc., which are only loosely coupled to the MPA itself, this is still tiny in contrast to overall developer mindshare. This is why they reinstated popcorntime etc etc.

I'm anxiously waiting for a quit-GitHub movement. I hold my source code there because of its popularity and "defaultish" nature. Of course I can go someplace else right now, but then people won't find my software.

You can make GH be just a mirror

Agreed that Github needs to push back, but we should also be contacting our legislature so that they are aware of the abuse of law.

True, but that's a longer "sales cycle" (election cycles are usually every 2-4 years) if you will. Tactical response vs strategic response.

A full war needs to be waged, at the tactical and strategic level, for (digital) freedom.

This has been an issue, and has been lobbied for, for at least two decades. The law may do us favors one day but that day is far into the future.

Has there been even a single move away from ever more draconian copyright? Just the last budget bill had provisions for more criminal enforcement of copyright and with bipartisan support. If this is a slippery slope it's a steady and worryingly unstoppable one so far.

Civil disobedience through distributed systems seems like the only answer right now.

Your legislators can't hear you over the sound of millions of dollars from Hollywood getting deposited in their campaign accounts.

Corporations can't donate to campaigns, they can only collect voluntary donations from employees and only donate $5000 per campaign.

And Microsoft does donate to all the ones you don't like, so on this theory they'd be doing GitHub's bidding.

The future may arrive soon: https://www.youtube.com/watch?v=sHypmOp8AdM

Whether we contact our representatives or not, the MPA / Disney / etc have deeper pockets than we do.

We've reached the point where a candidate for the senate will only get the nomination and have a chance to be elected if they spend a significant amount of money on their campaign. There's no campaign limits, so if you don't spend much, you're liable to lose.

As a result, the people who run successful campaigns almost always have already agreed to side with the MPA and other interests that have money.

Us telling our legislature we're not happy about it won't help either because, well, what are we going to do? Vote for the person on the other party? Not likely. Vote for another guy? It's unlikely anyone else will even be on the ballot since both the democrats and republicans will avoid having multiple candidates to avoid splitting the vote within the party.

I agree that the problem is really legal at its root, but I think we need better plans than "contact your representative".

This year many high profile campaigns that spent the most money also lost, and the ones that won by spending the most were not "corporate" but were Bernie aligned.

While you may be able to point to one or two anomalies, we need more than that. If the MPA has the ear of 70% of congress, that's still enough to have their way on legislation, regardless of a few fringe elements.

As far as I can tell, there's not a large trend that this is changing currently. The candidate that spends the most still wins 70-80% of the time: https://www.opensecrets.org/elections-overview/winning-vs-sp...

The cost of running a winning campaign has steadily increased as well: https://www.opensecrets.org/elections-overview/election-tren...

Those trends, to me, do not paint a compelling story that things are different now.

Your conclusion that

  receiving funding => being popular => winning

is not necessarily incorrect. But it is also possible that it is the other way around:

  being popular => receiving funding => winning

I.e. candidates which are more popular tend to have an easier time receiving funding. Or, it could be some combination. This would also explain the outcomes you point to.

Sanders, despite some reformist tendencies, is a also corporate-aligned. He is a staunch supporter of the Democratic Party and of its pro-corporate leadership; supports the military-industrial complex and most (not all) of its foreign interventions; and recently voted for the CARES act, which transferred huge amounts of wealth to large corporations.

Those "Bernie-aligned" elected members of the house have just recently chosen to support Hundred-Millionaire house member Nanci Pelosi for speaker of the house. They did not even do this in exchange for anything. Other Bernie-aligned representatives, already in office before this year, have also neglected to act against their pro-corporate party line.

So, the moneyed elites can indirectly win even if they ostensibly lose.

> and recently voted for the CARES act, which transferred huge amounts of wealth to large corporations.

That was a payroll support program like every other country did, plus airline bailouts which were good because they have giant union contracts.

CARES is the greatest anti-poverty measure the US has done in a hundred years and probably the largest downward transfer of wealth in the world. You didn't notice because all left-wing commentators decided to lie about it ("we only got $1200 checks") instead of reading about how the unemployment benefit worked.

https://twitter.com/jdcmedlock/status/1322348938339389441

>He is a staunch supporter of the Democratic Party

I'd consider this debatable. He isn't even a member of the Democratic Party, he just caucuses with them.

I didn't say "member", I said supporter; but he's effectively a key member. He:

1. Encourages people to vote for the democratic party.

2. Encourages people to run within the democratic party.

3. Was accepted and recognized as a candidate in the democratic primaries of 2016 and 2020 (even if the race was somewhat rigged against him).

4. Is endorsed by the democratic primary when he runs for Senatorship in Vermont.

5. Refrains from criticizing the leadership of the democratic party, even when their positions and policy are opposed to his stated positions.

6. Went on tour with DNC chairperson Tom Perez to convince people to support the party, after the 2016 elections.

7. If that's all not enough - he was a top appointed official of the party: Chair of senate outreach efforts as of 2016; see : https://www.usatoday.com/story/news/2016/11/16/senate-democr...

Long gone are the days when he was any sort of an outsider to the party.

Deep pockets are only useful as a proxy for getting people to vote. What means more than deep packets is votes. If we can bring in votes that is far more powerful than money.

So get out there and convince voters that this is an important topic. The law will change fast if congress decides that not changing it will mean they are thrown out and some other person who will replaces them. So long as they think few people care it will get lib service. (also so long as there seem to be a signification amount of people on the other side nothing will change)

...and don't forget that the incoming president has a definite position on IP and copyright that many here are probably opposed to:

https://techcrunch.com/2008/08/25/joe-biden-obamas-running-m...

In fact I'd go as far as saying quite a few of the events of the past few days are precisely due to this upcoming change of government.

It's weird that we expect Github to do that, in a way. The repo might well be hosted on there for free, but we all want Github to spend a ton in legal fees to defend something they make zero cash from.

I'm not sure what my point is here other than finding it sad that code hosting is so centralised.

We do. We want to see github or anyone defend any fake lawsuit against them.

Good thing there aren't any lawsuits against anyone then.

I think it's in Github's interests to push back on this. MPA's dubious legal requests likely cost Github time, money, and PR to resolve properly. It adds up over time and I doubt any company wants to be caught in the middle of an arms-race conflict like this, nipping it in the bud could very well be worth the upfront legal fees.

I imagine MPA would also be emboldened by this if Github removes the Nyaa repository forever on what is basically a pretty flimsy basis ("Nyaa.si uses the code and that's a piracy website so the code itself is piracy").

What's next? Transmission and rtorrent?

Github's market position is in no small part based on network effects and depends on nearly every open source project being hosted there.

Now imagine a competitor promising some kind of protection against these kinds of frivolous DMCAs. That could lead to a large chunk of media, p2p and security software moving there, threatening Github's position in those niches and putting that competitor on more equal footing.

A better way would be to start excluding MPA and their behaviour in our open source licenses.

>A better way would be to start excluding MPA and their behaviour in our open source licenses.

This is a remarkably good idea. Add an explicit clause to major open source project licenses that disallow use by the MPAA and similar groups, along with enough explicit damages spelled out to give it teeth.

Then those licenses would no longer be open source licenses.

Anything requires MSFT legal review, so it'll be at the very least 24 hours or so before they can make decisions like not honoring DMCA complaints.

Github = Microsoft.

Reply on news.ycombinator.com