Hacker News Reader

Comment by Giefo6ah | Hacker News Reader

If you live in the USA, the "decoy notes" may be considered an "effective technical measure" from the "Digital Millennium Copyright Act".

If you live in Europe, this restriction may be considered "gatekeeping" and exempted by the Digital Markets Act.

Don't bring attention to yourself by asking for permission. Publish your codec, and if the company cares about this they will send a cease and desist.

If you want the world to benefit from your code but you don't want to be responsible for it, try to adapt the codec to ffmpeg. The ffmpeg project is used to dealing with these matters, and will keep your codec working for eternity.

View on HN

> If you live in Europe, this restriction may be considered "gatekeeping" and exempted by the Digital Markets Act.

That's not how the DMA works at all, there is no concept of gatekeeping practices. Instead, the EU Commission designates companies that act as gatekeeper for some services (current list here: https://digital-markets-act.ec.europa.eu/gatekeepers-portal_...) which then puts constraints on what they do.

But we have various exemptions that are for all the companies, no? E.g. you're free to hack and crack software to do your own backup copies.

Not a lawyer but it wouldn't be under the DMA - these rights predate the DMA by a while.

Yes of course

Don't publish your code. Let the AI "accidentally escape the sandbox and publish it in a readily available Git repository". Tongue in cheek, in current days who would blame a poor LLM just trying to do the right thing? :)

> Publish your codec, and if the company cares about this they will send a cease and desist.

If there are doubts about C&D letters, don't publish code to a USA provider. Bring it to Gitee, under an anonymous author name.

Exactly. Surprised to see 'just don't let them find you' so far down when it should be the first advice.

I thought you were going to say, don’t publish the code. Publish the prompts.

If you don't want to be responsible for it, another way is to just publish it anonymously: make a GitHub that isn't attached to your real name etc, perhaps using a one-off disposable email address, and put it there. Then you don't have to think about what the lawyers think. Worst case it'll get taken down, but by that point it'll likely be popular enough that there'll be plenty of copies.

[Pirate flag emoji here]

What if the companies start auto subpoenaing the AI companies to try and tie the code to an account?

Maybe then using an open weights model is a good way to hide your tracks...

Or at least use an obscurer model from an obscure company, so they don't know who to subpoena.

Everyone is aware that multiple services offer zero data retention, right?

Let them do it. It will end up really well. I know the system has been protecting these companies, but that has been an economic concern as much as other motives. Now that AI is the crown jewel of economy and global dominance, let the entertainment industry have a go at it. Let them.

Wait until we all get popcorn though, and find a comfy place to watch from that's just outside the splash zone.

Do companies in the US really have the right to do that? I would think that kind of investigation is reserved for law enforcement only. If the design was made over email, would the piano company be able to subpoena Google for someone's private gmail messages?

Attorneys can subpoena if the court approves, as part of ongoing litigation, AFAIU (IANAL).

Consider previous cases where companies like Reddit have unmasked their users at the behest of court order.

> Do companies in the US really have the right to do that?

Does it matter? What's important is if it can happen or not, and how if so. We already know that MPAA is willing to basically do whatever, even contribute themselves to piracy, if it means they can put people in jail for copying stuff eventually. They themselves also gotten in trouble for copyright violations themselves in the past, so doesn't seem like they're hiding away from breaking a little bit of laws to hunt pirates.

Sure, on github it will (still) get the most attention, but perhaps another repository outside the US is a better fit.

You could also create a text document instead of a software that details the mechanism used to fool other MIDI decoders and publish only that (for now).

Finally, familiarize yourself with the Art. 6 Software Directive (2009/24/EC) / §69e UrhG — decompilation for interoperability. It may be your ticket for a legal status in Germany/EU.

> Worst case it'll get taken down,

Eeh, worst case scenario you'll get sued as Microsoft will have no problem with handing over everything they have from your Windows installation information, GitHub accounts, NPM authentication and everything else they own today if the courts tell them to.

You can't just commit crimes on the open internet without really hiding IPs and what not, and expect that to not come back to haunt you eventually. Kind of poor form to suggest otherwise too.

"You can't just commit crimes on the open internet "

Who said it is a crime, are you a lawyer?

Allegedly commit potential crimes*

I'm not saying yay/nay if this is a crime or not, but if you think it might be, and you create a new account on GitHub to "be anonymous", you're not taking opsec seriously enough for something you believe might be a crime.

By the way, generally judges or juries would be the ones to decide if something was illegal or not, it's not the lawyers who decide this, in any country I'm familiar with.

Tbf "is it a crime" is hard for even a single lawyer to answer because it depends on: who you are, your skin colour, how rich you are, your sex, whether it's a white collar crime or not, did you commit the crime on behalf of a corpo, etc.

But we like to pretend that the justice system delivers justice evenhandedly I suppose.

No it does not. The law defines what a crime is. That you are bummed out about how it is applied, does not change the question, whether it is a crime. One thing is the definition of what constitutes a crime/felony/misdemeanor, another thing is the application and the punishment meted out.

That's not quite the case in common law countries. In countries like the UK and the US, the interpretation of the law as written is ultimately decided by the court, meaning that the definition of what constitutes a crime/felony/misdemeanor is subjective. The more courts that attempt to interpret that specific law, the more 'jurisprudence' builds up, meaning that the interpretation applied in a previous decision can certainly have an impact on a future decision.

If there are predictable patterns w/r to the implementation that is something a good lawyer would tell you, albeit in couched terms.

Please note: This is America where potential civil immigration charges can result in summary execution because poorly-trained wannabe-cop racists with guns make needless escalations. If law enforcement thinks it’s a crime, it’s a crime until the courts say otherwise.

99% of American law enforcement does not care about a piano disc encoder.

I am not a lawyer, but I am pretty sure there is a crime somewhere there.

> You can't just commit crimes on the open internet without really hiding IPs and what not, and expect that to not come back to haunt you eventually.

Not sure what you're talking about, the current AI boom is entirely based on committing crimes on the open internet without really hiding IPs and what not.

So is much of big tech in general.

Keyword being "you". "They" can commit crimes, because they're big tech companies who give gifts to the right people. But "you" are not "they".

Any reasonable person would interpret the original comment as the "generic you" rather than the "second person you", but nice save.

Why bother publishing the code? Anyone with LLM access can recreate it. Instead write up your findings on how it works. Publish that in a blog, submit it to Wikipedia and Reddit. Player piano did security through obscurity. Now make it less obscure.

code with compilation instructions can be understood and used by much more people than a long conversation between a human and 2 top tier LLM only accessible through costly agreements and providing nondeterministic output. Going from a prompt to working code you have to traverse a pretty steep paywall...(yes 20 to 200 dollars per month is steep if you compare it with the rest of the software stack like compilers/interpreters and text editors, which is usually free)

> the "decoy notes" may be considered an "effective technical measure" from the "Digital Millennium Copyright Act".

I really hope not. My understanding is that to be "effective" it needs to at least be a form of encryption with a secret key. At least, I'm not aware of any case law that allowed anything less than that.

IMO, "dummy notes" are nothing more than a form of obfuscation. If it's obvious how to filter them out, then I don't think it comes close to meeting the bare minimum of what might count as an "effective technical measure".

Of course, who knows what way the courts will rule if it ever reached that far.

shitty CAPTCHA’s and simple checksums have been ruled to be “effective measures”, so this would probably be too.

However, Section 1201(f) is designed to allow developers leeway in reverse engineering to make "independently created computer programs" talk to other "computer programs". But this usually distinguishes between talking to a binary (good) and reading a media file (bad).

My guess is the encoder is probably legal under 1201(f) because it’s reverse engineering a DMCA covered application to create new media files for it to use. But the decoder would be illegal because it reverse engineers a DMCA covered application to extract copyrighted media.

No, on appeal the simple checksum was ruled to NOT be an effective measure. [0]

And while courts might have ruled that a CAPTCHA might count as a "technological measure" they haven't gotten as far as ruling them as "effective" yet.

But in general yes. The protection scheme doesn't need to be well designed or free of design flaws to count as "effective". But from what I can tell, it does need to be a valid attempt at some cryptographic scheme requiring a secret known only to the copyright holder.

[0] https://law.justia.com/cases/federal/appellate-courts/F3/387...

You're underselling this report. The court found that a whole lot of computer code that's intended to be a roadblock to interoperability isn't copyrightable - great news for adversarial reverse engineers everywhere. Recommend reading.

Also it was an appeal to a preliminary judgement. The lower court said: okay, you're most likely going to lose so you have to stop selling these until we find out whether you lose. The appeal court said: actually this case is almost completely bogus and you're probably going to win, so you can keep selling them.

It's not effective technology if it is secure via obscurity. If it fits on a shirt, you're also fine. The key here (pun intended) is to publish it and show how obvious it was to reverse engineer.

https://www.cnn.com/2000/TECH/computing/09/08/decss.shirt.id...

Consider publishing the prompts used to create it.

Instruct the AI to output an .MD file that can be used to reconstruct the code

Very little value in the prompts imho, anyone can point their LLM to that post and it’s enough

Any company would be a fool not to send a C&D given how many people on this site seem to think that "I got a C&D" means "if I don't obey it, I'm gonna get sued."

Anti-SLAPP laws exist for a reason, and if corps can bully anyone, how is it that corps routinely lose lawsuits on either side of the docket, hmmmm?

Keep licking that corporate boot, folks. Corps send C&Ds because they cost them all of maybe $100-200 and they're so effective.

There is a long road between "got a C&D" and "am getting sued." Among other things, a judge is going to want to see that both sides attempted to negotiate. If the company sending the C&D just demands that and then tries to file suit, the judge is going to tell them to go back to step 2 and stop bothering him/her.

Folks, stop telling people that if they get a C&D they have to just fold. Good chance you never hear from them again because the cost of suing you is nowhere near the damages they will be able to prove in court.

> There is a long road between "got a C&D" and "am getting sued."

Sometimes!

The average mortal cannot afford negative backlash, financially or otherwise, to their living situation.

> the cost of suing you is nowhere near the damages they will be able to prove in court.

The problem is, the one advising them whether to sue or not might not care about that at all, and might personally profit from a lawsuit. So they've got all incentive in the world to persuade their employer that they must pursue this or they will have given up priceless rights forever.

> Publish your codec

Put the code on the blockchain somewhere and it will be un-deleteable.

Reply on news.ycombinator.com