Hacker News Reader

Comment by nilved | Hacker News Reader

Can people realize by now how ludicrous it is that a bot or idiot is able to take down 116 repositories without any oversight or validation, and your only recourse is to (a) deal with it (b) take time from your day to jump through flaming hoops for bureaucrats? GitHub's brand of DMCA compliance is much like YouTube's: lazy to the point of unequivocally benefiting copyright owners, not content producers. Hosting your code on GitHub is senseless because anybody can take your code down at a moment's notice.

View on HN

> GitHub's brand of DMCA compliance is much like YouTube's: lazy to the point of unequivocally benefiting copyright owners, not content producers.

I believe the text of the DMCA is written to cause this. If you are an ISP, and you don't want to be liable for infringments, you have to take things down after receiving a DMCA takedown notice. The end.

You can put it back up after the user has followed the right procedure to challenge and assume liability themselves. I admit I'm not sure exactly what procedure the DMCA outlines for this.

I think what ISP's _could_ do is facilitate user's filing challenges more easily. But they've got to take it down after receiving a takedown request, that's pretty much what the law says (or else the ISP can be sued for the copyright infringement too).

Theoretically you can sue someone for issuing a takedown request in bad faith. Perhaps ISP's could help their users do this too, but it could get sticky for them.

Now, I guess, if an ISP ignores a DMCA takedown request, all that happens is that they too can be sued for copyright infringement of the content.

Now, I guess an ISP _could_ individually evaluate each DCMA takedown request, decide that some of them are completely illegitimate and there was in fact no infringing material, and thus that they have little legal risk to leaving it up, and probably nobody's going to take them to court over it, and if someone does, the ISP will probably still win and they're willing to deal with it.

I think it's pretty obvious that it's not really reasonable to expect a business to do this (by assigning an actual lawyer to evaluate every request? By trusting less trained/certified people to make the determination? Even paying them minimum wage it's probably not affordable), although it would be pretty exciting if one decided to anyway.

You can't ignore a request. But you can make them work for it. For example:

http://www.diynetwork.com/about-us/dmca-digital-millennium-c...

You _can_ ignore a request. You'll just be liable for any potential copyright infringement on the content you ignored the request to takedown.

But yes, effectively, it is not reasonable for a company to ignore the takedown request.

"Theoretically you can sue someone for issuing a takedown request in bad faith. Perhaps ISP's could help their users do this too, but it could get sticky for them."

This needs to be done by larger companies. Right now all a person has to do is claim copyright infringement, and companies take down. There is a guy on Ebay who claimed he owned the copyright to a old watch making school workbook(Chicago School of Watch Repair). Well he didn't own the copyright, but Ebay wouldn't even bother to look into it. There should be clear penalties for falsely claiming ownership to a copyright? I understand small companies caving in, but larger companies should do a little due diligence?

> This needs to be done by larger companies. Right now all a person has to do is claim copyright infringement, and companies take down.

Yes, see, that's the law. That's the way the DMCA is written. If someone files a DMCA takedown, companies have to take it down (or risk liability themselves). Right.

To change it, Congress would need to change it, there's nothing larger companies can do.

And now we live in this wonderful world where companies don't actually file DMCA takedowns at all, but rather have gentleman's agreements to take down content in a manner indistinguishable from the DMCA except the part that actually gives the uploader any legal recourse to challenge it. :-/

The hope is that this sort of shit hastens the hardening of the Internet to the point where anyone can host whatever the hell they want, anonymously, with no possible recourse for any old asshole to do anything about it, DMCA and laws be damned, and supported by default by all major browsers and operating systems.

Do you think you could start a class action lawsuit on this basis? If companies aren't going to bother to stand up to this, and individuals don't have the money to do so, then short of actually fixing the law, class action suits seem the only (legal) way forward. But proving that a significant enough portion of takedowns are illegal might be difficult.

There's an EFF fair use test case involving a YouTube takedown of a toddler bouncing around to a 29 second clip of a Prince song playing in the background: Lenz v. Universal. It was filed in 2007 and has yet to be resolved.

The fact is that while section 512(f) of the DMCA provides consequences to misrepresentations by those making takedown requests, it is damned impossible to actually enforce that.

Now I'm wondering if it's possible to DDOS a DCMA takedown system with a randomized spam of takedown requests.

You know, like a mad-lib "Your site has our content askjdh12312312.avi on the link yourtube.io/5h0rtur1/ and must be removed to comply with yadda yadda yadda".

It's probably five kinds of illegal and three kinds of immoral, though.

A normal DMCA takedown request is taken under penalty of perjury (sadly, a lot of the big common carriers, like Youtube, have gentleman's agreements with Big Media, so they don't rely on formal DMCA takedowns), and knowingly and falsely claiming to be the copyright holder is likely an infringement of the author's moral rights, which is at the criminal end of copyright law, so that's two flavours of illegal right there.

Also questionable is how the computer that sends out the e-mail can have a "good faith belief"? Especially given that their detection rates are often abismal.

You are free to counter claim and go to court spending $xxxK on lawyers to test it.

One of the big problems with the DMCA and a lot of similar laws is that they have no built-in protections for abuse. Anyone is allowed to claim anything and because of legal fears, many content hosts immediately side with the alleged copyright holder when there is no proof whatsoever. The only way I can see this not being a problem (other than a repeal of the DMCA itself) is if such actions start to have consequences.

Bot or not, this is an intentional action by Qualcomm. Github should push back against this if it wants to remain credible in the open source community. Are there some general provisions in the law that allow it to respond to abuse (which this is a clear case of) with their own lawsuit?

Of course, the Qualcomm repository should be pulled. Permanently.

Someone should make a bot that DMCAs accounts belonging to employees and their connections in the parent company. For each unverified DMCA they enact.

They're the employees who will have to get in and make changes to the system and they work for the companies that have to make noise and say no to the DMCA issuers.

If they blanket exclude their own employees of the policies everyone else has to abide, well, that'll say something won't it. There seems to be no negative effect of making false DMCAs so play that game.

> There seems to be no negative effect of making false DMCAs so play that game.

Unprosecuted crimes (e.g. the perjury one must commit to file a false DMCA notice) have a strange way of suddenly becoming prosecuted crimes when people act in blatant disregard for the law.

I believe there's only a perjury penalty if you misrepresent the fact that you are authorized to act on behalf of the copyright holder.

So if you say, "I'm requesting you take this down because it infringes on Star Wars and I'm an authorized agent of Disney" when you have no relation with Disney, you're up for perjury.

However, if you say, "I'm requesting you take this down because it infringes on blahblah.avi and I hold copyright to blahblah.avi" which is true, then no perjury penalty. Even if blahblah.avi has nothing to do with the github repo being taken down. "Oops, my bad, honest mistake, wink wink." The person on the receiving end of the DMCA still has to jump through all the hoops to get their own copyright material reinstated.

So if you do your bot right, there's no penalty. None at all. If there is, I'd love to know about it, because these bots need to die in a fire.

You can claim damages against a false takedown, it's just really hard. The only notable case I know of is OPG v. Diebold http://en.wikipedia.org/wiki/OPG_v._Diebold

I wasn't aware of that case. Thanks. I found sec 512(f) here:

http://www.law.cornell.edu/uscode/text/17/512#f

The most worrying part is the flip side, which is the takedown notice must state that “under penalty of perjury, that the information contained in the notification is accurate.” [512(c)(3)(A)(vi)]. In fact, here it is[1]:

> Qualcomm is the owner of an exclusive copyright for each of these documents. Cyveillance is authorized to act on behalf of Qualcomm, and has a good faith belief that the publication and/or disclosure by your web site is not authorized by Qualcomm, any of Qualcomm’s agents, or the law. I certify, under penalty of perjury, that the information in this notice is accurate.

The pertinent document: https://github.com/CyanogenMod/android_device_sony_huashan/b...

[1]: https://github.com/github/dmca/blob/master/2014-07-02-Qualco...

Honestly, I'm ok with this. The specific case is dumb, but I can't imagine a change to the laws that could make things better. You can't outlaw dumb.

Recently I found that one of my popular posts on startups had been boosted without permission or credit by some wannabe-accelerator in Texas. I filed a DMCA request and their host took the page down promptly. It just worked.

I'd hope Github is doing some basic checks on requests like this. But I don't want them to try to become a mini-court. We already have a perfectly good court system for resolving ownership disputes.

> We already have a perfectly good court system for resolving ownership disputes.

Patent trolls are ok too ?

I gather you must not be a native speaker of English. "Perfectly good" does not mean perfect. It means something like "serviceable" or "adequate for the purpose at hand":

http://www.theonion.com/video/nations-parents-release-annual...

http://www.urbandictionary.com/define.php?term=perfectly%20g...

Ha. Great reference.

> I'd hope Github is doing some basic checks on requests like this.

You're not allowed to do that without losing the safe harbor provisions of the DMCA. Anything that shows up that matches the format must be obeyed. That's why counter-notifications exist.

Are you sure about that? My guess is that if I, say, forge some DMCA notices as being from major media companies trying to take down stuff belonging to other major media companies, YouTube will happily ignore me.

Certainly I don't see anything in the law itself that prevents them from verifying that the notice actually comes from the entity claimed, or saying, "Hey buddy, are you sure you really own that?" Which is all I meant by basic checks.

Are you aware of some case law that demonstrates otherwise?

My guess is that if I, say, forge some DMCA notices as being from major media companies trying to take down stuff belonging to other major media companies, YouTube will happily ignore me.

On what do you base your guess? Because as I understand it, your guess is 100% wrong.

On a few things.

One, if I read the safe harbor stuff correctly, then if you ignore a DMCA notice it means you can now be sued for hosting the content. If a host decides they are willing to run that risk, I believe they can happily ignore a DMCA notice.

Two, basic business knowledge. YouTube partners with a lot of the major media companies, and taking down large volumes of their stuff in a way that looks dumb would harm their partnerships. Companies are very reluctant to bite the hand that feeds them.

Three, if someone could take down everything on YouTube by forging a zillion DMCA notices, I expect some enterprising troublemaker would have done it long ago just for the lulz.

Ok! Your turn. What's your evidence? Because that's what I asked for before and nobody replied.

Some companies seem to believe that the "losing the safe harbor provisions" risk is in respect to that particular dispute rather than in general. If so, they can knowingly take that particular risk by questioning a particular notice.

I'm not a layer, but I don't think so. IMO if they don't comply, they can be sued for copyright infringement caused by ignoring that notice. If there is no infringement, there is nothing to fear.

These type of bots have many problems. I have see similar situation on Youtube where a content provider mistakingly takes down their own content along with the infringers.

Also, I have heard of this happening with people sharing open source software on bit torrent. This isnt the original article I read but the closest one I could find.[1]

[1] http://max-technology.blogspot.com/2008/12/open-source-torre...

CDA §230 could be amended to immunize intermediaries for all liability for copyright violations (just as they're immunized for liability from other civil lawsuits).

Even in a notice and takedown system, the time required to act on the notice could be increased to ensure that the target has an opportunity to counternotice, and the counternotice could be made immediately effective, rather than effective with a delay.

I think the first would make it useless for purposes of enforcement, so I think that's a bad idea.

But the opportunity for counternotice seems like a great idea, perhaps including some discretion for the hosting company. When the DMCA was written, they would have had to allow for a relatively long period. But now that we all have the internet in our pockets, it seems like a few days or maybe a week would be plenty of time.

> "Hosting your code on GitHub is senseless because anybody can take your code down at a moment's notice"

While I agree with the sentiment, this statement is a bit extreme. Especially since it's a distributed system so you're not exactly losing your work. Also, you can get it back online if you jump through the flaming hoops. In reality there is no better option for hosting OSS code right now than GitHub.

> In reality there is no better option for hosting OSS code right now than GitHub.

You're right that your code isn't permanently lost, but you're wrong that GitHub is the only option or even the best option for hosting your code. GitLab and gogs are incredible pieces of software and if your needs are small, you can even just use cgit or the built-in gitweb tool. DigitalOcean is one host that can trivially provision GitLab instances.

I've hosted my own git server for about a year at https://stealthis.ca. It costs less money than GitHub's cheapest plan and supports unlimited mirrors and private repositories with any amount of collaborators. It also has never went taken my code offline, ever, for any reason. You can guess what'd happen if somebody sent me a DMCA request.

Github costs $0 and 0h of admin work for OSS code.

If you don't include "regaining access to your code because you upset somebody and they filed a false DMCA complaint that GitHub blindly obeyed" as admin work then you're indeed correct!

Hosting your code on the internet may be taken down at a moment's notice. If you host it on your own domain it may be confiscated.

It's what the law requires. GitHub, YouTube, etc... don't have a choice in the matter. They are required to take down the content until they receive a formal counter-notice from the recevier of the takedown.

Reply on news.ycombinator.com