No, you just have a hash of the "official" version of the list. And when the list needs to be updated, the person with the private key publishes a new list again.
The advantage of using the bitcoin blockchain, for example, is that it can't be censored. DMCA trolls now have to go after every single bitcoin company in the world, to stop them from "hosting" the copyrighted work.
IPFS dev here. We are quite close to having git being hosted directly on IPFS/IPLD. Things like pushing and cloning work. Example workflow:
git push ipld::
<prints out CID of that commit which has 1:1 mapping to hash of the commit>
git pull ipld::$CID
<or>
git clone ipld::$CID
Important fact is: the git objects are stored in native git format. Hashes are the same, but are pretended with CID header (content identifier) which tells IPFS how to understand links and content of this object.
We plan to work on remotes in close future. There is one more issue where our measure of DoS protection causes that repos with files bigger than 1MiB+ (or 2MiB, I can't recall) can't be fetched. It will be a bit harder to fix but I know we can do it.
If we could only remove the logjam in congress right now to get some real work done... currently the two parties are deadlocked in a power struggle and have completely forgotten why they're there.
> currently the two parties are deadlocked in a power struggle
You mean since about 1790? There have always been two parties in congress (minus the era of good feelings) and they have always had opposing ideology, and have almost always blocked one another's proposals.
It is very naive to think the current Republican congress is anything different or new. Their inaction is intentional - they need to pass their anti-citizen legislation they were appointed for when people are not watching them.
It is also somewhat inaccurate to blame it on "deadlocked parties". The factions within them to varying degrees stifle them. The parties aren't monoliths of ideology that uniformly vote the way the chair swings.
If congress isn't passing good legislation, its because the constituent members of that congress aren't a majority good actors. Regardless of color. Regardless of excuses given.
Politicians always act in the interest of someone. Sometimes its themselves. It used to sometimes be for their constituents (because they had to appease them for votes). Today it is mostly for corporate campaign donors. And those donors want the status quo. They don't want the changes average Americans want. The whole point of their buying and owning of politicians is to impede change. Of course a congress filled with men told to maintain gridlock and prevent reform by their masters will do so, and they do it in a way optimized for themselves - by always blaming someone else and taking no responsibility for the gridlock you cause, your base can just keep reelecting you despite hating congress in general. As long as the voters remain ignorant to this con, the business interests get what they paid for - usually corporate welfare.
It's true that partisanship and the two-party system have been a fixture of our system from the very early days. But there are matters of degree, and the degree today is at a peak.
> You mean since about 1790? There have always been two parties in congress (minus the era of good feelings) and they have always had opposing ideology, and have almost always blocked one another's proposals.
That's by design, actually. The goal was never to create a government that can efficiently create a million laws and regulations.
The point of having multiple parties is that each of them will block each other and only the laws and regulations that everybody can agree on will actually get through.
Unfortunately, politicians have been learning to game the system for ~200 years now, and it's not working exactly as designed.
Another big difference lately seems to be that everybody's an extremist because nobody can change their mind or compromise without getting called out in the media for back pedaling or giving up or "working with the enemy" or whatever.
> The point of having multiple parties is that each of them will block each other and only the laws and regulations that everybody can agree on will actually get through.
Gridlock is part of the design, yes. But consensus or unanimity are not. The simple majority rules, except for the cases defined in the Constitution, such as constitutional amendments. The Senate's filibuster is not how the Senate is supposed to function.
There is way more money in politics now than there was in 1790. Hell, there is way more money in politics now than there was in 1970. It's the root of all evil, it really is. Name any malady you want of our current system -- at the end of the day I guarantee you it is in some way attributable to somebody buying influence at some point.
Most legislation needs 60 votes to pass the Senate, which means you need at least 8 Democrats (counting the two independents with them). Legislation which Republicans can pass by themselves is the exception, not the rule. One of the problems they had with their health care bill was that it had to fit into the narrow budget reconciliation rules so that they could pass it with a simple majority.
Confirmations are quite different from legislation. Most confirmations had already been reduced to only requiring a simple majority. Supreme Court was the only remaining position for which a confirmation still required 60 votes.
There doesn't appear to be any movement toward changing the rules for legislation. If they were willing to do that, they wouldn't have tried so hard to squeeze the AHCA under the budget reconciliation umbrella.
Sure. They can change the rules for legislation in much the same way they were willing to do so for Supreme Court nominations, and do it without Democrats. That confirmation rules are the same as legislation, or that Republicans were willing to use this option is obviously not what I was trying to say.
Well, the President is the member of the Republicans that is meant to control the presidency. If that Republican cannot control himself then I don't think the rest of the Republicans would have any Democratic obstruction to worry about if they wanted to replace him with someone who does.
Are they really though? Is it obstructionism to vote no on something that you wouldn't have voted yes on even if it had come from your own party? Voting no on a healthcare bill that has been given a terrible score by the CBO and most healthcare groups and is going to increase the number of uninsured by millions [1] is not obstructionism.
The ACA was debated and discussed for over a year, it was very moderate compared to what most liberals would have wanted and the democrats had to make concessions [0] just to get 1 or 2 votes and those who voted against it hadn't bothered really to propose anything to the contrary. The repeal plans were rushed, were going to hurt tons of people [1]
Obstructionism is taking something that would usually be a no-brainer or that were your party to have suggested it would have sailed through and turning into a crusade and I haven't seen any of that, unless you can point it out for me.
Libertarian here-- what makes you think that the two parties working together will increase our liberty in regards to the internet?
The logjam keeps the parties from working together to create new inefficient programs, expand others, increase spending. The logjam is _great_ and frankly I hope it continues.
They never forgot why they were there, it's just that the reason (self enrichment, both financially and in terms of power) isn't the one US citizens believe it's supposed to be.
Do you have some good examples of what people would consider obstructionism coming from the Democrats? Its easy to find over Obama's 8 years, but how much consistent obstructionism have the Democrats engaged in? Every single minor thing under Obama was an absolute catastrophe, every budget every debt ceiling, pretty much no matter what. For some reason both parties get equal "credit" for the lack of progress but I can't personally see it that way though I try to have an open mind.
When having a discussion with someone about obstructionism I like to point to instances on both sides, and if it seems one side has twice as many that make a difference to me and I refuse do acknowledge that they are truly the same, numbers matter.
The unfortunate truth is that there are mostly only much more authoritarian countries to fill any leadership void left by the US. As flawed as it is, and as flawed as Trump is, European countries can only step up so much to keep liberal democratic societies as the global ideal.
My worry is that the current regimes of Russia and China are on the political upswing faster than the European experiment and struggling or young democracies in the developing world can stand the test of time.
Enthusiastic participation by America in upholding the idea of liberal democracy (even when it's imperfectly executed) can tip the scales.
The way that happens is by the head of the government reversing course as smoothly as possible from admiring and praising autocratic regimes to giving hope and comfort to democratic allies. Whether it's President Trump, Pence, or fucking Mark Zuckerberg doesn't make too much of a difference in that regard.
Dotcom was accused of doing things that are illegal in both the US and New Zealand (and around 200 other countries...). That's why New Zealand cooperated with the US's extradition request, including raiding Dotcom for the US.
He may not be the best example, but there are others who have been bitten by things as trivial as "routing data through U.S. servers" (including through a CDN).
Would forking really help or is it because it's hosted on github? I mean US citizens would still contribute. Together with a lot of people from other countries. But moving it to a European server with a European domain should increase their safety from those takedown requests, but also limits their impact when you're not on github anymore.
I've never had a mouse where it wasn't a problem. I don't buy uber-quality mouses, so I'm down in the trenches with the vast majority of mouse users with moderate-to-low quality hardware.
I'm also often using a laptop, on linux, and I do the middle-click-simulation (both buttons at once) with two hands, which is really annoying. I suppose I could fix it.
Also I always have my left hand on the keyboard, so for me it's not a problem to ctrl-click.
Ctrl+click doesn't work on a tab, though--have to hit the X.
Some of the websites that do that have solid content though. Not good enough for me to pay them though so I end up clicking the back button and using alternative sources.
why? what if sites are rewarded based on time user spends on it actively? what if websites just sign up to be part of the network, and uses common api (think: subscriptionService.isPaidUser() { show content } else { say "sorry" }
You realize that everyone CBS, Disney, everyone is starting their own subscription service and (for many) pulling out of Netflix.
Besides grasping at maintaining stranglehold over distribution. They are hoping to replicate the cable model. Pay for the base package where all the crap no one wants is, then pay for all these extra premium packages.
Well, the sites that currently fund operations through ads would have to fund them some other way, right? I think many of them would transition to other business models, scale back, or go away completely. I think you'd also see a sharp rise in types of sponsorships that look less like traditional ads and aren't as blockable, like when The Onion has funny original content about cooking at home brought to you by Blue Apron.
If I'm really interested, I might open the inspector and delete the offending div, but often scroll is still hijacked or I'll delete div after div up the stack only to accidentally delete the content too.
It's a pain and it's often easier to use the cached version from a search engine or some archiving service.
I always enable ads on a URL if it asks me to (provided they don't over advertise/have spammy advertisements), kind of already feel shitty about what is effectively stealing content for free so those notices just make me conscious of the guilt.
I wonder how others rationalize blocking ads and not subscribing either but still feeling entitled to access the content.
I block all ads because my safety is a higher priority than the site's profitability. Internet ads are a malware vector, with no accountability. Also, advertising companies have made an art out of psychological manipulation; I protect my mind by filtering their input from my senses.
Just saw your subscription update. Why would I subscribe to something that I am unlikely to return to?
The only solution that I can think of, are micropayments. Perhaps this financial pressure will motivate the powers that be to eliminate roadblocks to its implementation.
I don't feel guilty about it, just like I don't feel guilty about not reading ads in magazines or newspapers.
If you put something on the web, and you want me to pay for it, put up a paywall. If you want to instead serve ads, don't expect me to read them (or load them, even). My bandwidth, my decision.
I don't feel entitled to access arbitrary content. But by the time a web server has already sent it my way for free, I don't give any fucks. If they can't afford to do that, then they shouldn't do that. But they probably do it because they can afford it, and find it profitable enough. I'll be happy to leave if the site sends me a paywall instead of content.
Unless it's The Atlantic, which blocks all article access from my iPad even though I'm a subscriber. I can read their content only with a computer-based browser (with ad blocker, of course).
I contacted them about this, actually. I subscribed to The Atlantic's digital edition expecting ad free: it turns out you need to specifically get an ad free subscription from them. The one offered on the block page is what you need or it doesn't count.
Bonus: After I asked The Atlantic, they partially refunded my subscription and a magazine arrived at my door (for my now cancelled and partially refunded digital only subscription).
Call me crazy, but this seems like a pretty honorable scheme for profiting off of content.
Someone put effort in to create content, and has the option of putting this kind of paywall up. There is a consumer choice made to sell their own attention by viewing ads, pay a subscription fee for the content directly, or just move on to free content elsewhere.
That said, most places where you pay the subscription fee will ALSO show you ads and silently sell your data, but still... The above scheme feels reasonable in principle.
Publically accessible content simply wants to have their search engine pie (public content) and eat it too (paywall).
Ad-blocking makes sure they have to make the hard choice of putting content behind authorization. A user-agent's job is simply to be the user's agent, and not the publisher's monetization platform.
Perhaps. They are losing people like me though. I will never pay for a subscription to read a website and I will continue using adblockers to get rid of annoying ads.
But they could still profit from me. There are less annoying ways to monetize which I might accept.
For example affiliate links to buy products I am interested in (books, video games, gadgets). I'd be willing to pay % extra for some nice product in order a fund a website which pointed me to it. Or extra traffic I'd refer to their site.
There's no way that affiliate links can pay the bills for publishers; numbers don't ad up (otherwise everyone would do it, and no one does -- well, actually, there's extremely limited situations where it works in some consumer corners, but those situations are limited and the total amount of revenue is also very limited). And how much extra traffic are you really going to refer? Ads are sold on the thousand -- $X per thousand (consumer can be cents up to maybe $8, B2B much higher). So even if you referred 200 people that's not even worth any effort. Unfortunately, if you're not going buy a subscription, register for a paper or click on an ad, you're probably not worth anything to the site anyhow.
But they would not make any money via ads from me anyways. I never click ads unless I do it accidentally by mis-clicking. So even with disabled adblocker I'd just lower their CPC (cost per click). So it costs them nothing to let me read their website with adblocker and there a tiny possible upside from me referring more traffic to them.
Either way I assume people like me are a fast growing part of millennial population so their business model based on ads is doomed to fail anyways.
Click throughs aren't necessary for advertising to work. A lot of it is to prime your subconscious, or strengthen associations. This is why Coca Cola doesn't care if you click through. Same with car companies. When most Americans think of soda, they think of coke. If you prime their subconscious to associate soda positively with thirst, and soda is similarly associated with Coke, you've got them.
I don't understand the distinction between intentionally overpaying for products to benefit a website and just paying the website directly. Also, not all websites can (or should) talk about products.
Adblocking, at this stage, is about personal safety. Ad networks are demanding the right to execute arbitrary code on end users' machines, and have shown themselves to be completely incapable of vetting that code, leading to ad networks being a common and persistent malware distribution channel.
Which means that using the best available adblocking technology is a necessary personal-safety step on the modern internet.
doing so breaks an increasing number of sites. "so don't visit those sites" is the common response, and is fine as general policy, but sometimes isn't an option.
I have noticed that blocking scripts makes the pages of most local television stations break.
But then I look at the list of 50 different domains blocked on the page, and I am not sorry--not one little bit. I don't really need to watch your little news video that badly. And I certainly don't want it to autoplay.
They are by far the worst offenders among sites I am likely to encounter frequently, as destination links from aggregators and social media. Newspaper sites are far more well-behaved with respect to their scripts, but also more likely to directly monetize the page view.
I see some disagreement with you, but I am somewhat of the opinion that I agree (though I don't think it's a great "common user" solution.)
ScriptSafe is running and I allow some sites, trust a few domains, and the rest get, at best, temporary access to run local JavaScript if specific content I want isn't loading. I get the feeling the majority of sites don't even function without JavaScript at this point, and some intertwine their ad system with other "necessary" JavaScript, so it's tough to surf the web without some hassle.
I don't think this is a perfect or even passable long-term mainstream solution.
Depends on what you define as “to break”. Of all the sites I use most remain very much usable even without scripting support, but certainly some functionality is often lost (whilst performance, on the other hand...)
To me, disabling JavaScript often tends to fix websites. I consider ads, animation, interactive menus, scroll-hijacking, malware, and auto-playing videos to be broken functionality.
Yep. I do it in a slightly different way. I have uMatrix installed as a browser add-on to help control for privacy, fingerprinting, security etc. But it can also be used for stuff like this. Simply disabling scripts on many sites' root domain and hitting refresh solves paywalls and adblock prevention on a fair amount of sites. For others it obviously doesn't work and nothing will load, but it works on more than you may expect.
I think it's fair game to say "Our newspaper pays for quality journalists to do quality journalism, please consider subscribing or not using an adblocker on our site".
I prefer this to the WaPo model of paywalling or having a limited number of articles.
I do object to the Bloomberg model though, where they say "We notice you're using an ad blocker, which may adversely affect the performance and content on Bloomberg.com. For the best experience, please whitelist the site."
I agree it's fair game. But I think that message needs to recognize why I blocked those ads in the first place. It's not because "I don't like ads" or "I don't want to support you". It because the ads you were showing sucked: they bogged down my computer and they were malicious.
I would very likely unblock a site if they spoke to that. "We've taken numerous steps in the last 3 months to increase your privacy and eliminate bad, bloated, malicious, and frankly user-unfriendly advertising. We value and will not abuse your trust in allowing us to share advertising with you."
Absolutely agree. And for really large sites such as major news sites, there really isn't even an excuse for using any of the "normal" ad networks. There should be (if there isn't already) an ad network with only acceptable non-tracking ads that just show dumb images to people without worrying who sees shoes and who sees cars. I accept a shoe ad as relevant next to a shoe article, not because a Facebook friend sent me a PM with a picture containing a shoe yesterday.
Well, it sounds reasonable to ask that question if so many people have Adblock installed?
I have always blocked ads and always (try) will be, but I this is the outcome from Adblock going mainstream. Yes, the ad networks/sites were the reason in the first place, but it doesn't matter. Another side-product is (hidden) "native advertising"... so many tweets/share/likes are purely marketing. That gay marriage article Madonna tweeted? Think twice before you believe he does it out of morals, most likely she is being paid to share that out with her audience.
I've said this before, but it bears repeating. "Unblock or Subscribe" misses the point. The the point is this: I don't trust you.
I don't trust you not to show me scammy ads, load 2MB of tracking JS, maliciously redirect me, or generally ruin my overall user experience with your content you claim is so valuable. So I run an ad-blocker. I'm blocking your infrastructure because I don't trust it and blocking your ads because I question your judgement.
And the only other option you offer me is for me to give you my credit card number!? To infrastructure I don't trust and to a company whose judgement is in question.
I just globally turned of javascript, then enabled it on a site-by-site basis. I have been against this for a long time, but turns out I was wrong, and as a site effect this prevents most ads (it also makes sites loads fast).
What's to stop people from forking off that list and transitioning to another one? Like what if ad blockers just switched to use EasyList2 instead of EasyList?
Other countries have copyright laws too. Most of these laws have some kind of notice-followed-by-takedown protocol, and my understanding is that in many jurisdictions, a DMCA takedown notice qualifies as such a notice. Probably the only major difference would be the amount of effort the infringed party would have to go through to enforce the takedown notice if the infringing party is non-compliant.
> and my understanding is that in many jurisdictions, a DMCA takedown notice qualifies as such a notice.
It sounds a bit weird that a notice that has legal ramifications and is written in non-official language of the country would be legally binding. Or would American judges accept DMCA notice that was written in Spanish (I was considering using something like Comorian, but that's probably a bit too different case)?
I imagine it differs from jurisdiction to jurisdiction. If the law merely states something along the lines of the takedown notice having to contain the copyrighted work, the name of the copyright holder and some kind of assurance that the copyright holder is in accordance with the content of the notice, a DMCA takedown notice might qualify. Language could be a problem, but it would probably be hard to argue that you were unable to process a takedown notice written in english if your site is doing business in that language (which won't apply to every case, but presumably the majority).
For example, if you host this list in Russia DMCA will not do anything because (sorry for my French) Russia does not give a shit about U.S. copyright laws.
It's quite possible that Russian companies will not care about DMCA, but that's not to say Russia doesn't have their own copyright law, which includes a notice and takedown protocol. It's just a question of how much effort you want to go through to take something down.
Serious question: what does “hosted” means with a distributed system or repo? Ok, on Github you have the PRs and issues, but in the end it’s just one copy of the repo.
This is what you get when companies have all the incentive to file DMCA takedown requests and there's no punishment for filing a bogus one. And modern technology is making this problem increasingly worse, with all the automated takedown tools.
Don't joke. You really don't want to see these kinds of ravenous lawyers try to define website access not from an 'approved' browser as unauthorized access under the CFAA.
You could add to your TOS which browsers are approved. Using an unapproved browser would violate the current CFAA - under the current interpretation. Federal felony 1-5 years.
And then submit a subpoena for all users that have installed a user agent switcher plugin. Because clearly they're all criminals with nefarious intent.
1) Find a young eager numbers driven federal prosecutor near 'US District Court Of Wyoming'
2) Offer plea deals. Explain to the users of said 'hacker plugins' they can choose to take the 'risk' of a (confused local residence) jury or take the generous plea of 2 years of federal prison.
>From those cases, we distill two general rules in analyzing authorization under the CFAA. ... Second, a violation of the terms of use of a website--without more--cannot be the basis for liability under the CFAA.
They say this because (Id. at 1076):
>"Not only are the terms of service vague and generally unknown . . . but website owners retain the right to change the terms at any time and without notice." [676 F.3d 854 (9th Cir. 2012)] at 862. As a result, imposing criminal liability for violations of the terms of use of a website could criminalize many daily activities. Accordingly, "the phrase 'exceeds authorized access' in the CFAA does not extend to violations of use restrictions. If Congress wants to incorporate misappropriation liability into the CFAA, it must speak more clearly." Id. at 863.
Interesting. TOS can't be a 'catch all'. There needs to be another criminal intent. But, wouldn't using the plugin to avoid paying for the service be the other crime? Seems like two crimes? Which would satisfy?
No. It's appears to be a weird situation, described poorly by all sides, each of whom appear to be highly concerned with promoting themselves within their explanations.
A. Nobody - NOBODY - is ever punished for violating.
B. The folks in question here think they have a colorable argument for why it really is DMCA. As linked from the OP, this is here [1]. (FWIW, I think it's silly)
Nobody is punished because the DMCA claim/counterclaim process gives them a chance to back out of the claim before it goes to court. And the word is that if it does go to court, proving that they willfully and intentionally misrepresented their ownership of the material under question is a very high bar; it would probably require some internal memo with content approximating "We know we don't own X but let's issue a DMCA against Y for hosting X anyways."
In the US the "justice" system is predominantly accuse first ask questions later, and because legal council is insanely expensive (by design) in most cases all you have to do is accuse someone of something and it will either bankrupt them trying to defend it or they will pay you off to let them go.
It is incredibly broken and corrupt, but like many things in the US nothing will be done about it because the elites have the money to defend themselves and enjoy the benefit of being able to ruin anyone they want who don't have access to similar financial resources that they wield.
If you can afford the several hundred thousands to millions of dollars a protracted legal battle will take you can often get the costs dumped on the losing party. You just have to spend years getting there with your own money and time.
The problem here DMCA is that there is a way to prosecute for a false notice, but it's not the one people want it to be.
Most people hear that DMCA notices are sent under penalty of perjury and think that means "if there's no reasonable claim of a copyright violation it's perjury". But the part of the notice that's made under penalty of perjury isn't the claim of violation, it's the assertion that the person sending the notice either holds copyright to the work in question or is authorized to act on behalf of the entity that does.
So to nail someone for perjury from a DMCA notice, you have to prove that they don't hold a copyright, or aren't authorized to act on behalf of whoever does hold a copyright, to the work in question. "This isn't a copyright violation" doesn't do it.
Wonder if we could create a git in the blockchain... where DMCA just can't exist/happen since there's no central authority to ask to take stuff down...
If by "internet" you mean your browser/over HTTP, then yes. But the IPFS client provides exactly that, on your local machine, without any restrictions. If you offer it to the public, you can choose your own policy on copyrighted etc. content.
Copyright law doesn't care what technology you use to store and distribute material. If you have a blockchain that contains unauthorized copyrighted material, any host participating in that network would be legally subject to DMCA requests by the copyright holder. What would the defense look like in court, anyway? "We can't stop illegally distributing the plaintiff's content because that would break the chain?" In effect it would just be a spectacularly inefficient distributed storage system.
You are overlooking the fact that there is no actual DMCA violation in this case. The problem is that companies being bullied with frivolous DMCA threats will comply because it is easier than fighting it. Using a blockchain removes this as an option (and also makes the bullying pointless in the first place).
How would that work though? DMCA only applies to the US, so with a global network how would the DMCA be effective? Even if every node in the network in the US removes it, all you might achieve is break the chain. The content will still be there.
The same is true of any other distributed storage system. Adding a blockchain doesn't change the situation in any way, other than making complying with the law far less convenient.
Though I should add that while the DMCA is indeed a US law, and notification and enforcement mechanisms vary by jurisdiction, other countries also have copyright law. It's illegal to publish copyrighted material without permission in any country with a copyright system. That's what copyright is.
Only if you delete all and any memories you have of the domain. I suggest a bottle of strong alcohol.
If the contents of the bottle doesn't facilitate in aforementioned memory deletion, usage of the bottle to apply liberal amounts of blunt force is suggested.
This seems a bit hyperbolic. If you believe there's a battle between ad servers and ad blockers, it's obvious the ad blockers are winning by a lot.
IANAL but this seems like a questionable use of DMCA Takedown notice which, in any event, isn't actually binding. EasyList could probably file a counternotification and risk a lawsuit.
I didn't realize that anti-adblock lists were generally maintained separately, and this comment tipped me off to it.
If you're using something like uBlock, it might be worth going into Settings -> 3rd-party filters. There's a few lists in there which are not enabled by default that are curated to work around anti-adblocking technologies. For example, "Adblock Warning Removal List".
If you're going into uBlock's settings, don't forget to add the domain this whole this is referring to (functionalclam.com) to your custom block filters.
Could this comment alone be considered infringement and be subject itself to a DMCA takedown? You are instructing someone how to potentially bypass security measures for copyrighted works? /s
Just encode the list of urls with htmlentities, base64, rot13, whatever. Then the DMCA can't be used to attack it.
Edit: Disagree? Please comment. It's attackable via the DMCA because the word/brand is in the file in it's copyrighted form. If you encode it such that it isn't in that form, it's protected from that approach.
That's what I'm getting at. The DMCA complaint should have been rejected. It wasn't because the people filtering the incoming requests are using a simple high pass filter of "is this text on this page". So, if you encode the data, you remove the ability to use the DMCA inappropriately.
There are two aspects to your question which are tangled together.
1. Can IP be encoded as a way of dodging the DMCA? a: no.
2. Will encoding the source material allow you to dodge DMCA trolls?
I think the answer is again no. The tradeoff in complexity isn't worth the marginal gains. Imagine not being able to browse the code on github, for example, since it's encoded.
A better response is to fight. If the DMCA has been abused, it's up to us to meet each claim with energy and on the same battlefield. It's tiring work, but this is the compromise America has reached circa 2017.
It is just removing an easy, incorrect loophole. They are getting away with the DMCA complaint filing because most providers will allow them if you can find the "matching infringing text" on the page, without further justification.
Encoding it forces the DMCA filer to more comprehensively explain what is being violated. Basically it just raises the bar to a point where frivilous complaints can't clear it.
No one is getting away with the DMCA complaint. The target in this case did not file a counter notification. If they'd done that, then the DMCA complaint would be invalidated.
You can argue that's unfair, but we don't have a justice system. We have a legal system. And these are the rules.
Encoding it forces the DMCA filer to more comprehensively explain what is being violated. Basically it just raises the bar to a point where frivilous complaints can't clear it.
I think the crux of the disagreement is that I've seen how tenacious DMCA trolls are. They're smart. We like to think of them as dumb, but that's just flattery.
If you're trying to apply technical tricks to get around the legal system, you generally lose. The way to win in this case is to meet force with force on the same terms: file a counter-notification.
I think you're underestimating how valuable it is to have the content un-encoded on github. Anyone can see it. Flip through their commit logs. They have dozens of contributors that add or remove URLs almost daily. That wouldn't happen if it were encoded.
Filing a counter notice has risk...being right still has costs.
Obscuring it makes the DMCA filer have to better explain the why in the request. Something more than just "this short piece text is on this page and I don't like it".
Technical solutions to get around the legal system can work quite well. Just go ask all the not-in-jail users of The Pirate Bay.
Github is a very above the table solution for distributing a list of things. But if it gets to expensive to host it there, due to frivolous lawsuit threats, I expect other solutions to distributing these lists start to pop up.
The best advantage of encoding or even encrypting this stuff would be obfuscation. It would make is much more difficult for someone to even become AWARE that they are being blocked, if the info is hidden.
Not everybody has the resources to fight off trolls, even if what they are doing is completely legal (as in this case). Sometimes technical solutions are your only option.
I'd be interested in examples of technical solutions evading the legal system. The Pirate Bay example is mistaken -- there are millions of people that use Pirate Bay with no VPN with no ill effects. But if you have specific, correct examples, then this is an area of some interest for me.
Regarding your point about obfuscation, I feel like people aren't thinking this through. It's on Github. The commit messages are public. Finding whether you're blocked is as simple as grepping the logs for your domain. And if you feel the people filing the DMCAs aren't technically capable, you may be underestimating them.
The advantage of having it on github far outweighs the negatives. How many contributors do you feel they gained from this publicity? Possibly at least one, which is one more than EasyList would've had otherwise.
Encoded, not encrypted. I can't be violating a copyright with text that can't possibly create brand confusion, etc.
The DMCA complaint is patently invalid in this case. A counter notice would almost certainly eventually succeed, it's just a lot of work and potential spend in legal. Encoding it is just removing the ability to use it inappropriately in the first place.
"brand confusion"? You seem to be conflating copyright law with trademark law. If I had a copy of "Steamboat Willie", it wouldn't matter if it was H.264 encoded or md5summed or stored in an AES locker, it's still a copyright violation because I don't have a license for the content.
I'm not, the filer of the DMCA is. How else could just a uri being on a page cause a DMCA takedown of a page? That's what happened...they filed a DMCA because the text "http://whatever" was on a github page. Which sounds a lot like meaning trademark, but saying copyright.
That's why I don't consider this underhanded. As you mention, it's not copyrighted in the first place. Obscuring it is just closing the loophole that's being exploited.
I'm not talking about obscuring long passages of copyrighted text. Just obscuring one plaintext url that's on a page with others.
The project maintainer wanted to take it down. He has gone on record saying that the url shouldn't have been there in the first place, regardless of the DMCA.
If you put an encrypted blob on each line instead of a plaintext url, the DMCA notice will contain "My copyrighted work appears at <link to github line number> which decrypts to <my url> when using <decryption method>." It's exactly the same as the original claim. If you feel they're not technically sophisticated enough to file a claim like this, I think we'll have to agree to disagree.
In practice that "when using" stuff doesn't work. The DMCA request is denied by most providers if they can't see "the text in question".
This is from experience. Scrapers that change one or two words in a long passage of text getting away with it because it doesn't match. Or very lightly cropping 1000's of original photos. I will cede that it depends on the provider. Google and many others do some rudimentary checking for sanity before allowing a DMCA request. They would never have passed this one, where just a short piece of text was claimed as infringing.
How would encoding help? It's already encoded! That repo contains the bits:
0b11001100b11101010b11011100b11000110b11101000b11010010b11011110b11011100b11000010b11011000b11000110b11011000b11000010b11011010b1011100b11000110b11011110b1101101
which is the ASCII _encoding_ of the forbidden string.
Just because these bits are an EBCDIC cp500 encoding of that string doesn't make it less forbidden than an ASCII encoding:
Because of the light touch string matching that providers do before complying with a frivolous DMCA request. Most will deny the request if they dont see "the text".
And reduced discoverability that your url is on my page in the first place. Even though a url isn't something you can copyright.
Am I the only one who thinks its laughable that adding their domain to a blocklist "circumvents" their protection technology? If I was a content provider I don't think I'd want to rely on something so flimsy.
Good idea, had the same idea, but we need (the community/users need) to be able to determine what the URLs are, for transparency. So I suggest ROT-13 instead.
I don't see how this would work when the URL lists are full of regexps etc.
If you could make it work, you'd would wind up with some sort of source file of domains, parsed at build time to generate list of hashes that actually ship with your plugin. That source file would belong in a repo, and would still be DMCA-able in this way.
Also, this would make ad-blockers even more CPU intensive than they are.
We shouldn't have to pursue a technical solution. It's my computer, it's my internet connection. If I'm not allowed to control my own property, then the concept of property becomes meaningless.
>I don't see how this would work when the URL lists are full of regexps etc.
I guess you could distribute a compiled finite automaton instead of a list of hashed values. It would make searching GitHub for "infringing lists" much harder (even harder than hashes).
Nevertheless, I agree with "We shouldn't have to pursue a technical solution". There's no point in trying to act like a Mr. smarty-pants in legal situations, as most technical solutions might not work out as expected in court.
Agreed with seeking a legal solution instead of just relying on a techincal one, but if the problem is the string of characters, just hash those instead without hashing the whole host:
>Also, this would make ad-blockers even more CPU intensive than they are.
Although they may be CPU intensive in terms of browser add-ons, I'm under the impression ad blockers are usually less CPU intensive than loading all the scripts required to display the ads, at least on particularly heavy pages. Does the CPU cost of blocker vs ads ever favor ads?
URLs are matched via a regex or wildcard type syntax, to eliminate files served out of /ad/ paths (yes, people still do this).
This makes hashes somewhat less useful. And a distinct hash of a URL could likely be considered to be the URL itself for the purposes of a legal action.
They even clearly state they used the only tool available to them, DCMA. From all the current summaries on this, DMCA does not apply to a line entry in easylist. A domain can be trademarked.
This should be added back in. And if github cannot standup to DMCA abuse, then well, easylist and all other developers should be giving a clear hard though to their continued use of the github platform.
So is their argument that by including their hostname in easylist, you are circumventing copyright controls because they validate copyrighted material usage? The takedown notice didn't seem to be related to the domain name per se, but rather the effects of including it in easylist. IOW in order to view our client's copyrighted material, we are providing access controls and by denying the code access to our server, you are circumventing those access controls.
Tangentially related, the author of that project has also created uMatrix. Well, it's the micro symbol, but you get the idea.
uMatrix is pretty much like an old school software firewall, except it is just for your browser. It works by whitelisting, instead of blacklisting. There is a bit of a learning curve, but after you've visited your most visited sites, it becomes a fairly easy solution. As you fist visit sites, you configure it to only allow what is needed to get the functionality you want. Once done, you don't generally have to muck with it further.
As stated, there is a learning curve. There are many choices of what to allow and block, but you can surely figure it out. You can even export and share your configuration.
I am not affiliated. There is a version for Firefox, Chrome, and my beloved Opera. It'll probably work in Pale Moon, Vivaldi, etc...
It eliminates the need for multiple extensions. I've been very happy with it.
I use ad-blockers in every browser and I would have no problem if that were part of the headers my browser emits ( have no idea if it is or not). If websites don't want to serve me because I'm blocking ads, so be it.
However, that defense is a bit flimsy to me since the fall back to having the paywall blocked could/should be a "Paywall blocked, please disable your addblocker to gain access to our content" msg.
Anyhow, that is immaterial because so long as they don't actually serve adds, Easylist could/would have removed the line no problem. Admiral should have just said "Our domain doesn't serve adds, we work on paid content access" and they would have been removed without all this hassle.
It's their fault for delivering data they want restricted. I'm under no obligation to make every HTTP request they want me to or execute any untrusted JavaScript. Nor am I obligated to render their HTML as intended. If they want these things then they need every user to enter onto a binding contract agreeing to those terms.
ah, but you might be. This gets into a crazy area where we're talking about some entity offering up information via HTTP and you choosing how to represent that data. You could use Lynx, Firefox, Chrome, IE or even just browse everything with Python/BeautifulSoup in a console. Does the provider get to chose how you represent that data?
Well it turns out they kinda do. Sites have terms of service people supposedly agree to, all the time, without reading, because it's fucking impossible.
I posted this argument before and got the following comments which make a good argument:
However the comments get into implementations like Netflix and rendering that data, but it's a bit different because in that case you are paying for access.
Will we be in a world one day where sites can require specific web browsers, by law?
That is not a problem because there will be competitors without this requirement. The problem is laws that are not well balanced and are biased towards interests of one party.
This argument really gets old. Morally you know what you're doing. Most people would be fine blocking the big dozen or so of the most offensive ad networks but this extreme approach (especially when the publisher is trying to offer you choices) just comes off as ridiculous.
It's not advertisers as much as a complex supply chain with bad incentives in a 12-figure global industry.
We say the same things with government waste over military and healthcare. And we can fix it in the same ways with better trust, accountability and regulation.
What entire industry? Advertising? And how is the world worse because of it?
Do you realize just how much advertising funds? It's a 12 figure global industry and 99% of the content you consume is funded in part by it - and that's before we get to how advertising drives the economy by efficiently matching businesses to customers. Every company relies on advertising (whether paid, word-of-mouth, etc) to succeed.
It's irrational to see so much hate and it's likely your complaint is really only about intrusive ad formats and data privacy. That is something I agree with and I'm for every change that makes for safer, better, and more private ads, but that is vastly different than calling for the elimination of advertising in any sensible reality.
The only hope against the DMCA is that eventually the takedowns get so ridiculous that courts are forced to strike it down as the unconstitutional garbage it is.
I think it's worth mentioning that even if an easylist filter entry counts as "circumventing a technological measure that effectively controls access" -- which I think is debatable for multiple reasons -- the DMCA takedown procedure only covers copyright infringement. It does not apply to anti-circumvention measures.
As Admiral's blog post points out, Github recommends using the same contact procedure for anti-circumvention takedown requests as for normal DMCA takedowns. But as far as I can tell, they're doing so purely on their own initiative; such a takedown request doesn't have the force of law in the same sense that a claim of copyright infringement does.
I don't understand how your comment is a response to mine. Could you please clarify?
The DMCA is a set of laws. The DMCA takedown procedure is a part of those laws, defined in a fairly rigid way: it has specific notification requirements, timeframes, and is clearly defined to only apply to copyright infringement. Just because the DMCA also prohibits circumvention, it doesn't automatically follow that circumvention is the same as copyright infringement. And the Wikipedia section that you linked to doesn't mention the takedown process at all.
> Github recommends using the same contact procedure for anti-circumvention takedown requests as for normal DMCA takedowns
I made this mistake to, Admiral's blog post does imply it. However, they were making a DMCA take down request, based off the reasoning it was for anti-circumvention.
To that same logic any operating system that allows editing the hosts file or running your DNS service and routing a domain name to loop-back or some other server is also liable for producing circumvention tools.
So, they made a github account the same day they made the "request" with an account that in no way indicates where the request is coming from? The github profile bio reads "Help all parties understand and resolve DMCA issues efficiently and effectively to minimize file and repository impacts."
Perhaps they should have used a bit more transparency when asking for the offending url to be removed from the repo, instead of acting like a spammy copyright boogyman, then immediately resorting to a dubious DMCA takedown request.
I wonder if folks could get sneaky and change the design from a literal url to a regular expression tailored to single out that url but would also include additional sites that are just gibberish and could be relaxed if useful sites ever do fall into the URL overlap. This might be a new line of research to craft regExs to filter out a specific string while also throwing out a bunch of sister gibberish strings that would be unlikely to be adopted simply by virtue of language.
If it turns out that this type of DMCA use is legally valid, adblockers could be modified to reject pages that embed URLs that have filed such requests.
So if a particular site uses admiral to protect its ads, it loses traffic.
users of your list will not get this. And will stop using your list. This ending up not serving your purpose nor theirs.
For instance, let me go out on a limb and point out how some distros of linux insist on shipping without any non-free software. So, a user ends up having to go through hoops to just get an audio of video file playing. I think the analogy Im going for is, you don't want to play by our rules (our license, etc), we'll not use your software (or correspondingly block your site).
I'm trying to point out what I think is likely consequence of such an action
> users of your list will not get this. And will stop using your list.
I don't think that's universally true. For me, if a site is broken because blocking ads also makes the content inaccessible, I just close the browser tab and move on with my day. (For a while the LA Times was blocking content in this way, so I just refused to visit their site. I guess it worked; they don't do this anymore.)
I don't claim to be the common case, but frankly I don't know what the common case is, and I suspect you don't either, so it could go either way.
You're definitely right. Our ability to ignore our ideals when we're slightly inconvenienced is why content paired with invasive ads is so effective in the first place.
> Many GNU/Linux distributions do not contain libdvdcss (for example, Debian, Fedora, SUSE Linux, and Ubuntu) due to fears of running afoul of DMCA-style laws, but they often provide the tools to let the user install it themselves. For example, it used to be available in Ubuntu through Medibuntu, which is no longer available.
> users of your list will not get this. And will stop using your list. This ending up not serving your purpose nor theirs.
I disagree. Users use adblock lists to protect themselves. This company has proven that they are actively hostile to users. Blocking their entire site, all of their domains, etc, is a sensible precaution for users to take. I have no doubt that this company serves JavaScript (i.e. executable code) that serves their purposes, not users'. And any other sites that insist on using their services are also hostile to users, and blocking them is sensible as well.
If some users just have to see that site, they can either find another list (who cares, no one's doing this for Internet Points), or they can click the "Add Exception" button.
We need not submit ourselves to be effectively held hostage by hostile content providers. It's just content.
Why is it that the tech set always forgets that CS pedantry != legal pedantry? Have we forgotten about intent? You can't just change the line to a regex that /just happens/ to match that URL and go "neener neener neener it's not the same!" Are you willing to argue in court that that line was changed and it /just so happened/ to match the domain from before? Do you have a plausible explanation for why that change would've been made that doesn't involve "well, we were trying to creatively skirt a DMCA takedown request"?
Well, first of all, blocking a URL is not against the DMCA.
So one argument to do is this is because it is NOT illegal, and the purpose would be to stop frivolous lawsuits.
So yes, it would be trying to creatively skirt frivolous lawsuits.
Another legit reason though, is obfuscation. The company that tried to threaten this frivolous lawsuit may have not even noticed, if it was some weird regex. And they'd either not complain, or have to spend a bunch of money tracking down the problem. Both are wins, in my book.
>Well, first of all, blocking a URL is not against the DMCA.
But you'd significantly help the legal case of those claiming it is by trying to obfuscate that you're doing so; they would argue in court it's an implicit admission you "knew it was illegal."
> they would argue in court it's an implicit admission you "knew it was illegal."
So you'd argue in reply that although you maintain that it's legal, you knew that it'd likely be something that bad actors would file frivolous suit over. Even when you win, being hauled into court is incredibly disruptive.
Blocking a URL is, in and of itself, not illegal, sure.
Blocking a URL that allows you to break a copyright-protection mechanism[1,2]? Well, that's not so clear. It's also unclear whether or not Admiral falls under the umbrella of a copyright-protection mechanism.
I really really really want EasyList to be in the right here, and be able to re-add the block without fear, but it's far from clear what all the implications of this are. I'm glad the EFF has stepped in to help them out; I'm content to wait for their opinion (or the opinion of an actual lawyer versed in the subject at hand) on this.
In the end, this is just another example of why the DMCA needs to go.
[1] Yes, you could say that this is bad design that the mechanism can be broken so easily, but that's not the point: the DMCA doesn't care how good or bad the mechanism is. If you break it, you're in violation.
[2] I suppose there's another point to be made: DMCA takedown notices are only for removing content or links to content that contain actual material where copyright has been infringed, not for removing circumvention tools.
Do you think adblocking is the same as removing DRM? How do adblockers technically relate to copyright infringement? I don't see any adblocker do anything about DRM.
If there is an adblocker that allows me to download lossless video from Netflix I'd sure like to hear about it.
Are you perhaps saying that the ads played on Spotify and YouTube are a form of DRM? Or does every TOS violation constitute a DRM violation now?
How is "blocking ads" in any way related to copyright and DRM?
I'm not sure if its a matter of forgetting but about not knowing the contours of the boundaries of what's permissible and seeing a straightforward workaround as a proposition which also serves to give feedback regarding why or why not the proposition would be tenable. Evaluating a concrete technical solution in light of some legal matter should do well to illuminate and draw attention to the crux of the problem.
I guess the bottom line is whether one is forced to blacklist/whitelist a site and what means are permissible. If its simply about the site name appearing literally then a workaround would seem easy enough and one couldn't claim uniquely singling out because the filter applies more broadly. Of course the intent is the same in both, but I'm not versed enough on DCMA issues to know how intent plays a role in this field. Your point actually makes me curious about the legal field more generally and just how pervasive intent is and what areas of law it plays a role and which is does not.
It's not specifically about the DMCA; it's about legal issues in general. Intent matters in the vast majority of law. You'd be hard-pressed to argue in front of a judge that your intent wasn't to block this specific site, based on the sequence of events:
1. Site added to block list.
2. Site removed from block list due to DMCA takedown request.
3. Site block by new rule added that doesn't target it directly.
I can't imagine any judge or jury looking at that sequence events and then taking you seriously when you say "I didn't intend to block the original site".
The parent's point was more along the lines of: people in the tech world need to stop looking for technical solutions to all problems. Some problems are social problems, or legal problems. They should be solved directly, not with awkward (or possibly illegal or at least tort-worthy) workarounds. We talk about chilling effects and corporations engaging in anti-social behavior when they threaten open source and the open web in particular, but attacking social/legal problems with technological workarounds is itself also anti-social.
Not saying that technological solutions are not useful sometimes. In the short-term, you can often make a bad social or legal problem less bad by using a tech workaround, while simultaneously taking the long slog toward fixing the root of the problem. But putting tech band-aids over our problems and then walking away will only hurt us in the long run.
I think it's about what exactly is the DMCA used against. My first thought was as well that they claimed the act of writing down the domain name somehow violated the copyright of their domain. That sounds kind of silly and if it were actually the case, I think a hash/regex solution would make sense.
However I think what actually happened was that the business is operating paywalls/"anti-adblocker-walls" for other sites - so they claim that blocking them constitutes "circumvention of protection devices" for their customers - which indeed would be far severe for adblockers if confirmed by a judge.
(That's my understanding, though I might have gotten it wrong)
OK, why not circumvent the "argue in front of a judge" aspect? Instead of a list hosted on GitHub, put it on some server that's very hard to take down, leased anonymously. You could get EasyList, and then add back whatever's been removed. And make sure that no logs are retained concerning user input.
This is one of those areas where I'd say it comes down to your lawyer. I agree with the general premise being presented, that sometimes the tech community tries to use technology to circumvent problems that aren't technological. That being said, in this specific instance the most effective defense would probably be something to the extent of "Your honor, based on the advice of my legal staff and my own understanding of the law, I was not in direct violation of the DMCA. For this reason, it seemed only logical that the issue must have been that the manner in which I was operating was the problem and not the outcomes of my operation. For this reason, in an attempt to comply with the notice I received, I revised my software to remedy what I understood to be the problem."
The claim is about copyrighted material thus DMCA, right? the only reason that string appears is for matching. The intent is for identification, not stealing someone else's copyrighted material. If there's a better way to match than comparing to a literal copy then we should do that. Ideally, one regex that matches all offending domains and no others.
Does it really matter? If they cannot send takedown notice they still are allowed to sue Github so Github might want to remove the offending code rather than enter a legal battle with unclear consequences.
The admiral website has a copy of a notice [1] if you are interested.
Oh, that's way more interesting. So they have standing? I can see the argument that altering the execution of the program sent to the users computer is a DMCA violation (i vehemently disagree, but i can see it). But i don't think they didn't actually wrote the page that's delivered to the user.
I'd imagine it would technically need to be the publisher or the agent that took legal action. This was clearly an experiment though. Expect much more widespread use and, I'd assume, a court case soon.
That's a funny thought, but the company making the complaint could probably prove that the ad blocker was interfering with their ads even without looking at the source code.
Moreover, the DMCA covers unauthorised access to copyrighted content, and the ad blocker cannot claim ownership of the ROT13'ed domain name, just as the domain name itself is not copyrightable.
In theory the ad blocker could use a more complicated scheme to obfuscate their source code, but I'm not sure whether they could combine a "do not de-obfuscate this code" rule with an open source / Free Software license.
This is a crucial point: the software is not blocking their ads, neither are the software's authors--the users of the software are. And the users have every right to not connect their computers to any other computer they please.
It's interesting to compare this to Second Amendment arguments. Do ad blockers block ads, or do users? Do users have a right to keep and bear ad blockers? Of course it's silly, and ad blockers are passive tools, but there are some striking parallels.
instead of blocking requests, replace the domain name with something funnily invalid, with a play on words on each original domain. then in case of any dmca, claim satire fair use.
Not looking up a domain name cannot constitute circumvention.
Imagine a DVDCSS-like system that used remote servers to convey permission and defaulted to ALLOW. Would users who unplugged their DVD players from the Internet be guilty of circumvention? Now imagine that DVDs for said player were handed out freely on the street, stuffed into people's mailboxes, etc. Would people who played those DVDs without connecting their players to the Internet be guilty of circumvention?
That's the same thing, in principle, that's going on here. Claiming that it's circumvention (whoever makes that claim; I don't know if you are) is preposterous. This is obviously an abuse of the DMCA (not hard to do, considering the DMCA itself is an abuse, but I digress).
Then they would purge it from the repo. In fact, it's questionably the case that they have abided by the DMCA order, for the very reason that it still exists in the repo history. As far as I know, DMCA takedowns normally lead to closing the entire repo.
This is a good question. At least at a location where the US does not have an immediate jurisdiction. It's kinda lame, really, that the whole world has to bend over because all of these services are right there in the US. Make them work, at least. Germany, Sweden come to mind.
I concur, I think until the world catches up with the innovation happening in the US (I'm guessing that's why this content is hosted on US services), we'll have to put up with this
The DMCA is a US law, so, anywhere outside jurisdiction of US law. GitLab on a C1 Scaleway instance would probably get you pretty far along the way. The lists really aren't that large in size but there are so many requests. It may be better to build in something like [WebTorrent](https://github.com/webtorrent/webtorrent) to propagate updates.
This IMHO is the most sensible thing. There I think are a gazillion ways of serving your list which are out of reach of such laws (not necessarily US laws)
This isn't a legal issue in that the laws are bogus (I mean, they are but it is not the issue here). The real issue is that this company is bully and using the legal system as a bludgeon. These abuses should be penalized and they would happen less.
The downside is that some sites/patterns are removed from the list for legitimate reasons (for example, in the case where a rule is overly broad and breaks sites that it shouldn't). If you can make the software distinguish between "good" and "bad" old rules in the history, then you absolutely have not complied with the DMCA takedown notice anymore.
You probably did not understand the issue. The domain in question is a part of a copyrigth protection scheme. Blocking access to it is a circumvention of copyright protection scheme and it is illegal under DMCA. No, you cannot block hosts that are a part of a copyright protection scheme and you cannot distribute the software that does that.
How you block the domain - with a simple string or an automatically trained neural network - doesn't matter.
I can block anything I like. And I can do whatever I like to help others do that. And I'll make sure that nobody can stop me, or them, or threaten me about it.
> The domain in question is a part of a copyrigth protection scheme. Blocking access to it is a circumvention of copyright protection scheme and it is illegal under DMCA.
You're asserting things to be true that are very much in question, and the assertion borders on the absurd.
Is it also a DMCA violation to add firewall rules to ones own network equipment?
It may not be a bad idea to report this user via GitHub's "block or report" feature when viewing that account: https://github.com/dmcahelper
That type of behavior can only be bad for open source software. Threats like "to minimize file and repository impacts" are going to push more folks toward private repositories if they don't understand that it's not an actual authority pressing them into making changes on a given platform.
Additionaly, this account is borderline with regards to GitHub's TOS¹: “While using GitHub, you agree that you will not under any circumstances: […] impersonate any person or entity, including any of our employees or representatives, including through false association with GitHub, or by fraudulently misrepresenting your identity or site's purpose”. They haven't explicitly impersonated GitHub, but I bet I'm not the only one to have wondered for a few seconds whether this was an official GitHub account or not and I'd hardly believe this wasn't intended.
I just filled a complaint, they have a "report this use" link. Took only a minute, whatever it takes to keep people from abusing people and collaboration, especially using the ugly DMCA hammer.
Agreed. I just reported that account (https://github.com/dmcahelper) for submitting spurious DMCA takedown requests. GitHub personnel responded promptly:
Hi Justin,
Thanks for writing in. We're looking at the account.
All best,
(GitHub employee name redacted)
GitHub is listening. Please consider reporting this account, which can be done via the link above. Look for Block or report user link under the user description at left.
How does that non-response (the same one they pasted to me) give you the impression they're listening? For one, they have done nothing to address the issue of flagrant DMCA abuse. For two, the account is still active. For three, the commit hasn't been reverted.
This is not the first time this has happened.[0] GitHub's response has been woefully inadequate and OSS maintainers should consider using another platform. Everyone using GitHub is vulnerable to suddenly and arbitrarily losing their repository.
The beauty of git and similar DVCS's is that you essentially can't lose the repository. You can only lose the github namespace for that repository. And using a different platform has the same effect. If you are worried about losing the Github namespace for the repository then moving to a different platform doesn't seem like a solution.
issues, pull requests, deploy keys, access control. None of those the repository. They are associated with the repository and it would be annoying to lose them But with the exception of the issues all of them are replaceable with mostly minimal effort unless you did something really wrong.
And again switching to a different platform doesn't solve that problem either. You'd still lose the issues that are in github.
I've done a bit of research, now. You can trademark a domain name, but it appears they can't be copyrighted. I am pretty sure the DMCA is silent in regards to trademarks.
To reply to myself, I need to first state that I am not a lawyer. I have, however, taken a number of courses on both law and procedures. Please keep that in mind.
I have also now spent more time on this than I'd expected.
One of the DMCA provisions, is that (as others have mentioned) that software to circumvent copyright is also prohibited.
I do not believe that EasyList meets the legal definition of software. It's not software, I don't believe. It is a list used by software. Basically, it is a configuration file. By itself, it performs no functions.
Its pretty much a 'dumb' plain text file. It is not executable, in and of itself. By itself, it does exactly nothing except take up space.
Computer software is defined in 48 CFR 2.101 and, unless my reading is incorrect (and it may be), this doesn't enable a program to be produced, created, or compiled.
I can find no rulings on this subject, however.
I am not a lawyer, this is not legal advice, and you should check with a qualified legal professional in your jurisdiction before acting.
That said, this does make for a potentially interesting case. It's probably a good thing to get some decision handed down. That and, well, it'll be pretty easily circumvented regardless of potential rulings.
By itself, any software performs no functions. Software is just instructions, and a config file is, too, just instructions. Sure, a difference is whether it's instructions for hardware or instructions for other software, but that doesn't sound material to me. Especially when hardware can be emulated by software.
However, circumvention tools (software or otherwise) require suing, not merely issuing a takedown notice, as another commenter pointed out.
I'm not sure it meets the definition of a circumvention tool, which appears to be a reference to 'computer software.' As in, the legal definition for such. The courts use a specific definition, found by the entry in the above reply. The few cases I found made use of the specific terminology.
DMCA is not the appropriate tool for this. Filing a DMCA takedown notice when you know that there is not any copyright infringement going on in the document you are asking to be taken down is a misuse of the DMCA, and an entity filing such a takedown can be liable for any monetary damages or attorney fess of the other party. Although I don't know that's ever happened, it's in the law as a penalty for intentional misuse of a DMCA takedown notice. https://www.law.cornell.edu/uscode/text/17/512
It may very well be that the URL should have been removed, with regard to Easylist policies, github policies, or even some other law. But not DMCA takedown notice. If DMCA takedown notice was the only tool available to them, then they had no tools available to them, because DMCA was not a tool legally available for asking someone to remove a URL from a list. A URL in a list is not possibly copyright infringement.
(I am not a lawyer, this is not legal advice, just my understanding for sake of discussion of a hypothetical)
The DMCA doesn't just let you request the takedown of copyrighted content. It lets you request the takedown of tools which can be used to "circumvent technological restrictions" on accessing other, unrelated copyrighted content.
So for instance, when the CSS encryption on DVDs was broken, there were DMCA takedown requests issued to sites hosting the deCSS decryption code, even though the copyright of that code itself wasn't at issue.
ETA: a comment below corrects me, saying that the DMCA prohibits distribution of circumvention tools (i.e. makes it illegal and even criminal I think), but doesn't allow takedown notices for such tools: you have to actually sue them in court. So this takedown notice seems to have been incorrect even if the DMCA is invoked.
That could be, cite to the law or description of it? I'm interested in learning more. What I see in the law (https://www.law.cornell.edu/uscode/text/17/512) is that a "notification of claimed infringement" must include "Identification of the copyrighted work claimed to have been infringed, or, if multiple copyrighted works at a single online site are covered by a single notification, a representative list of such works at that site."
If the notice did not identify a work believed to have been infringed, then why did Github respond to it? Why don't they follow their own process? If the notice did identify a work being infringed, then they are probably wrong because you can't infringe a copyrighted work by listing a URL in a list. I guess actually getting damages might require proving they _knew_ that, and be generally infeasible/cost prohibitive.
Part of the challenge here is that "the DMCA" is a number of clauses. People who are "against the DMCA" often turn out to have an incoherent position, at least from a legal standpoint, when it turns out they just disagree with one of the contentious clauses.
This would in fact be the most contentious clause, the one about being able to take down tools that enable circumvention, the one that is historically the one that perturbs techies and HN-types the most. I think what we see here isn't so much a DMCA takedown of a single line, but a single line modification in an attempt to prevent someone trying to take down the entire ad blocker, by making it so this particular person doesn't have any standing (in the legal sense) to make claims against the ad blockers anymore.
The copyright takedown clause would be number two, but it has a mitigating factor; the DMCA copyright takedown process that you might see on a hosting site or HN itself [1] has a positive element as well, which is that by conforming to the DMCA a site like HN is able to host user content like our comments while discharging from themselves the responsibility of having to pre-filter every comment for copyrighted content. This clause has certainly been abused, and there is a justifiable case that the Feds have not been adequately aggressive about chasing them down, but on the net I still approve of this clause, personally.
(You also have to distinguish between "the DMCA" and a site's policy, which may go above and beyond. Many or most of the things that people complain about for YouTube, for instance, are their own elaborations on the theme, not the legal requirements themselves. Not all of them, though; YouTube tends to favor the big media companies very strongly when it comes to defining "fair use". But things like taking away your monetization and giving it to somebody else is a YouTube policy, not the DMCA. Or at the very least, it's a penumbric emanation of the DMCA and not the DMCA itself.)
Were I the developers or anyone with any ownership in this software, I would hesitate on putting too much stock in the idea that this was an improper use of the DMCA claim process. It was. But the reward for aggressively pushing back on that may be a proper lawsuit for violation of the anti-circumvention clauses, for which there is not a notification process but simply a legal basis for lawsuits granted, IIRC. Your reward for armchair-lawyering this DMCA takedown request could be a true lawsuit.
The DMCA does make distributing circumention measures illegal, but I can't find anything in the law, or discussions of it, saying that the takedown process applies to circumvention measures. The takedown process says an ISP like Github is not liable for copyright infringement if they respond to takedown notices, which is what creates the takedown process. It doesn't say anything about circumvention measures and liability with regard to notices though.
What the DMCA says about circumvention measures:
> (2) No person shall manufacture, import, offer to the public, provide, or otherwise traffic in any technology, product, service, device, component, or part thereof, that—
> (A) is primarily designed or produced for the purpose of circumventing a technological measure that effectively controls access to a work protected under this title;
> (B) has only limited commercially significant purpose or use other than to circumvent a technological measure that effectively controls access to a work protected under this title; or
> (C) is marketed by that person or another acting in concert with that person with that person’s knowledge for use in circumventing a technological measure that effectively controls access to a work protected under this title.
It seems obvious to me that Easylist is not such, I don't think it meets A, B, or C. But it'd be an expensive court process and who knows what the court would end up doing.
In this example, it seems like Easylist has no desire to include that URL anyway, as it is not an ad server.
It may be true that Github can decide to refuse to host the thing anyway, but it's not a DCMA takedown notice process.
As I added after you replied, I agree that this is an improper use of the takedown procedures. However, your reward for successfully armchair-lawyering that may be a full-on Federal lawsuit.
Also, I agree that Easylist itself may still not be a lawsuit target. It simply makes a claim about a certain domain, it doesn't do any access circumvention itself based on that claim. But if Easylist isn't, the ad blockers using it certainly would be. And that alone would change the dynamics of the situation quite a bit.
I hate to say it because I like adblockers too, but it is frankly very likely that when the advertising industry finally makes the push against them that by current law, it will indeed turn out that it is illegal to use ad blockers on sites that take active measures to ensure you view ads [1]. Again, don't mistake me saying this for endorsing it, but I think it's a very plain and obvious reading of not just the DMCA, but even something as fundamental to our legal system as common-law contracts... if a website wishes to make viewing their content conditional on viewing an ad, they can do that, just as they can make viewing their content conditional on paying them money, joining a club, or anything else that qualifies as "consideration" [2]. They can also place further restrictions on that content as part of that content. Any argument in favor of ad blocking that would also explain why either Netflix customers have the legal right to retain copies of the movies, or in the most extreme cases, explain why everybody has the legal right to retain copies of Netflix movies, should be discarded as an argument that proves too much [3].
I'd suggest the ad blocking community and the interested tech community at least wargame out the plan for if they lose the legal cases, because I would personally put that at somewhere around 90% probability if any of them ever go to court. Even with the EFF supporting it, I fear the EFF would pretty much be reduced to making very handwavy arguments about fundamental rights and basically pounding on the table, because in my considered opinion they really won't have much else. And even if they are correct, courts tend not to take much account of those arguments.
[1]: If the judgment goes really bad, it could even be illegal to bypass sites that don't try anything explicit. However there is a very good argument here that there is a history on the internet of assuming more rights rather than fewer if you don't assert yourself, such as the fact that browsers generally render things differently anyhow, the long history of search engines, the needs for accessibility software to render pages fundamentally differently anyhow, etc. I think there's a good chance no judge would want to overturn that consensus as it's now around 25 years old.
I understand I'm arm chair lawyering, but the purpose of a user agent is to display what the user wants it to, not what the site wants it to. I can't be sued for not watching commercials.
Actively circumventing access restrictions is another issue entirely, but if I'm sent data, there is no reason or guarantee it must be displayed as intended. What about blind folk, or those who don't run JavaScript? Is turning off just now illegal? What about not downloading images?
If a site can't make me pay, and doesn't want it's content to be viewed unless I pay, simply don't send me the content.
Again, circumventing access control, even terrible ones, is one thing, but if you send me the data, then you sent me the data, what the issue?
> If a site can't make me pay, and doesn't want it's content to be viewed unless I pay, simply don't send me the content.
I'm fully on your side here, but to play devil's advocate, I think it's fair to consider an analogy like "if a restaurant doesn't want its food to be consumed unless I pay, simply don't serve me the food."
You ask a server (of the web or the hospitality variety) to serve you the usual. The server gives it to you and reminds you that the deal hasn't been fully executed yet: you're to next [ask the cashier by the door to ring you up || ask the ad server to serve you an ad], and then [pay when asked || render the ad amongst the rest of the content]. Sure, you could forego talking to the [cashier || ad server] instead.
Again, I don't like that one bit, but I think it's the kind of "reasonableness" that holds up in court. IANAL.
At the risk of destroying my efforts at being reasonable, suppose it's an "if you eat the whole thing, it's free" situation, except there is no "$19.99 if you can't finish" else clause. You know that they didn't offer an else, yet you eat anyway, and you slip your onions into the plant in the corner.
Then they can make other ridiculous rules too, for example "you should pay 100x the price in menu unless you can stand on your head for an hour". That would probably increase the income dramatically.
But there is no expectation that a restaurant will serve you without paying. There is an expectation that a website will ask for payment/authorization if required, otherwise I'm not required to pay.
Moreover, there is no way to know if the content you're requesting will require a transaction (unlike a restaurant where the prevailing expectation is payment for service, even if prices are left off the menu). It has always been the case that I need to request the resource and then be told if it costs money, otherwise it's given to me.
Likewise, there has never been, and I would argue can't be, an expectation that a user agent render all content as expected. Would custom style-sheets violate the law? Do Lynx, Links, Links2, w3m, mutt, and pine all of a sudden become illegal? How does a screen reader render an ad? How does a braille interface render an ad? Am I now legally required to run a graphical interface otherwise I'm playing legal roulette?
What happens if the adserver malfunctions and doesn't send me an ad? Am I now put in a legally bad spot? What if an ad is sent in swf and I don't have flash installed? I also feel like there are legal implications to forcing someone to execute code sent to them. Do ad servers all of a sudden become responsible for drive-by malware? Can we sue them for damages?
I feel that the crux is that there is no way to know if "payment" is required before requesting a resource. You can't send me something and then say, "oh, yeah, hey, you need to pay me for that" when the (vast) majority of the time I'm sent things without any expectation of payment.
Perhaps the better analogy, then, is that it's kind of like an unattended farm stand with an honesty box. Except the honesty box isn't visible on the way in, it's located on the back of the enter sign so you only see it on the way out, and the driveway is so long that surely you've already started munching on the fruit while starting to leave. Since I'm still on a food kick the whole expectation-of-paying thing is still clouding the analogy a bit, but at least this is closer to the situation than a sit-down restaurant analogy. Oh, and of course our hypothetical farmer needs to have primarily fixed costs, little or no variable costs based on the amount of fruit taken.
It may very well be more common for such hypothetical farmers to forego having an honesty box hiding where you don't see it until you've consumed the fruit, but for those who do choose to have one, are you stealing the fruit if you don't drop in a few bucks?
More on topic: I also think courts would see quite a difference in intent between using a mainstream graphical browser with an ad blocker vs using things like a text mode interface, a screen reader, a braille display, or libcurl. The former is like driving past the honesty box while chuckling; the latter is like not even knowing it was there.
> Perhaps the better analogy, then, is that it's kind of like an unattended farm stand with an honesty box
The issues is that there is normally a expectation of paying for things like produce. Unless there was explicitly a "Free Produce" sign, I would expect to have to pay.
There is no expectation that you need to pay for the data sent to you later; if payment is required for access, you're told so and need to provide it to continue to the resource (or otherwise provide proof that you had paid, e.g. logging in).
There hasn't historically been and can't be an expectation of payment later because that would be untrue for many, if not the vast majority, of websites. Additionally, there has never been an expectation that the client will render everything you send to them. All browsers have the option to disable JS and images, and always have.
It's these differences in expectation and culture that I believe provide the difference between your examples and the web. Violating these constraints would cause legal issues in the vast majority of systems, would mean running old software would be illegal (Chrome preloads links under certain circumstances, but doesn't render them), and would also end up forcing users to run code they didn't choose to run (there is no expectation or knowledge of what code the server will send and choosing to not run harmful code would be illegal), which would be an interesting thought experiment as a civil rights violation. It would also force me to, say, accept a EULA for Flash, even if I disagree with it because I visited a site that randomly sent me a flash payload. Or what about something without a linux runtime; I would have no ability to avoid committing a crime, because I don't have the choice to accept the rest of the content that came with the content I can't run, but am legally required to run.
Violating the very assumptions of how the web works would have terrible ramifications.
> More on topic: I also think courts would see quite a difference in intent between using a mainstream graphical browser with an ad blocker vs using things like a text mode interface, a screen reader, a braille display, or libcurl.
Why? They're all the same thing. I'm deciding how I want to consume content; I'm not circumventing a access control mechanism.
Because what a court does isn't always logical or even reasonable. Especially on IP stuff, especially on IP stuff involving software. Did you pay attention to Oracle v. Google?
So far in the Oracle v Google case it's been ruled that apis are covered under copyright, but that implementing them from scratch is covered by fair use. I mean, that's not wholly unreasonable.
Oracle has appealed, would we'll see what happens.
I seem to have hit the max reply depth, so sibling posts will have to do.
> disable JS and images
> They're all the same thing. I'm deciding how I want to consume content; I'm not circumventing a access control mechanism.
I guess the difference I am trying to highlight is:
* a lack of ads for hard technical and/or compatibility reasons (JS not enabled, images not enabled, graphics subsystems not existing, not having sufficient eyesight, etc.), versus
* a lack of ads because screw you.
This line in the sand may be stupid, but I'm afraid it's not "the same thing." I'm afraid this difference could be argued successfully in court, and that is my point.
Hn removes the reply for an increasing amount of time per level, I think.
But it's not "screw you" it's "I don't want to waste the bandwidth I pay for and am metered on with things I don't want to download and could potentially harm my computer". Viewing those ads costs me money as well, money which isn't going to the person serving the ads, not to mention the risk of malware.
"I understand I'm arm chair lawyering, but the purpose of a user agent is to display what the user wants it to, not what the site wants it to."
This is an assertion that is commonly made on the internet, but I see no reason to believe it carries any legal force, or even necessarily any moral force. In fact it's not that hard to read it as an argument made solely to come to the desired predetermined conclusion rather than any sort of principled argument. It implies that the sender loses all rights to anything they send to you, which is definitely legally untrue; I gave examples above already.
Also, if you win on this point, you will not experience a glorious utopia in which ad blocking is OK and you can save whatever streams you want and so on... you'll experience a world in which all this content gets removed from the web and locked behind even more proprietary clients that will come with what the publishers want. What may seem to you to be a simple bugbite back in favor of what you believe your rights to be may cause a much larger allergic response than you'd anticipate.
"I can't be sued for not watching commercials."
You haven't signed a contract saying you will. That may not be the case online.
The questions about whether such contracts should be something that even can be offered, or whether simply clicking through a EULA or accessing a bit of content can bind one to a contract, or the nature of what such a contract may be allowed to be, are all separate matters of interesting discussion. However I don't foresee any world arising in which the "the purpose of a user agent is to display me what I want to see and therefore any manipulation of the content other people own the rights to is within my rights" is going to hold up. There's too many rights and rights-holders that won't stand for it, and even if you did somehow win that case, they'll simply retreat and retrench in whatever it takes to recover those rights for themselves. If you rewrite the terms of the contract, you have to account for the other side of the contract reacting to it, not just passively sitting back and going "Oh, gosh, I guess I'm stuck then, I'll just keep doing what I'm doing without changing anything."
> The questions about whether such contracts should be something that even can be offered, or whether simply clicking through a EULA or accessing a bit of content can bind one to a contract, or the nature of what such a contract may be allowed to be, are all separate matters of interesting discussion.
But you can't accept a contract just by visiting the site. Especially since the in the same action as becoming aware of the exist of the contract also makes you breach the contract.
> However I don't foresee any world arising in which the "the purpose of a user agent is to display me what I want to see and therefore any manipulation of the content other people own the rights to is within my rights" is going to hold up.
Why? This has always been the purpose of the user agent and it's difficult to impossible to actually make sure things will always look the same in all browsers. Could viewing a site in FireFox or Edge become illegal? Again, how would I know that _before_ taking the action. What about systems such as links2, w3m, elinks, and lynx?
> f you rewrite the terms of the contract, you have to account for the other side of the contract reacting to it, not just passively sitting back and going "Oh, gosh, I guess I'm stuck then, I'll just keep doing what I'm doing without changing anything."
Which terms? The UA has always been the agent of the user, not the site whose content is being displayed.
I just find it very difficult to believe that the court will accept that I've broken a "contract" I can't know exists without breaking it.
What you are describing applies only to US where copyright laws are biased towards the interests of publishers. Developing adblockers in other countries might be the solution I think. It is unbelievable that a publisher might decide what I do with content on my computer. No, he cannot or at least should not be able to decide. If he doesn't want me to block the ads then he should not serve the pages to me in the first place.
> However, your reward for successfully armchair-lawyering that may be a full-on Federal lawsuit.
I assume Github has a whole bunch of non-armchair lawyers.
But this is indeed the problem with the whole system, it comes down to who can pay the legal bills.
It seems obvious to me that Easylist is neither "primarily designed or produced for the purpose of circumventing a technological measure that effectively controls access", "has only limited commercially significant purpose or use other than to circumvent", nor "is marketed.. for use in circumventing a technological measure that effectively controls access."
But it could take a whole lot of legal fees to determine that in court, and as we saw in Oracle v Google, the courts don't always decide what seems obvious to us. For better or worse, any sane person or entity wants to stay out of court regardless of whether their lawyers think they have a great case. Unless they have a whole lot of money to burn.
At the least, I think Github should make it's policies clear about what it's doing. If they say a DMCA takedown notice must "Identify the copyrighted work you believe has been infringed" (as the law indeed says), they should not take action to complaints that don't do this. If they want to respond to other types of complaints, they should say so, and explain how. (And ask their lawyers how it effects their liability under DMCA, if at all).
Github appears to be trying for transparency with their docs and practices on DMCA, which is great and important and greatly appreciated. This is one area where it could be improved. Responding to DMCA takedown notices that are not in fact DMCA takedown notices and do not follow Github's own published instructions/requirements for DMCA takedown notices (cause they aren't DMCA takedown notices)... is not transparency. The DMCA regime has plusses and minuses; mis-educating people about the DMCA law doesn't help us evaluate what these may be in order to be engaged citizens.
An adblocker is not a tool which can be used to "circumvent technological restrictions" on accessing other, unrelated copyrighted content. It is a tool to restrict access to content.
At first glance you're right, but it's not hard to imagine an ad system which makes the text of a website invisible (or scrambled) until the advert has loaded, and imagine an ad blocker which is designed to do the unscrambling without rendering the ad.
I don't know if that's the precise situation here, but if the ad blocker is intentionally carrying out a process like this to access the copyrighted work of the website without obeying the restrictions of the technological control process, then I could see that falling well within the bounds of the DMCA.
AFAICT, the relevant provision of the DMCA here is "No person shall circumvent a technological measure that effectively controls access to a work protected under this title".
Is there any elaboration on what "effectively controls access" means (e.g. in case law or in the statute that I missed)? Does a system that fails open (the only thing listed in the EasyList commit was the domain name, so a network error would replicate the same situation) fall within the scope of the provision?
> Is there any elaboration on what "effectively controls access" means
Apple Inc. v. Psystar Corp.[1] involved circumvention of a system that "effectively controls access" to Mac OS X, preventing it from being installed on non-Apple hardware.
Apple's anti-circumvention system is (in part) that some of the important system binaries are encrypted, the kernel transparently decrypts them when they are executed.
The key isn't secret (in fact it's a constant that hasn't changed in 10+ years), but it is only distributed inside the SMC chip on the main board of a real Mac.
There's no question that encryption is generally an effective access control method, it can't be circumvented without either having the key or breaking the encryption system in use.
The court found that regardless of how trivial it was to obtain the key, the fact that it was encrypted made it "effective":
> Psystar contends that Apple's anti-circumvention technology was ineffective because the decryption key for circumvention is publicly available on the internet. This argument fails.
> "The fact that circumvention devices may be widely available does not mean that a technological measure is not, as the DMCA provides, effectively protecting the rights of copyright owners in the ordinary course of its operation." Sony Computer Entm't Am., Inc. v. Divineo, Inc., 457 F. Supp. 2d 957, 942 965 (N.D.Cal.2006).
> Generally, measures based on encryption "effectively control" access to copyrighted works. Here, when the decryption key was not employed, the encryption effectively worked to prevent access to Mac OS X. And that is all that is required.
> See Universal City Studios v. Reimerdes, 111 F. Supp. 2d 294, 318 (S.D.N.Y.2000) (noting that when a decryption program was not employed, the encryption worked to control access to the protected work).
> Accordingly, Psystar has violated the DMCA by circumventing Apple's protection barrier and trafficking devices designed for circumvention. Apple's motion for summary judgment on its DMCA claim must be granted.[4]
There are many cases of DMCA abuse, and it'd be nice if someone had the resources to go after these, get them fined and help set a precedent to prevent further abuse. Unfortunately, that probably cost more than it's worth.
Funny how this disclaimer is only found besides legal advice. Really, you should not have to write this. ("I am not a lawyer" is more reasonable, though.)
From what I understand, "legal advice" has a legal meaning, basically requiring it to come from your lawyer, and implying an attorney-client relationship. People want to be clear that they aren't a lawyer, and that they aren't attempting to practice law by offering someone else Legal Advice. Instead, it's more like Uncle Fred saying "You should sue the guy!"
It's not clear how trademarks would apply here. I can write "General Motors". I can write about General Motors. I just can't impersonate General Motors or their products. That's trademark.
That was my point. GP mentioned trademarks for no reason and I said that the DMCA is a copyright law (that's what the C stands for), and that trademark law is irrelevant to this discussion. I also agree that even if trademarks mattered in this case, it still wouldn't be infringement.
On the other hand, it looks like it was an improper use of the DMCA because they're claiming that EasyList is an anti-circumvention tool (effectively arguing that it breaks DRM).
The DMCA is United States-specific. Copyright laws are very widespread and harmonized to some extent by international treaties such as the Berne Convention; a Google search for that term can lead you down the right path. (I'm not trying to explain anything, just give you some good search pointers if you're interested in researching yourself.)
anywhere but US, already EU countries definition of legality of streaming should be enough to safely just filters lists
from what i remember Spain and Central Europe are very laid back regarding your rights to non-commercial steaming of copies of works you don't actually own
This might create a new front in the war against ads. You'll have ad blockers, then they'll build in a component to block anti-adblock mechanisms, which will force the ad makers to employ more countermeasures... I don't see how the content providers will ever win this war. They have more to lose here.
>A companion extension to uBlock Origin: to gain ability to foil early anti-user mechanisms working around content blockers or even a browser privacy settings.
I think /u/gorhill is the lord of this particular war, and his followers are armed to the teeth. I type this on Firefox on Android with uBlock Origin.
I check his github occasionally to see if he accepts donations, and I donate to a couple of the lists occasionally.
In the war analogy, we have the best arms dealers. They other side is fighting a losing war.
I have checked multiple times and gorhill doesn't appear to accept donations. I seem to recall reading a thread where they indicated they didn't want to ever be considered to be beholden to anyone.
As mentioned above, uMatrix is my favorite. Once configured, it is easy... There is a learning curve.
I'd donate regularly, but that doesn't appear likely. I greatly appreciate their work.
> And if github cannot standup to DMCA abuse, then well, easylist and all other developers should be giving a clear hard though to their continued use of the github platform.
This. This is the main topic here. The wide use of centralized services (such as Github, but it applies also to Facebook, Google et al.) makes you dependent to corporate decisions, including coward (or maybe rational) decisions towards freedom of their users.
This is also why linux kernel developers will never, ever use a service like Github. Apart from scalability issues, the single point of failure that these services are (not for technical reasons, but for political reasons) is simply scary.
TL;DR: Assholes who send buggy DMCA is not the issue here. Depending on a centralized service is.
It's not Github's job to stand up to DMCA notices. The law requires them to forward them to the account publishing the content without any consideration of the merits. Then, easylist has the option to comply or refuse.
That's besides the point. It's the reason open source projects should not depend on centralized sites like github or any other site that make this kind of disruptive automated dmca take down easy.
It should take much more legal effort and 'application of mind' to effect disruption.
> It's not Github's job to stand up to DMCA notices.
I want to make it clear that I'm not arguing for the legal grounds here. I'm not a lawyer, so I will leave that to them. I'm arguing from a more moral/ethical stance.
I'd like to disagree with you. By allowing you to run under their umbrella, I feel that Github has a responsibility to take care of you, and the data that you put on their site. I feel that it is quite insincere for them to say "Sure, put your code on our site!" but then kick you to the curb as soon as there's any trouble. There's definitely a level of extremity that I don't expect from them: I think that after a certain amount of legal argument, they should pass it to the uploader, but I feel like their default attitude should be "no, you can't just attack the uploader because you feel like it."
It sends a clear message to the FOSS community that they don't care about taking care of their own, which is bad for Github, and bad for the committers.
I'd be curious though: Why do you think that "The law requires them to forward them to the account publishing the content without any consideration of the merits"? It's my understanding that they do have some grounds here as it is their site.
EDIT: I reworded my post as the original was rude, and accusatory.
Good to hear. I sincerely hope this turns into a lawsuit to scare off others who may be watching the outcome of this to decide if they should try the DMCA route, too.
Even if we take for granted the absurd premise that this is "copy protection circumvention", it's still nonsense for the same reason that gun manufacturers aren't sued for murders.
> With all these dozens of domains (over a hundred), it sure smells like they're incorporating a HSTS fingerprinting attack into their product portfolio. HSTS fingerprinting enables a server to tag every browser with an n-bit (ie: 100 domains is 100 bits) unique identifier so you can track that browser whenever it returns (or wherever it goes). Since users cannot clear their "HSTS cookies" as it were, this fingerprint remains permanently associated with that browser.
>
> Wonderful feature for an ad agency to track each visitor indefinitely. Even while in Private Browsing / Incognito mode.
Okay. Let's eradicate them from the surface of this planet.
Or, more constructively, go after them in the EU, where such practices would surely be illegal under the so-called cookie law (which is actually about storing information in a user's browser more generally, and not specific to cookies at all).
As long as that really is what they're doing, of course.
Couldn't they just use 100 subdomains for their 100 bits?
Maybe we need a browser extension (or just a website) that instructs your browser to make requests to the HTTPS version of domains that are found to be used to set HSTS cookies, thus "blowing the fuses" and making those domains unusable for providing bits of entropy.
In fact, rather than blowing all the fuses, the extension/website could blow just a random few, as a bit mask, giving you someone else's ID number and ruining the ad company's profiling/analytics. That way you would be helping people who weren't using this defence, rather than just having your visits not added to any profile.
GitHub is just the platform. If they get a DMCA complaint, procedure says they should contact the repository owner. The repository owner receiving a fraudulent notice sends a one-line email stating "consider this my DMCA counter notice". The content stays online, the DMCA notice does nothing and the only avenue now is for Admiral to sue, which of course they are not prepared to do.
You post an entry on your blog ridiculing them and their VC funded shenanigans and HN gets a good laugh out of it.
Admiral asked Easylist to remove functionalclam.com from their filters and here’s why:
functionalclam.com is not an adserver.
That domain is part of the DMCA copyright access control platform Admiral provides publishers so they can engage visitors in a transparent way on the value exchange for their copyrighted content, instead of resorting to surprise ad reinsertion the way some of our competitors advocate but visitors and advertisers dislike.
Circumventing a publisher’s paywall or copyright access control technology is not OK and we don’t believe it’s core to the mission of AdBlock Plus and EasyList.
======================
Dan the fag's linked in page:
======================
CEO
Admiral: Adblock Publisher Solutions
2015 – Present (2 years)United States
Advanced Adblock Analytics with Automated Revenue Recovery
The power of the internet to inform, entertain and liberate mankind is at a crossroads. The future of ad-supported content is in peril, and with it, free access for citizens to critical news, education, discourse and resources the world over. The shorthand name for this looming catastrophe is "adblocking", but the root problems and solutions for users and publishers are more complex.
Adblockers claim adoption by over 200M users worldwide and publisher losses as a result of adblocking are estimated to reach $40 billion in 2016. Despite per-site adblocking rates ranging from 10% to as high as 40% for some tech-focused sites, the trend is still young and growing with a 40%+ growth rate over the past 12 months.
Admiral is the publisher analytics suite built specifically to help web and mobile publishers understand the impact of adblocking for their site, and automatically recover lost revenues by solving the issues driving adblock adoption specific to their userbase.">
There are many alternative words available to describe someone of poor character. Words that are not homophobic slurs would be less prone to misinterpretation too. You may have presented evidence about Dan's character but your use of language was mostly informative about yours.
Actually no, your comment has been flagged so no one, oversensitive or not, can see it. Do better. Damore doesn't give a pass for these kind of childish antics.
Ok, you're clearly a free thinker, which is nice. I think you mean well.
The problem is, society doesn't care. You're not allowed to mean well in this context. It's like being a heretic during the inquisition, then trying to argue that you're actually the good kind of heretic, the kind that believes in kindness and compassion even though you reject god. It doesn't compute.
Your options are to martyr yourself and be excluded, or conform while trying to be subversive in other ways. The former hasn't worked very well.
Your original contribution was valuable. It was excluded solely for your language. I would recommend trying again, and let readers decide for themselves. We're pretty good at reading between the lines here -- it isn't reddit. You don't usually have to be explicit, and we like drawing our own conclusions.
It only requires explanation here because of the silicon valley culture of liberal oppression rather than individualism and freedom of expression which are the true values of a hacker. I shouldn't even of had to write that shit but people want to get offended by people who arent trying to offend them.
I use privacy badger, and unless I'm mistaken, it doesn't use a list to block content, it just blocks any 3rd party request that send cookie information.
Edit: the linked issue is regard "instart" which seems to exploit a Chromium flaw that allows it to disguise third-party cookies as first-party, preventing filtering based on that categorization alone.
It seems it's getting harder to rely on browsers working how they were originally intended.
Instart is a MITM service like Cloudflare. It more or less partners with adproviders to serve thirdparty requests through a proxy on the first party domain.
Instart is a MITM service like Cloudflare. It more or less partners with adproviders to serve thirdparty requests through a proxy on the first party domain.
Because that means you might be blocking legitimate stuff too.
My company, https://TalkJS.com, makes a pluggable messaging component. Customers embed it in an iframe, created by a 3rd party (from their perspective) hosted js file. Currently, it doesn't rely on cookies for security but we easily might change that.
Same for other pluggable content, say Disqus and many more. I would be very sad if an ad blocker would block us because we dare use appropriate tools for security.
Well the point was that we should reward ads that aren't forced on us, or at least the ones that try to be as nice as possible. Intrusive advertising should not work...
Then perhaps like me, that ad will mean he actively avoids that product and brand out of ad-fatigue and simple spite rather than the intended effect, which is to attract people to them.
If I see an ad, I click it. In fact, I right-click it and click the button for my shitty addon "thousand-click".
Then my raspberry pi loads that ad in a headless firefox and clicks it thousands of times.
You won't believe how soon you stop getting ads, and instead just empty iframes, or warnings from Google that you're abusing their ads. Well, their problem.
Luckily, there's now an addon that does this fully automatically: AdNauseam.
Fully automated ad abuse, and ensures that if enough people use it, online advertising will die within of weeks.
Personally, this could be a real problem, if Ad services decide to pry open the doors on our ability to deny them our screen real estate. I block Ads, primarily due to the fact that I don't want my web surfing history and behaviors captured by some uncontrollable mob a ad-servers. Further, most advertisements are akin to the dreaded <flash> tag of old! animated, ugly, and obtrusive.
We are coming to a point in the Internets genesis, where technology should evolve to allow the "information consumer" to directly reward the "information producer"... without the need of an intermediary like Google Adwords, etc. etc.
596 comments
[ 1.9 ms ] story [ 345 ms ] threadThe advantage of using the bitcoin blockchain, for example, is that it can't be censored. DMCA trolls now have to go after every single bitcoin company in the world, to stop them from "hosting" the copyrighted work.
We plan to work on remotes in close future. There is one more issue where our measure of DoS protection causes that repos with files bigger than 1MiB+ (or 2MiB, I can't recall) can't be fetched. It will be a bit harder to fix but I know we can do it.
If we could only remove the logjam in congress right now to get some real work done... currently the two parties are deadlocked in a power struggle and have completely forgotten why they're there.
You mean since about 1790? There have always been two parties in congress (minus the era of good feelings) and they have always had opposing ideology, and have almost always blocked one another's proposals.
It is very naive to think the current Republican congress is anything different or new. Their inaction is intentional - they need to pass their anti-citizen legislation they were appointed for when people are not watching them.
It is also somewhat inaccurate to blame it on "deadlocked parties". The factions within them to varying degrees stifle them. The parties aren't monoliths of ideology that uniformly vote the way the chair swings.
If congress isn't passing good legislation, its because the constituent members of that congress aren't a majority good actors. Regardless of color. Regardless of excuses given.
Politicians always act in the interest of someone. Sometimes its themselves. It used to sometimes be for their constituents (because they had to appease them for votes). Today it is mostly for corporate campaign donors. And those donors want the status quo. They don't want the changes average Americans want. The whole point of their buying and owning of politicians is to impede change. Of course a congress filled with men told to maintain gridlock and prevent reform by their masters will do so, and they do it in a way optimized for themselves - by always blaming someone else and taking no responsibility for the gridlock you cause, your base can just keep reelecting you despite hating congress in general. As long as the voters remain ignorant to this con, the business interests get what they paid for - usually corporate welfare.
It's true that partisanship and the two-party system have been a fixture of our system from the very early days. But there are matters of degree, and the degree today is at a peak.
That's by design, actually. The goal was never to create a government that can efficiently create a million laws and regulations.
The point of having multiple parties is that each of them will block each other and only the laws and regulations that everybody can agree on will actually get through.
Unfortunately, politicians have been learning to game the system for ~200 years now, and it's not working exactly as designed.
Another big difference lately seems to be that everybody's an extremist because nobody can change their mind or compromise without getting called out in the media for back pedaling or giving up or "working with the enemy" or whatever.
Gridlock is part of the design, yes. But consensus or unanimity are not. The simple majority rules, except for the cases defined in the Constitution, such as constitutional amendments. The Senate's filibuster is not how the Senate is supposed to function.
The Democrats are doing now what the Republicans did for the last 8 years. And I imagine in 7 years the opposite will happen.
There doesn't appear to be any movement toward changing the rules for legislation. If they were willing to do that, they wouldn't have tried so hard to squeeze the AHCA under the budget reconciliation umbrella.
The ACA was debated and discussed for over a year, it was very moderate compared to what most liberals would have wanted and the democrats had to make concessions [0] just to get 1 or 2 votes and those who voted against it hadn't bothered really to propose anything to the contrary. The repeal plans were rushed, were going to hurt tons of people [1]
Obstructionism is taking something that would usually be a no-brainer or that were your party to have suggested it would have sailed through and turning into a crusade and I haven't seen any of that, unless you can point it out for me.
[0] http://www.cbsnews.com/news/health-care-concessions-irking-l...
[1] https://www.usatoday.com/story/news/politics/2017/07/19/cbo-...
The logjam keeps the parties from working together to create new inefficient programs, expand others, increase spending. The logjam is _great_ and frankly I hope it continues.
When having a discussion with someone about obstructionism I like to point to instances on both sides, and if it seems one side has twice as many that make a difference to me and I refuse do acknowledge that they are truly the same, numbers matter.
He should have stayed in Honk Kong
Btw nobody could make you take down a link from a list if you host it in EU.
Not even DOJ It's perfectly legal and it's a protected right
Enthusiastic participation by America in upholding the idea of liberal democracy (even when it's imperfectly executed) can tip the scales.
The way that happens is by the head of the government reversing course as smoothly as possible from admiring and praising autocratic regimes to giving hope and comfort to democratic allies. Whether it's President Trump, Pence, or fucking Mark Zuckerberg doesn't make too much of a difference in that regard.
Sweden comes to mind too hosting WikiLeaks, so i am pretty sure some irrelevant ad blockers are certainly not big deal
So I guess the lesson here is: don't do that.
https://www.wired.com/2012/03/feds-seize-foreign-sites/
a) whitelist their site in my adblocker b) or subscribe to their monthly subscription and keep reading their site with adblocker
Close tab is way better than back. Easier, more consistent and faster.
I'm also often using a laptop, on linux, and I do the middle-click-simulation (both buttons at once) with two hands, which is really annoying. I suppose I could fix it.
Also I always have my left hand on the keyboard, so for me it's not a problem to ctrl-click.
Ctrl+click doesn't work on a tab, though--have to hit the X.
Besides grasping at maintaining stranglehold over distribution. They are hoping to replicate the cable model. Pay for the base package where all the crap no one wants is, then pay for all these extra premium packages.
I really like that I can visit the vast majority of links I click on for free.
Only works on some sites, but where it does it's effective.
It's a pain and it's often easier to use the cached version from a search engine or some archiving service.
I wonder how others rationalize blocking ads and not subscribing either but still feeling entitled to access the content.
Just saw your subscription update. Why would I subscribe to something that I am unlikely to return to?
The only solution that I can think of, are micropayments. Perhaps this financial pressure will motivate the powers that be to eliminate roadblocks to its implementation.
If you put something on the web, and you want me to pay for it, put up a paywall. If you want to instead serve ads, don't expect me to read them (or load them, even). My bandwidth, my decision.
Bonus: After I asked The Atlantic, they partially refunded my subscription and a magazine arrived at my door (for my now cancelled and partially refunded digital only subscription).
Someone put effort in to create content, and has the option of putting this kind of paywall up. There is a consumer choice made to sell their own attention by viewing ads, pay a subscription fee for the content directly, or just move on to free content elsewhere.
That said, most places where you pay the subscription fee will ALSO show you ads and silently sell your data, but still... The above scheme feels reasonable in principle.
Ad-blocking makes sure they have to make the hard choice of putting content behind authorization. A user-agent's job is simply to be the user's agent, and not the publisher's monetization platform.
But they could still profit from me. There are less annoying ways to monetize which I might accept.
For example affiliate links to buy products I am interested in (books, video games, gadgets). I'd be willing to pay % extra for some nice product in order a fund a website which pointed me to it. Or extra traffic I'd refer to their site.
Either way I assume people like me are a fast growing part of millennial population so their business model based on ads is doomed to fail anyways.
Then perhaps you are not their target audience, and they won't miss you.
Also the ad business is not going anywhere, the tech will evolve and you'll start seeing more native advertising and sponsored content.
Which means that using the best available adblocking technology is a necessary personal-safety step on the modern internet.
It's fairly easy in any browser to create a list of websites to ignore JavaScript on.
But then I look at the list of 50 different domains blocked on the page, and I am not sorry--not one little bit. I don't really need to watch your little news video that badly. And I certainly don't want it to autoplay.
They are by far the worst offenders among sites I am likely to encounter frequently, as destination links from aggregators and social media. Newspaper sites are far more well-behaved with respect to their scripts, but also more likely to directly monetize the page view.
ScriptSafe is running and I allow some sites, trust a few domains, and the rest get, at best, temporary access to run local JavaScript if specific content I want isn't loading. I get the feeling the majority of sites don't even function without JavaScript at this point, and some intertwine their ad system with other "necessary" JavaScript, so it's tough to surf the web without some hassle.
I don't think this is a perfect or even passable long-term mainstream solution.
I prefer this to the WaPo model of paywalling or having a limited number of articles.
I do object to the Bloomberg model though, where they say "We notice you're using an ad blocker, which may adversely affect the performance and content on Bloomberg.com. For the best experience, please whitelist the site."
Wth? No way. Please ask nicely, no FUD.
Asking nicely doesn't work.
I would very likely unblock a site if they spoke to that. "We've taken numerous steps in the last 3 months to increase your privacy and eliminate bad, bloated, malicious, and frankly user-unfriendly advertising. We value and will not abuse your trust in allowing us to share advertising with you."
I have always blocked ads and always (try) will be, but I this is the outcome from Adblock going mainstream. Yes, the ad networks/sites were the reason in the first place, but it doesn't matter. Another side-product is (hidden) "native advertising"... so many tweets/share/likes are purely marketing. That gay marriage article Madonna tweeted? Think twice before you believe he does it out of morals, most likely she is being paid to share that out with her audience.
I don't trust you not to show me scammy ads, load 2MB of tracking JS, maliciously redirect me, or generally ruin my overall user experience with your content you claim is so valuable. So I run an ad-blocker. I'm blocking your infrastructure because I don't trust it and blocking your ads because I question your judgement.
And the only other option you offer me is for me to give you my credit card number!? To infrastructure I don't trust and to a company whose judgement is in question.
Nope.
If you host your repo in some other country that does not care about U.S. DMCA then it should be fine.
Disclaimer: IANAL.
It sounds a bit weird that a notice that has legal ramifications and is written in non-official language of the country would be legally binding. Or would American judges accept DMCA notice that was written in Spanish (I was considering using something like Comorian, but that's probably a bit too different case)?
https://en.wikipedia.org/wiki/Web_hosting_service
lol
1) Find a young eager numbers driven federal prosecutor near 'US District Court Of Wyoming'
2) Offer plea deals. Explain to the users of said 'hacker plugins' they can choose to take the 'risk' of a (confused local residence) jury or take the generous plea of 2 years of federal prison.
>From those cases, we distill two general rules in analyzing authorization under the CFAA. ... Second, a violation of the terms of use of a website--without more--cannot be the basis for liability under the CFAA.
They say this because (Id. at 1076):
>"Not only are the terms of service vague and generally unknown . . . but website owners retain the right to change the terms at any time and without notice." [676 F.3d 854 (9th Cir. 2012)] at 862. As a result, imposing criminal liability for violations of the terms of use of a website could criminalize many daily activities. Accordingly, "the phrase 'exceeds authorized access' in the CFAA does not extend to violations of use restrictions. If Congress wants to incorporate misappropriation liability into the CFAA, it must speak more clearly." Id. at 863.
http://harvardlawreview.org/wp-content/uploads/2017/02/1265-...
The article links to a copy of the image: https://user-images.githubusercontent.com/5947035/29184514-2...
A. Nobody - NOBODY - is ever punished for violating.
B. The folks in question here think they have a colorable argument for why it really is DMCA. As linked from the OP, this is here [1]. (FWIW, I think it's silly)
[1] http://blockadblock.com/adblocking/is-adblock-plus-violating...
It is incredibly broken and corrupt, but like many things in the US nothing will be done about it because the elites have the money to defend themselves and enjoy the benefit of being able to ruin anyone they want who don't have access to similar financial resources that they wield.
If you can afford the several hundred thousands to millions of dollars a protracted legal battle will take you can often get the costs dumped on the losing party. You just have to spend years getting there with your own money and time.
Most people hear that DMCA notices are sent under penalty of perjury and think that means "if there's no reasonable claim of a copyright violation it's perjury". But the part of the notice that's made under penalty of perjury isn't the claim of violation, it's the assertion that the person sending the notice either holds copyright to the work in question or is authorized to act on behalf of the entity that does.
So to nail someone for perjury from a DMCA notice, you have to prove that they don't hold a copyright, or aren't authorized to act on behalf of whoever does hold a copyright, to the work in question. "This isn't a copyright violation" doesn't do it.
https://discuss.ipfs.io/tos#8
In other words, one would first have to integrate an IPFS client into all major browsers.
This is half decent idea though actually.
Though I should add that while the DMCA is indeed a US law, and notification and enforcement mechanisms vary by jurisdiction, other countries also have copyright law. It's illegal to publish copyrighted material without permission in any country with a copyright system. That's what copyright is.
If the contents of the bottle doesn't facilitate in aforementioned memory deletion, usage of the bottle to apply liberal amounts of blunt force is suggested.
IANAL but this seems like a questionable use of DMCA Takedown notice which, in any event, isn't actually binding. EasyList could probably file a counternotification and risk a lawsuit.
> If it is a Circumvention/Adblock-Warning adhost, it should be removed from Easylist even without the need for a DMCA request.
Anyone know why he's saying this?
Edit: I guess he's referring to the following via https://easylist.to/2013/05/10/anti-adblock-guide-for-site-a...:
> Anti-Adblock should only be challenged if the system limits website functionality or causes significant disruption to browsing
Because their business model depends on it working.
If you're using something like uBlock, it might be worth going into Settings -> 3rd-party filters. There's a few lists in there which are not enabled by default that are curated to work around anti-adblocking technologies. For example, "Adblock Warning Removal List".
Edit: Disagree? Please comment. It's attackable via the DMCA because the word/brand is in the file in it's copyrighted form. If you encode it such that it isn't in that form, it's protected from that approach.
1. Can IP be encoded as a way of dodging the DMCA? a: no.
2. Will encoding the source material allow you to dodge DMCA trolls?
I think the answer is again no. The tradeoff in complexity isn't worth the marginal gains. Imagine not being able to browse the code on github, for example, since it's encoded.
A better response is to fight. If the DMCA has been abused, it's up to us to meet each claim with energy and on the same battlefield. It's tiring work, but this is the compromise America has reached circa 2017.
This is false if the IP being enforced is trademark (which I'm not even sure is covered by the DMCA).
So the encoding isn't skirting anything.
It is just removing an easy, incorrect loophole. They are getting away with the DMCA complaint filing because most providers will allow them if you can find the "matching infringing text" on the page, without further justification.
Encoding it forces the DMCA filer to more comprehensively explain what is being violated. Basically it just raises the bar to a point where frivilous complaints can't clear it.
You can argue that's unfair, but we don't have a justice system. We have a legal system. And these are the rules.
Encoding it forces the DMCA filer to more comprehensively explain what is being violated. Basically it just raises the bar to a point where frivilous complaints can't clear it.
I think the crux of the disagreement is that I've seen how tenacious DMCA trolls are. They're smart. We like to think of them as dumb, but that's just flattery.
If you're trying to apply technical tricks to get around the legal system, you generally lose. The way to win in this case is to meet force with force on the same terms: file a counter-notification.
I think you're underestimating how valuable it is to have the content un-encoded on github. Anyone can see it. Flip through their commit logs. They have dozens of contributors that add or remove URLs almost daily. That wouldn't happen if it were encoded.
Obscuring it makes the DMCA filer have to better explain the why in the request. Something more than just "this short piece text is on this page and I don't like it".
Github is a very above the table solution for distributing a list of things. But if it gets to expensive to host it there, due to frivolous lawsuit threats, I expect other solutions to distributing these lists start to pop up.
The best advantage of encoding or even encrypting this stuff would be obfuscation. It would make is much more difficult for someone to even become AWARE that they are being blocked, if the info is hidden.
Not everybody has the resources to fight off trolls, even if what they are doing is completely legal (as in this case). Sometimes technical solutions are your only option.
Regarding your point about obfuscation, I feel like people aren't thinking this through. It's on Github. The commit messages are public. Finding whether you're blocked is as simple as grepping the logs for your domain. And if you feel the people filing the DMCAs aren't technically capable, you may be underestimating them.
The advantage of having it on github far outweighs the negatives. How many contributors do you feel they gained from this publicity? Possibly at least one, which is one more than EasyList would've had otherwise.
The DMCA complaint is patently invalid in this case. A counter notice would almost certainly eventually succeed, it's just a lot of work and potential spend in legal. Encoding it is just removing the ability to use it inappropriately in the first place.
That's why I don't consider this underhanded. As you mention, it's not copyrighted in the first place. Obscuring it is just closing the loophole that's being exploited.
I'm not talking about obscuring long passages of copyrighted text. Just obscuring one plaintext url that's on a page with others.
If you put an encrypted blob on each line instead of a plaintext url, the DMCA notice will contain "My copyrighted work appears at <link to github line number> which decrypts to <my url> when using <decryption method>." It's exactly the same as the original claim. If you feel they're not technically sophisticated enough to file a claim like this, I think we'll have to agree to disagree.
This is from experience. Scrapers that change one or two words in a long passage of text getting away with it because it doesn't match. Or very lightly cropping 1000's of original photos. I will cede that it depends on the provider. Google and many others do some rudimentary checking for sanity before allowing a DMCA request. They would never have passed this one, where just a short piece of text was claimed as infringing.
which is the ASCII _encoding_ of the forbidden string.
Just because these bits are an EBCDIC cp500 encoding of that string doesn't make it less forbidden than an ASCII encoding:
0b100001100b101001000b100101010b100000110b101000110b100010010b100101100b100101010b100000010b100100110b100000110b100100110b100000010b100101000b10010110b100000110b100101100b10010100
Here's how I made both.. shows reasonably (IMO) that encoding is.. nothing.
And reduced discoverability that your url is on my page in the first place. Even though a url isn't something you can copyright.
If you could make it work, you'd would wind up with some sort of source file of domains, parsed at build time to generate list of hashes that actually ship with your plugin. That source file would belong in a repo, and would still be DMCA-able in this way.
Also, this would make ad-blockers even more CPU intensive than they are.
We shouldn't have to pursue a technical solution. It's my computer, it's my internet connection. If I'm not allowed to control my own property, then the concept of property becomes meaningless.
I guess you could distribute a compiled finite automaton instead of a list of hashed values. It would make searching GitHub for "infringing lists" much harder (even harder than hashes).
Nevertheless, I agree with "We shouldn't have to pursue a technical solution". There's no point in trying to act like a Mr. smarty-pants in legal situations, as most technical solutions might not work out as expected in court.
[HASH:1AB543.124A3CC4.1AB543]/ads
Although they may be CPU intensive in terms of browser add-ons, I'm under the impression ad blockers are usually less CPU intensive than loading all the scripts required to display the ads, at least on particularly heavy pages. Does the CPU cost of blocker vs ads ever favor ads?
This makes hashes somewhat less useful. And a distinct hash of a URL could likely be considered to be the URL itself for the purposes of a legal action.
They even clearly state they used the only tool available to them, DCMA. From all the current summaries on this, DMCA does not apply to a line entry in easylist. A domain can be trademarked.
This should be added back in. And if github cannot standup to DMCA abuse, then well, easylist and all other developers should be giving a clear hard though to their continued use of the github platform.
Edit: it looks like EFF has gotten in touch with easylist. Good. https://torrentfreak.com/dmca-used-to-remove-ad-server-url-f...
Ahhh... other comments are saying https://en.wikipedia.org/wiki/UBlock_Origin
uMatrix is pretty much like an old school software firewall, except it is just for your browser. It works by whitelisting, instead of blacklisting. There is a bit of a learning curve, but after you've visited your most visited sites, it becomes a fairly easy solution. As you fist visit sites, you configure it to only allow what is needed to get the functionality you want. Once done, you don't generally have to muck with it further.
As stated, there is a learning curve. There are many choices of what to allow and block, but you can surely figure it out. You can even export and share your configuration.
I am not affiliated. There is a version for Firefox, Chrome, and my beloved Opera. It'll probably work in Pale Moon, Vivaldi, etc...
It eliminates the need for multiple extensions. I've been very happy with it.
I use ad-blockers in every browser and I would have no problem if that were part of the headers my browser emits ( have no idea if it is or not). If websites don't want to serve me because I'm blocking ads, so be it.
Admiral seems to be a paywall server basically. If blocking their domain gave access to paywalled content, then the DMCA seems to apply http://www.dmlp.org/legal-guide/circumventing-copyright-cont...
However, that defense is a bit flimsy to me since the fall back to having the paywall blocked could/should be a "Paywall blocked, please disable your addblocker to gain access to our content" msg.
Anyhow, that is immaterial because so long as they don't actually serve adds, Easylist could/would have removed the line no problem. Admiral should have just said "Our domain doesn't serve adds, we work on paid content access" and they would have been removed without all this hassle.
EFF has gotten in touch with easylist according to [1]. That's good.
[1] https://torrentfreak.com/dmca-used-to-remove-ad-server-url-f...
Well it turns out they kinda do. Sites have terms of service people supposedly agree to, all the time, without reading, because it's fucking impossible.
I posted this argument before and got the following comments which make a good argument:
https://news.ycombinator.com/item?id=14095147
https://news.ycombinator.com/item?id=14095410
However the comments get into implementations like Netflix and rendering that data, but it's a bit different because in that case you are paying for access.
Will we be in a world one day where sites can require specific web browsers, by law?
We say the same things with government waste over military and healthcare. And we can fix it in the same ways with better trust, accountability and regulation.
Do you realize just how much advertising funds? It's a 12 figure global industry and 99% of the content you consume is funded in part by it - and that's before we get to how advertising drives the economy by efficiently matching businesses to customers. Every company relies on advertising (whether paid, word-of-mouth, etc) to succeed.
It's irrational to see so much hate and it's likely your complaint is really only about intrusive ad formats and data privacy. That is something I agree with and I'm for every change that makes for safer, better, and more private ads, but that is vastly different than calling for the elimination of advertising in any sensible reality.
As Admiral's blog post points out, Github recommends using the same contact procedure for anti-circumvention takedown requests as for normal DMCA takedowns. But as far as I can tell, they're doing so purely on their own initiative; such a takedown request doesn't have the force of law in the same sense that a claim of copyright infringement does.
It most certainly does apply to anti-circumvention in many cases.
The DMCA is a set of laws. The DMCA takedown procedure is a part of those laws, defined in a fairly rigid way: it has specific notification requirements, timeframes, and is clearly defined to only apply to copyright infringement. Just because the DMCA also prohibits circumvention, it doesn't automatically follow that circumvention is the same as copyright infringement. And the Wikipedia section that you linked to doesn't mention the takedown process at all.
I made this mistake to, Admiral's blog post does imply it. However, they were making a DMCA take down request, based off the reasoning it was for anti-circumvention.
Their request is here: https://github.com/easylist/easylist/commit/1ba8d4afeec6d562...
And was made by this account: https://github.com/dmcahelper
So, they made a github account the same day they made the "request" with an account that in no way indicates where the request is coming from? The github profile bio reads "Help all parties understand and resolve DMCA issues efficiently and effectively to minimize file and repository impacts."
Perhaps they should have used a bit more transparency when asking for the offending url to be removed from the repo, instead of acting like a spammy copyright boogyman, then immediately resorting to a dubious DMCA takedown request.
Why stop at intrusive ads ? Just block everything that features commercial ads.
Though the real issue is not ads per se but the tracking that tags along.
So if a particular site uses admiral to protect its ads, it loses traffic.
For instance, let me go out on a limb and point out how some distros of linux insist on shipping without any non-free software. So, a user ends up having to go through hoops to just get an audio of video file playing. I think the analogy Im going for is, you don't want to play by our rules (our license, etc), we'll not use your software (or correspondingly block your site).
I'm trying to point out what I think is likely consequence of such an action
/impassionate comment
I don't think that's universally true. For me, if a site is broken because blocking ads also makes the content inaccessible, I just close the browser tab and move on with my day. (For a while the LA Times was blocking content in this way, so I just refused to visit their site. I guess it worked; they don't do this anymore.)
I don't claim to be the common case, but frankly I don't know what the common case is, and I suspect you don't either, so it could go either way.
Flash I will give you, though it has been an irrelevance to me since YouTube went HTML5.
> Many GNU/Linux distributions do not contain libdvdcss (for example, Debian, Fedora, SUSE Linux, and Ubuntu) due to fears of running afoul of DMCA-style laws, but they often provide the tools to let the user install it themselves. For example, it used to be available in Ubuntu through Medibuntu, which is no longer available.
[1] https://en.wikipedia.org/wiki/Libdvdcss#Distribution
I disagree. Users use adblock lists to protect themselves. This company has proven that they are actively hostile to users. Blocking their entire site, all of their domains, etc, is a sensible precaution for users to take. I have no doubt that this company serves JavaScript (i.e. executable code) that serves their purposes, not users'. And any other sites that insist on using their services are also hostile to users, and blocking them is sensible as well.
If some users just have to see that site, they can either find another list (who cares, no one's doing this for Internet Points), or they can click the "Add Exception" button.
We need not submit ourselves to be effectively held hostage by hostile content providers. It's just content.
So one argument to do is this is because it is NOT illegal, and the purpose would be to stop frivolous lawsuits.
So yes, it would be trying to creatively skirt frivolous lawsuits.
Another legit reason though, is obfuscation. The company that tried to threaten this frivolous lawsuit may have not even noticed, if it was some weird regex. And they'd either not complain, or have to spend a bunch of money tracking down the problem. Both are wins, in my book.
But you'd significantly help the legal case of those claiming it is by trying to obfuscate that you're doing so; they would argue in court it's an implicit admission you "knew it was illegal."
So you'd argue in reply that although you maintain that it's legal, you knew that it'd likely be something that bad actors would file frivolous suit over. Even when you win, being hauled into court is incredibly disruptive.
Blocking a URL that allows you to break a copyright-protection mechanism[1,2]? Well, that's not so clear. It's also unclear whether or not Admiral falls under the umbrella of a copyright-protection mechanism.
I really really really want EasyList to be in the right here, and be able to re-add the block without fear, but it's far from clear what all the implications of this are. I'm glad the EFF has stepped in to help them out; I'm content to wait for their opinion (or the opinion of an actual lawyer versed in the subject at hand) on this.
In the end, this is just another example of why the DMCA needs to go.
[1] Yes, you could say that this is bad design that the mechanism can be broken so easily, but that's not the point: the DMCA doesn't care how good or bad the mechanism is. If you break it, you're in violation.
[2] I suppose there's another point to be made: DMCA takedown notices are only for removing content or links to content that contain actual material where copyright has been infringed, not for removing circumvention tools.
If there is an adblocker that allows me to download lossless video from Netflix I'd sure like to hear about it.
Are you perhaps saying that the ads played on Spotify and YouTube are a form of DRM? Or does every TOS violation constitute a DRM violation now?
How is "blocking ads" in any way related to copyright and DRM?
Well, they're obviously in the right :)
> and be able to re-add the block without fear
They could fix that by improving their OPSEC. So as to not be so easily threatened.
I guess the bottom line is whether one is forced to blacklist/whitelist a site and what means are permissible. If its simply about the site name appearing literally then a workaround would seem easy enough and one couldn't claim uniquely singling out because the filter applies more broadly. Of course the intent is the same in both, but I'm not versed enough on DCMA issues to know how intent plays a role in this field. Your point actually makes me curious about the legal field more generally and just how pervasive intent is and what areas of law it plays a role and which is does not.
1. Site added to block list.
2. Site removed from block list due to DMCA takedown request.
3. Site block by new rule added that doesn't target it directly.
I can't imagine any judge or jury looking at that sequence events and then taking you seriously when you say "I didn't intend to block the original site".
The parent's point was more along the lines of: people in the tech world need to stop looking for technical solutions to all problems. Some problems are social problems, or legal problems. They should be solved directly, not with awkward (or possibly illegal or at least tort-worthy) workarounds. We talk about chilling effects and corporations engaging in anti-social behavior when they threaten open source and the open web in particular, but attacking social/legal problems with technological workarounds is itself also anti-social.
Not saying that technological solutions are not useful sometimes. In the short-term, you can often make a bad social or legal problem less bad by using a tech workaround, while simultaneously taking the long slog toward fixing the root of the problem. But putting tech band-aids over our problems and then walking away will only hurt us in the long run.
However I think what actually happened was that the business is operating paywalls/"anti-adblocker-walls" for other sites - so they claim that blocking them constitutes "circumvention of protection devices" for their customers - which indeed would be far severe for adblockers if confirmed by a judge.
(That's my understanding, though I might have gotten it wrong)
The admiral website has a copy of a notice [1] if you are interested.
[1] https://blog.getadmiral.com/dmca-easylist-adblock-copyright-...
In that case, we are legally require to update all DNS servers' entries to remove that name permanently. :-)
Or alias it to 0.0.0.0 !!!
Moreover, the DMCA covers unauthorised access to copyrighted content, and the ad blocker cannot claim ownership of the ROT13'ed domain name, just as the domain name itself is not copyrightable.
In theory the ad blocker could use a more complicated scheme to obfuscate their source code, but I'm not sure whether they could combine a "do not de-obfuscate this code" rule with an open source / Free Software license.
It's interesting to compare this to Second Amendment arguments. Do ad blockers block ads, or do users? Do users have a right to keep and bear ad blockers? Of course it's silly, and ad blockers are passive tools, but there are some striking parallels.
instead of blocking requests, replace the domain name with something funnily invalid, with a play on words on each original domain. then in case of any dmca, claim satire fair use.
it would make patchs review much more fun too!
Imagine a DVDCSS-like system that used remote servers to convey permission and defaulted to ALLOW. Would users who unplugged their DVD players from the Internet be guilty of circumvention? Now imagine that DVDs for said player were handed out freely on the street, stuffed into people's mailboxes, etc. Would people who played those DVDs without connecting their players to the Internet be guilty of circumvention?
That's the same thing, in principle, that's going on here. Claiming that it's circumvention (whoever makes that claim; I don't know if you are) is preposterous. This is obviously an abuse of the DMCA (not hard to do, considering the DMCA itself is an abuse, but I digress).
That way any domain that was ever added would be in the blocklist. True negatives should be pretty low.
*edit: removed a redundant word
Edit: libertarianism anybody ? :D
Which will make administration rather more complex.
How you block the domain - with a simple string or an automatically trained neural network - doesn't matter.
You're asserting things to be true that are very much in question, and the assertion borders on the absurd.
Is it also a DMCA violation to add firewall rules to ones own network equipment?
That type of behavior can only be bad for open source software. Threats like "to minimize file and repository impacts" are going to push more folks toward private repositories if they don't understand that it's not an actual authority pressing them into making changes on a given platform.
¹ https://help.github.com/articles/github-terms-of-service/#3-...
edit:
Response from support: "Hi xxxxx. This account is not affiliated with GitHub and we are looking into it."
This is not the first time this has happened.[0] GitHub's response has been woefully inadequate and OSS maintainers should consider using another platform. Everyone using GitHub is vulnerable to suddenly and arbitrarily losing their repository.
[0] https://news.ycombinator.com/item?id=5331766
And again switching to a different platform doesn't solve that problem either. You'd still lose the issues that are in github.
Using github is bad for FLOSS.
Hmm...
I have also now spent more time on this than I'd expected.
One of the DMCA provisions, is that (as others have mentioned) that software to circumvent copyright is also prohibited.
I do not believe that EasyList meets the legal definition of software. It's not software, I don't believe. It is a list used by software. Basically, it is a configuration file. By itself, it performs no functions.
Its pretty much a 'dumb' plain text file. It is not executable, in and of itself. By itself, it does exactly nothing except take up space.
Computer software is defined in 48 CFR 2.101 and, unless my reading is incorrect (and it may be), this doesn't enable a program to be produced, created, or compiled.
I can find no rulings on this subject, however.
I am not a lawyer, this is not legal advice, and you should check with a qualified legal professional in your jurisdiction before acting.
That said, this does make for a potentially interesting case. It's probably a good thing to get some decision handed down. That and, well, it'll be pretty easily circumvented regardless of potential rulings.
However, circumvention tools (software or otherwise) require suing, not merely issuing a takedown notice, as another commenter pointed out.
IANAL :-)
Ok. We do not want to copy your add. We just want to get rid of those by putting them in a filter. How on earth this can come under DMCA?
It may very well be that the URL should have been removed, with regard to Easylist policies, github policies, or even some other law. But not DMCA takedown notice. If DMCA takedown notice was the only tool available to them, then they had no tools available to them, because DMCA was not a tool legally available for asking someone to remove a URL from a list. A URL in a list is not possibly copyright infringement.
(I am not a lawyer, this is not legal advice, just my understanding for sake of discussion of a hypothetical)
So for instance, when the CSS encryption on DVDs was broken, there were DMCA takedown requests issued to sites hosting the deCSS decryption code, even though the copyright of that code itself wasn't at issue.
ETA: a comment below corrects me, saying that the DMCA prohibits distribution of circumvention tools (i.e. makes it illegal and even criminal I think), but doesn't allow takedown notices for such tools: you have to actually sue them in court. So this takedown notice seems to have been incorrect even if the DMCA is invoked.
Github's own guidelines to DMCA takedown notices say "Identify the copyrighted work you believe has been infringed." https://help.github.com/articles/guide-to-submitting-a-dmca-...
If the notice did not identify a work believed to have been infringed, then why did Github respond to it? Why don't they follow their own process? If the notice did identify a work being infringed, then they are probably wrong because you can't infringe a copyrighted work by listing a URL in a list. I guess actually getting damages might require proving they _knew_ that, and be generally infeasible/cost prohibitive.
There are some problems with the DMCA regime.
This would in fact be the most contentious clause, the one about being able to take down tools that enable circumvention, the one that is historically the one that perturbs techies and HN-types the most. I think what we see here isn't so much a DMCA takedown of a single line, but a single line modification in an attempt to prevent someone trying to take down the entire ad blocker, by making it so this particular person doesn't have any standing (in the legal sense) to make claims against the ad blockers anymore.
The copyright takedown clause would be number two, but it has a mitigating factor; the DMCA copyright takedown process that you might see on a hosting site or HN itself [1] has a positive element as well, which is that by conforming to the DMCA a site like HN is able to host user content like our comments while discharging from themselves the responsibility of having to pre-filter every comment for copyrighted content. This clause has certainly been abused, and there is a justifiable case that the Feds have not been adequately aggressive about chasing them down, but on the net I still approve of this clause, personally.
(You also have to distinguish between "the DMCA" and a site's policy, which may go above and beyond. Many or most of the things that people complain about for YouTube, for instance, are their own elaborations on the theme, not the legal requirements themselves. Not all of them, though; YouTube tends to favor the big media companies very strongly when it comes to defining "fair use". But things like taking away your monetization and giving it to somebody else is a YouTube policy, not the DMCA. Or at the very least, it's a penumbric emanation of the DMCA and not the DMCA itself.)
Were I the developers or anyone with any ownership in this software, I would hesitate on putting too much stock in the idea that this was an improper use of the DMCA claim process. It was. But the reward for aggressively pushing back on that may be a proper lawsuit for violation of the anti-circumvention clauses, for which there is not a notification process but simply a legal basis for lawsuits granted, IIRC. Your reward for armchair-lawyering this DMCA takedown request could be a true lawsuit.
[1]: https://news.ycombinator.com/dmca.html - have a look at the footer of this page
What the DMCA says about circumvention measures:
> (2) No person shall manufacture, import, offer to the public, provide, or otherwise traffic in any technology, product, service, device, component, or part thereof, that—
> (A) is primarily designed or produced for the purpose of circumventing a technological measure that effectively controls access to a work protected under this title;
> (B) has only limited commercially significant purpose or use other than to circumvent a technological measure that effectively controls access to a work protected under this title; or
> (C) is marketed by that person or another acting in concert with that person with that person’s knowledge for use in circumventing a technological measure that effectively controls access to a work protected under this title.
It seems obvious to me that Easylist is not such, I don't think it meets A, B, or C. But it'd be an expensive court process and who knows what the court would end up doing.
In this example, it seems like Easylist has no desire to include that URL anyway, as it is not an ad server.
It may be true that Github can decide to refuse to host the thing anyway, but it's not a DCMA takedown notice process.
The whole situation is indeed a mess.
Also, I agree that Easylist itself may still not be a lawsuit target. It simply makes a claim about a certain domain, it doesn't do any access circumvention itself based on that claim. But if Easylist isn't, the ad blockers using it certainly would be. And that alone would change the dynamics of the situation quite a bit.
I hate to say it because I like adblockers too, but it is frankly very likely that when the advertising industry finally makes the push against them that by current law, it will indeed turn out that it is illegal to use ad blockers on sites that take active measures to ensure you view ads [1]. Again, don't mistake me saying this for endorsing it, but I think it's a very plain and obvious reading of not just the DMCA, but even something as fundamental to our legal system as common-law contracts... if a website wishes to make viewing their content conditional on viewing an ad, they can do that, just as they can make viewing their content conditional on paying them money, joining a club, or anything else that qualifies as "consideration" [2]. They can also place further restrictions on that content as part of that content. Any argument in favor of ad blocking that would also explain why either Netflix customers have the legal right to retain copies of the movies, or in the most extreme cases, explain why everybody has the legal right to retain copies of Netflix movies, should be discarded as an argument that proves too much [3].
I'd suggest the ad blocking community and the interested tech community at least wargame out the plan for if they lose the legal cases, because I would personally put that at somewhere around 90% probability if any of them ever go to court. Even with the EFF supporting it, I fear the EFF would pretty much be reduced to making very handwavy arguments about fundamental rights and basically pounding on the table, because in my considered opinion they really won't have much else. And even if they are correct, courts tend not to take much account of those arguments.
[1]: If the judgment goes really bad, it could even be illegal to bypass sites that don't try anything explicit. However there is a very good argument here that there is a history on the internet of assuming more rights rather than fewer if you don't assert yourself, such as the fact that browsers generally render things differently anyhow, the long history of search engines, the needs for accessibility software to render pages fundamentally differently anyhow, etc. I think there's a good chance no judge would want to overturn that consensus as it's now around 25 years old.
[2]: https://en.wikipedia.org/wiki/Consideration
[3]: http://slatestarcodex.com/2013/04/13/proving-too-much/
Actively circumventing access restrictions is another issue entirely, but if I'm sent data, there is no reason or guarantee it must be displayed as intended. What about blind folk, or those who don't run JavaScript? Is turning off just now illegal? What about not downloading images?
If a site can't make me pay, and doesn't want it's content to be viewed unless I pay, simply don't send me the content.
Again, circumventing access control, even terrible ones, is one thing, but if you send me the data, then you sent me the data, what the issue?
I'm fully on your side here, but to play devil's advocate, I think it's fair to consider an analogy like "if a restaurant doesn't want its food to be consumed unless I pay, simply don't serve me the food."
You ask a server (of the web or the hospitality variety) to serve you the usual. The server gives it to you and reminds you that the deal hasn't been fully executed yet: you're to next [ask the cashier by the door to ring you up || ask the ad server to serve you an ad], and then [pay when asked || render the ad amongst the rest of the content]. Sure, you could forego talking to the [cashier || ad server] instead.
Again, I don't like that one bit, but I think it's the kind of "reasonableness" that holds up in court. IANAL.
But, you choose not to eat the raw onions they've served with the meal.
This would be the analogy of choosing not to render html/javascript content.
Moreover, there is no way to know if the content you're requesting will require a transaction (unlike a restaurant where the prevailing expectation is payment for service, even if prices are left off the menu). It has always been the case that I need to request the resource and then be told if it costs money, otherwise it's given to me.
Likewise, there has never been, and I would argue can't be, an expectation that a user agent render all content as expected. Would custom style-sheets violate the law? Do Lynx, Links, Links2, w3m, mutt, and pine all of a sudden become illegal? How does a screen reader render an ad? How does a braille interface render an ad? Am I now legally required to run a graphical interface otherwise I'm playing legal roulette?
What happens if the adserver malfunctions and doesn't send me an ad? Am I now put in a legally bad spot? What if an ad is sent in swf and I don't have flash installed? I also feel like there are legal implications to forcing someone to execute code sent to them. Do ad servers all of a sudden become responsible for drive-by malware? Can we sue them for damages?
I feel that the crux is that there is no way to know if "payment" is required before requesting a resource. You can't send me something and then say, "oh, yeah, hey, you need to pay me for that" when the (vast) majority of the time I'm sent things without any expectation of payment.
It may very well be more common for such hypothetical farmers to forego having an honesty box hiding where you don't see it until you've consumed the fruit, but for those who do choose to have one, are you stealing the fruit if you don't drop in a few bucks?
More on topic: I also think courts would see quite a difference in intent between using a mainstream graphical browser with an ad blocker vs using things like a text mode interface, a screen reader, a braille display, or libcurl. The former is like driving past the honesty box while chuckling; the latter is like not even knowing it was there.
The issues is that there is normally a expectation of paying for things like produce. Unless there was explicitly a "Free Produce" sign, I would expect to have to pay.
There is no expectation that you need to pay for the data sent to you later; if payment is required for access, you're told so and need to provide it to continue to the resource (or otherwise provide proof that you had paid, e.g. logging in).
There hasn't historically been and can't be an expectation of payment later because that would be untrue for many, if not the vast majority, of websites. Additionally, there has never been an expectation that the client will render everything you send to them. All browsers have the option to disable JS and images, and always have.
It's these differences in expectation and culture that I believe provide the difference between your examples and the web. Violating these constraints would cause legal issues in the vast majority of systems, would mean running old software would be illegal (Chrome preloads links under certain circumstances, but doesn't render them), and would also end up forcing users to run code they didn't choose to run (there is no expectation or knowledge of what code the server will send and choosing to not run harmful code would be illegal), which would be an interesting thought experiment as a civil rights violation. It would also force me to, say, accept a EULA for Flash, even if I disagree with it because I visited a site that randomly sent me a flash payload. Or what about something without a linux runtime; I would have no ability to avoid committing a crime, because I don't have the choice to accept the rest of the content that came with the content I can't run, but am legally required to run.
Violating the very assumptions of how the web works would have terrible ramifications.
> More on topic: I also think courts would see quite a difference in intent between using a mainstream graphical browser with an ad blocker vs using things like a text mode interface, a screen reader, a braille display, or libcurl.
Why? They're all the same thing. I'm deciding how I want to consume content; I'm not circumventing a access control mechanism.
Oracle has appealed, would we'll see what happens.
> disable JS and images
> They're all the same thing. I'm deciding how I want to consume content; I'm not circumventing a access control mechanism.
I guess the difference I am trying to highlight is:
* a lack of ads for hard technical and/or compatibility reasons (JS not enabled, images not enabled, graphics subsystems not existing, not having sufficient eyesight, etc.), versus
* a lack of ads because screw you.
This line in the sand may be stupid, but I'm afraid it's not "the same thing." I'm afraid this difference could be argued successfully in court, and that is my point.
But it's not "screw you" it's "I don't want to waste the bandwidth I pay for and am metered on with things I don't want to download and could potentially harm my computer". Viewing those ads costs me money as well, money which isn't going to the person serving the ads, not to mention the risk of malware.
This is an assertion that is commonly made on the internet, but I see no reason to believe it carries any legal force, or even necessarily any moral force. In fact it's not that hard to read it as an argument made solely to come to the desired predetermined conclusion rather than any sort of principled argument. It implies that the sender loses all rights to anything they send to you, which is definitely legally untrue; I gave examples above already.
Also, if you win on this point, you will not experience a glorious utopia in which ad blocking is OK and you can save whatever streams you want and so on... you'll experience a world in which all this content gets removed from the web and locked behind even more proprietary clients that will come with what the publishers want. What may seem to you to be a simple bugbite back in favor of what you believe your rights to be may cause a much larger allergic response than you'd anticipate.
"I can't be sued for not watching commercials."
You haven't signed a contract saying you will. That may not be the case online.
The questions about whether such contracts should be something that even can be offered, or whether simply clicking through a EULA or accessing a bit of content can bind one to a contract, or the nature of what such a contract may be allowed to be, are all separate matters of interesting discussion. However I don't foresee any world arising in which the "the purpose of a user agent is to display me what I want to see and therefore any manipulation of the content other people own the rights to is within my rights" is going to hold up. There's too many rights and rights-holders that won't stand for it, and even if you did somehow win that case, they'll simply retreat and retrench in whatever it takes to recover those rights for themselves. If you rewrite the terms of the contract, you have to account for the other side of the contract reacting to it, not just passively sitting back and going "Oh, gosh, I guess I'm stuck then, I'll just keep doing what I'm doing without changing anything."
But you can't accept a contract just by visiting the site. Especially since the in the same action as becoming aware of the exist of the contract also makes you breach the contract.
> However I don't foresee any world arising in which the "the purpose of a user agent is to display me what I want to see and therefore any manipulation of the content other people own the rights to is within my rights" is going to hold up.
Why? This has always been the purpose of the user agent and it's difficult to impossible to actually make sure things will always look the same in all browsers. Could viewing a site in FireFox or Edge become illegal? Again, how would I know that _before_ taking the action. What about systems such as links2, w3m, elinks, and lynx?
> f you rewrite the terms of the contract, you have to account for the other side of the contract reacting to it, not just passively sitting back and going "Oh, gosh, I guess I'm stuck then, I'll just keep doing what I'm doing without changing anything."
Which terms? The UA has always been the agent of the user, not the site whose content is being displayed.
I just find it very difficult to believe that the court will accept that I've broken a "contract" I can't know exists without breaking it.
I assume Github has a whole bunch of non-armchair lawyers.
But this is indeed the problem with the whole system, it comes down to who can pay the legal bills.
It seems obvious to me that Easylist is neither "primarily designed or produced for the purpose of circumventing a technological measure that effectively controls access", "has only limited commercially significant purpose or use other than to circumvent", nor "is marketed.. for use in circumventing a technological measure that effectively controls access."
But it could take a whole lot of legal fees to determine that in court, and as we saw in Oracle v Google, the courts don't always decide what seems obvious to us. For better or worse, any sane person or entity wants to stay out of court regardless of whether their lawyers think they have a great case. Unless they have a whole lot of money to burn.
At the least, I think Github should make it's policies clear about what it's doing. If they say a DMCA takedown notice must "Identify the copyrighted work you believe has been infringed" (as the law indeed says), they should not take action to complaints that don't do this. If they want to respond to other types of complaints, they should say so, and explain how. (And ask their lawyers how it effects their liability under DMCA, if at all).
Github appears to be trying for transparency with their docs and practices on DMCA, which is great and important and greatly appreciated. This is one area where it could be improved. Responding to DMCA takedown notices that are not in fact DMCA takedown notices and do not follow Github's own published instructions/requirements for DMCA takedown notices (cause they aren't DMCA takedown notices)... is not transparency. The DMCA regime has plusses and minuses; mis-educating people about the DMCA law doesn't help us evaluate what these may be in order to be engaged citizens.
Vocabulary much? I'll bet there's a blip on Google Trends today.
I don't know if that's the precise situation here, but if the ad blocker is intentionally carrying out a process like this to access the copyrighted work of the website without obeying the restrictions of the technological control process, then I could see that falling well within the bounds of the DMCA.
Is there any elaboration on what "effectively controls access" means (e.g. in case law or in the statute that I missed)? Does a system that fails open (the only thing listed in the EasyList commit was the domain name, so a network error would replicate the same situation) fall within the scope of the provision?
Apple Inc. v. Psystar Corp.[1] involved circumvention of a system that "effectively controls access" to Mac OS X, preventing it from being installed on non-Apple hardware.
Apple's anti-circumvention system is (in part) that some of the important system binaries are encrypted, the kernel transparently decrypts them when they are executed.
The key isn't secret (in fact it's a constant that hasn't changed in 10+ years), but it is only distributed inside the SMC chip on the main board of a real Mac.
There's no question that encryption is generally an effective access control method, it can't be circumvented without either having the key or breaking the encryption system in use.
The court found that regardless of how trivial it was to obtain the key, the fact that it was encrypted made it "effective":
> Psystar contends that Apple's anti-circumvention technology was ineffective because the decryption key for circumvention is publicly available on the internet. This argument fails.
> "The fact that circumvention devices may be widely available does not mean that a technological measure is not, as the DMCA provides, effectively protecting the rights of copyright owners in the ordinary course of its operation." Sony Computer Entm't Am., Inc. v. Divineo, Inc., 457 F. Supp. 2d 957, 942 965 (N.D.Cal.2006).
> Generally, measures based on encryption "effectively control" access to copyrighted works. Here, when the decryption key was not employed, the encryption effectively worked to prevent access to Mac OS X. And that is all that is required.
> See Universal City Studios v. Reimerdes, 111 F. Supp. 2d 294, 318 (S.D.N.Y.2000) (noting that when a decryption program was not employed, the encryption worked to control access to the protected work).
> Accordingly, Psystar has violated the DMCA by circumventing Apple's protection barrier and trafficking devices designed for circumvention. Apple's motion for summary judgment on its DMCA claim must be granted.[4]
[1] https://www.courtlistener.com/opinion/1557201/apple-inc-v-ps...
Funny how this disclaimer is only found besides legal advice. Really, you should not have to write this. ("I am not a lawyer" is more reasonable, though.)
I believe you can trademark a domain, but trademarks are irrelevant to this discussion. The DMCA is a copyright law. The key questions are:
a) Can you have copyright over a domain? (According to https://copyright.gov, no)
b) If you could, would having a list of them constitute fair use? (Almost certainly, otherwise all search engines would be illegal.)
On the other hand, it looks like it was an improper use of the DMCA because they're claiming that EasyList is an anti-circumvention tool (effectively arguing that it breaks DRM).
from what i remember Spain and Central Europe are very laid back regarding your rights to non-commercial steaming of copies of works you don't actually own
>uBO-Extra
>A companion extension to uBlock Origin: to gain ability to foil early anti-user mechanisms working around content blockers or even a browser privacy settings.
I think /u/gorhill is the lord of this particular war, and his followers are armed to the teeth. I type this on Firefox on Android with uBlock Origin.
I check his github occasionally to see if he accepts donations, and I donate to a couple of the lists occasionally.
In the war analogy, we have the best arms dealers. They other side is fighting a losing war.
As mentioned above, uMatrix is my favorite. Once configured, it is easy... There is a learning curve.
I'd donate regularly, but that doesn't appear likely. I greatly appreciate their work.
This. This is the main topic here. The wide use of centralized services (such as Github, but it applies also to Facebook, Google et al.) makes you dependent to corporate decisions, including coward (or maybe rational) decisions towards freedom of their users.
This is also why linux kernel developers will never, ever use a service like Github. Apart from scalability issues, the single point of failure that these services are (not for technical reasons, but for political reasons) is simply scary.
TL;DR: Assholes who send buggy DMCA is not the issue here. Depending on a centralized service is.
It should take much more legal effort and 'application of mind' to effect disruption.
I want to make it clear that I'm not arguing for the legal grounds here. I'm not a lawyer, so I will leave that to them. I'm arguing from a more moral/ethical stance.
I'd like to disagree with you. By allowing you to run under their umbrella, I feel that Github has a responsibility to take care of you, and the data that you put on their site. I feel that it is quite insincere for them to say "Sure, put your code on our site!" but then kick you to the curb as soon as there's any trouble. There's definitely a level of extremity that I don't expect from them: I think that after a certain amount of legal argument, they should pass it to the uploader, but I feel like their default attitude should be "no, you can't just attack the uploader because you feel like it."
It sends a clear message to the FOSS community that they don't care about taking care of their own, which is bad for Github, and bad for the committers.
I'd be curious though: Why do you think that "The law requires them to forward them to the account publishing the content without any consideration of the merits"? It's my understanding that they do have some grounds here as it is their site.
EDIT: I reworded my post as the original was rude, and accusatory.
> With all these dozens of domains (over a hundred), it sure smells like they're incorporating a HSTS fingerprinting attack into their product portfolio. HSTS fingerprinting enables a server to tag every browser with an n-bit (ie: 100 domains is 100 bits) unique identifier so you can track that browser whenever it returns (or wherever it goes). Since users cannot clear their "HSTS cookies" as it were, this fingerprint remains permanently associated with that browser. > > Wonderful feature for an ad agency to track each visitor indefinitely. Even while in Private Browsing / Incognito mode.
Okay. Let's eradicate them from the surface of this planet.
As long as that really is what they're doing, of course.
Maybe we need a browser extension (or just a website) that instructs your browser to make requests to the HTTPS version of domains that are found to be used to set HSTS cookies, thus "blowing the fuses" and making those domains unusable for providing bits of entropy.
In fact, rather than blowing all the fuses, the extension/website could blow just a random few, as a bit mask, giving you someone else's ID number and ruining the ad company's profiling/analytics. That way you would be helping people who weren't using this defence, rather than just having your visits not added to any profile.
You post an entry on your blog ridiculing them and their VC funded shenanigans and HN gets a good laugh out of it.
Dan the fag's response to being called out:
======================
Admiral asked Easylist to remove functionalclam.com from their filters and here’s why:
functionalclam.com is not an adserver.
That domain is part of the DMCA copyright access control platform Admiral provides publishers so they can engage visitors in a transparent way on the value exchange for their copyrighted content, instead of resorting to surprise ad reinsertion the way some of our competitors advocate but visitors and advertisers dislike.
Circumventing a publisher’s paywall or copyright access control technology is not OK and we don’t believe it’s core to the mission of AdBlock Plus and EasyList.
======================
Dan the fag's linked in page:
======================
CEO Admiral: Adblock Publisher Solutions 2015 – Present (2 years)United States
Advanced Adblock Analytics with Automated Revenue Recovery
The power of the internet to inform, entertain and liberate mankind is at a crossroads. The future of ad-supported content is in peril, and with it, free access for citizens to critical news, education, discourse and resources the world over. The shorthand name for this looming catastrophe is "adblocking", but the root problems and solutions for users and publishers are more complex.
Adblockers claim adoption by over 200M users worldwide and publisher losses as a result of adblocking are estimated to reach $40 billion in 2016. Despite per-site adblocking rates ranging from 10% to as high as 40% for some tech-focused sites, the trend is still young and growing with a 40%+ growth rate over the past 12 months.
Admiral is the publisher analytics suite built specifically to help web and mobile publishers understand the impact of adblocking for their site, and automatically recover lost revenues by solving the issues driving adblock adoption specific to their userbase.">
======================
Sounds like Dan the fag is a liar.
(1) https://blog.getadmiral.com/dmca-easylist-adblock-copyright-...
(2) https://www.linkedin.com/in/danrua
(3) Using the word fag here to mean a piece of shit. No homophobia intended. Much love and respect for the gays.
The problem is, society doesn't care. You're not allowed to mean well in this context. It's like being a heretic during the inquisition, then trying to argue that you're actually the good kind of heretic, the kind that believes in kindness and compassion even though you reject god. It doesn't compute.
Your options are to martyr yourself and be excluded, or conform while trying to be subversive in other ways. The former hasn't worked very well.
Your original contribution was valuable. It was excluded solely for your language. I would recommend trying again, and let readers decide for themselves. We're pretty good at reading between the lines here -- it isn't reddit. You don't usually have to be explicit, and we like drawing our own conclusions.
https://news.ycombinator.com/newsguidelines.html
Why are we relying on a list?
https://github.com/jspenguin2017/uBlockProtector/issues/95
Edit: the linked issue is regard "instart" which seems to exploit a Chromium flaw that allows it to disguise third-party cookies as first-party, preventing filtering based on that categorization alone.
It seems it's getting harder to rely on browsers working how they were originally intended.
That's because people want to Do Cool Stuff™ in their browsers - ie, they don't want to merely "browse"
Not so much a flaw.
Not so much a flaw.
My company, https://TalkJS.com, makes a pluggable messaging component. Customers embed it in an iframe, created by a 3rd party (from their perspective) hosted js file. Currently, it doesn't rely on cookies for security but we easily might change that.
Same for other pluggable content, say Disqus and many more. I would be very sad if an ad blocker would block us because we dare use appropriate tools for security.
Then my raspberry pi loads that ad in a headless firefox and clicks it thousands of times.
You won't believe how soon you stop getting ads, and instead just empty iframes, or warnings from Google that you're abusing their ads. Well, their problem.
Luckily, there's now an addon that does this fully automatically: AdNauseam.
Fully automated ad abuse, and ensures that if enough people use it, online advertising will die within of weeks.
We are coming to a point in the Internets genesis, where technology should evolve to allow the "information consumer" to directly reward the "information producer"... without the need of an intermediary like Google Adwords, etc. etc.
That's what paywalls are.
In other words, the copyright law is used to force content consumption.