GitHub Refuses To Remove Cracked Copies Of My Software Even After A Month
Many people are asking AI models to take the Javascript code from my website, remove all ads from it, and they publish such a "new product" on Github for everyone to download.
There exist tens of such repositories on Github. I want my website to be the only source of a stable version of my program Photopea. I even received emails from people complaining about something in Photopea, and it took several emails to figure out that they are not using Photopea.com (so it ruins my reputation a little).
I reported it to Github on the 4th of September 2026: https://www.photopea.com/g/XKoqqIGv
Today, a month later, I received this response:
Thank you for submitting a DMCA takedown notice. We've reviewed the information you've provided, and based on the facts presented to us, we're unable to confirm a violation of 17 U.S. Code § 1201.
What do you think I could do? Do you think I should look for a lawyer to deal with it outside the digital world? I really doubt that a real person ever looked at my report, and they probably send this response automatically to 99% of people.
296 comments
[ 0.40 ms ] story [ 25.5 ms ] threadHope you manage to get it sorted but I have no idea how that would go down at this point. I’m sure at least one of them could claim they copied it off the other ones and then you’re shit out of luck.
I've seen people on Reddit writing things like, "Come on, what's the big deal? AI can write any code now." I disagree. There are hundreds of thousands of lines of code here, very complex code, which even AI wouldn't be able to write on the first try or in a single day. So this person stole this code from Photopea and built a product on top of it.
Headspace updated it's privacy policy info recently, which got me to have it checked with an LLM. And it turns out that what you're doing on $100 per year meditation app is still being sold to anyone willing to pay. Using headspace lost it's charm. I wonder if Andy ever agreed to this.
Here's a very rough draft of a comparison of the privacy of different meditation apps: https://litter.catbox.moe/crq4n62bf1prei8j.html
Balance is crazy! They're essentially a data broker themselves.
https://www.reddit.com/r/Bard/comments/1wxmqpt/ive_created_o...
You will never sue your way out of this. Piracy will always exist. GitHub will respond to a legal notice but whack a mole is the game and legal notices cost money
The solution in the WP community at the time was variations of the plugin as a loss leader to get revenue with support or to leverage community visibility into larger contracts for work or hosting the platform for others.
If your business model depends on your code being a secret, JavaScript is not a good play. The business model needs to enhance what the code offers since it’s basically a commodity now
Whether we like that is not the question I was answering.
My understanding is because of the way PHP works all plugins are directly interacting with the wordpress code.
Commercial plugins are a thing, next.
It just doesn’t work. Anyone who wants to will take it. I don’t see this problem going away
That is the entire business model of grafana
But wow, how do you stand a chance in stopping anyone when your code is all there freely available in the browser
Because it is trained on code of people like Ivan
I've had an AI reproduce astronomical formula functions without difficulty in whatever programming language I want. Graphical algorithms aren't even a challenge.
Might be time to reconsider the business model entirely, because Pandora's box is already opened.
I already don't care that much about IP "theft" on a good day. And it just seems weird to me that Ivan is complaining about other people copying his code (or is he talking about the *Craft projects, which are LLM Rust ports of common tools?) when his product is itself just a blatant adware copy of photoshop.
Pot, meet kettle and all that. Would Ivan be okay with Adobe using a third party he relies on to nuke Photopea due to IP infringement?
Use a trademark.
Second, the trademark will help you against the masqueraders, those copying your tool and the Photopea brandmark. That will help with customers complaining about some other modified product. It will not help in case you find someone copying your codebase and putting it out in the open under a different name. For that, you'll need a copyright.
Doing both of these might be expensive but gives you complete legal standing. Companies will have no choice but to take down the copies.
Something else is needed. If the code is basically open, then there is no technical protection. Remove tens of those repos - hundreds might appear.
I would imagine they all converge on common features and core implementation foundation
Because if the javascript source matches the source in the repo, then they copied it
I guess if you wanted to actually check it then you could compare the javascript from the site and the javascript of the projects on github. Both are accessible
If you have one of these, it’s possible that GitHub would honour it if you go via a lawyer.
As a pedantic aside, I thought that "cracked" software meant software that has had the copy protection bypassed or removed, not the alteration of the software functionality itself. If your software was actually cracked then you have some fairly heavy law in your favor.
Less than 7 figures (~1 million) per year -- not per month -- based on previous comment from 2021: https://news.ycombinator.com/item?id=26769141
(I'd just quit my job if I had an income like this.)
My reply is that you now own a customer list, brandname and trademark, and that is about it.
I would not fork or re-release proprietary code. I would ask my LLM to write a very rigorous end to end test suite for your tool, delete all the code, then have a clean context LLM re-write the code to pass all the same tests. Then I could publish it under an open license.
Ads are a cancer, and it is a matter of weeks before someone does the above where you have zero recourse.
I suggest open sourcing the code properly without ads yourself before someone does it for you. If you do that someone might donate to you instead of paying for the tokens to clone your work.
Software is no longer a moat and DMCA means nothing anymore.
If ad was the only way to get money, there would be no product/service to sell anymore and thus...nothing to advertise. It just cannot work that way.
Photopea is lucky that it has a decent amount of revenue. But that's an exception, not the norm. Generally speaking, for new software, the business model of desktop, client-only software hasn't worked well since late 2010s at least, and nobody should expect to run a viable business like that today. There are very few applications you "install" on your computer that doesn't require native capabilities in some way.
A closed source, client-only "desktop" application, especially a web app with obfuscated/minimized JavaScript code, has no real copyright protection these days. You either sell ads, sell it to enterprises, or if you are lucky enough to be able to pull it off, sell a subscription. Not putting the logic on the server in the first place means everything is basically public knowledge.
If you want to make proprietary software that's cool, but client-side JavaScript was a terrible choice. The cat is out of the bag.
There's a reason software for which you purchase a license key generally doesn't give you source code outside rock-solid legal agreements.
That is an extremely disingenuous and bad faith interpretation of what OP has said and I think you know it. You want to be edgy? Go comment on Reddit.
OP is rightly frustrated that their copyrighted work, that they’ve been working on full time for over a decade, is simply being ripped off by people and GitHub refuses to do anything about it.
This is a good faith contribution to the discussion, and frankly, the way things are going, the point it raises is something most of us need to consider.
OP, I’m sorry this is happening to you. It must be incredibly frustrating to have people ripping off something you’ve worked on for many years and pass it off as their own work. I would be furious in your position.
I wish I could do something directly to help you but the best I can offer is to echo the best advice others have already given you: it’s time to get a lawyer. That is the one guaranteed route to get GitHub to sit up and take the action they should already have taken on your behalf.
Free hugs will not replace lost ad revenue.
He needs to take the lesson learned on how to better protect IP at the source. Once it's out you cannot put the genie back in the bottle.
Literally every paywalled article posted to this site has an anti-paywall link in the comments. How is this materially different?
This isn't GitHub's fault and it's effectively impossible to stop.
Right now, the settled law is that such an LLM reproduction is 100% legal.
If you really want to protect your software in the years to come, you might have to seriously consider starting some sort of popular political movement to address this issue in copyright law.
Current models can already do a full reproduction of anything with source code available (e.g. JavaScript...), and there's already been some poor-quality Photoshop knockoffs.
How so? Interfaces are not copyrightable, but that it not the same as dissecting a js bundle and copying the implementations. Are we sure these LLM are keeping sanitary habits there?
I'm not convinced we are actually at the point where something like Photoshop is trivial to rebuild. That involves a lot of manual QA and the expertise in actually knowing how everything should work.
That said, give it 6-12 months and I won't be surprised if they can one-shot "create a future-complete clone of Photoshop, make no mistakes"
Where did you hear that? Because it is 100% untrue and is the opposite of current legal guidance from reputable legal expert
The current fun loophole is to have the LLM decompile the existing code, build unit tests around that, and then have a different LLM model build the code that satisfies those tests.
Either way, you can absolutely get a "clean room" result from an LLM.
My understanding was that re-invention without copying any code is legal. But scraping code from the browser and re-using it is not. I'd love to know how that plays in the courts with LLMs, as their entire model comes from copying code as training material, not writing new code from scratch.
Regular humans train on copying code too (Stack Overflow, etc.) so unless they were trained on that specific codebase, I really doubt you have any sort of legal standing. And given how little compensation the authors got when their work got trained on, I wouldn't hold out hope for a big payout even then...
Sorry GitHub, that's not for you to determine, as you are not a US judge. They should never have replied like this IMO and this behavior opens them up to liability for not properly handling DMCA procedures.
Proper DMCA 512(h) notices (assuming OP's was proper) require the host (github) to remove or disable the content first without even attempting to verify the claims.
Then the repo owner has a chance to challenge the notice. If they choose to do, they're basically required to publicly doxx themselves first, by nature of just going through the motions of the judicial court system.
If there was no challenge after a set period of time, then the content stays down.
If there was a challenge, it stays down until a court decides what happens next.
two sides to the coin, we'll hear about how some evil corporation used their influence to have a legitimate project DMCA'd and HN will have the opposite reaction on that day
something like "jury duty" from the community seems an interesting idea for a middle path, if we want better systems, we'll all need to contribute a little to making it so
What happened here?
But 1201 deals with circumventing copyright protections and AFAIK isn't related to DMCA takedowns, but 512(h) is what I've seen typically used for DMCA notices instead, to get the identity of a poster in order to sue them (since the ISP itself is exempt as a conduit), so that's why I mentioned what's required for it.
Did they actually republish you code or were they just creating wrappers that download/cache the code from your website to run locally?
Photopea creator weighs in on Photosuite project
https://news.ycombinator.com/item?id=49972730
You had commented on the photocraft post prior, so if it's that, then it's a bit muddled. It's a LLM based re-implementation and not a copy of the code made open. So the argument would be weaker there, and you'd really need specific code samples to make a case of copyright infringement. Photocraft not "piracy" as is normally understood, which is the exact same binary, optionally with the license protection removed.
Second, I am sorry this is happening to you.
Third, based on GitHub's reply, specifically
> we're unable to confirm a violation of 17 U.S. Code § 1201
they took your submission as 17 U.S. Code § 1201 takedown notice. Maybe you specifically stated this. Maybe it was implied. This is likely not what you want and GitHub's response is likely correct. The reason for this is that § 1201 prohibits circumventing a technological measure. The JS you host on your public site, even if obfuscated, very likely does not qualify for this protection. Another detail - the reason it took long (a month later according to your post) is that after the youtube-dl fiasco, they committed to manual review, legal and technical, of every 1201 takedown notice [0].
Fourth, if you believe these copies are sufficiently reproducing your copyrighted work, what you likely want to do is file a standard copyright infringement 17 U.S Code § 512(c) takedown notice. This still goes through the same DMCA report flow but it should result in a less stringent review process and a faster response.
Fifth and finally, consider asking your favorite LLM to get more context around these laws. Good luck!
[0] https://github.blog/news-insights/policy-news-and-insights/s...
1201(a)(3): "As used in this subsection-- to 'circumvent a technological measure' means to descramble a scrambled work, to decrypt an encrypted work, or otherwise to avoid, bypass, remove, deactivate, or impair a technological measure, without the authority of the copyright owner"
So you are going to have to prove their code is a copy of yours, not just a copy of the functionality.
In Google vs Oracle, APIs also aren’t necessarily copyright able:
“So long as the specific code used to implement a method is different, anyone is free under the Copyright Act to write his or her own code to carry out exactly the same function or specification of any methods used in the Java API. It does not matter that the declaration or method header lines are identical”
To sum it up; get a lawyer.
Meanwhile AI refuses to touch photos that contain anything that remotely looks like Mickey Mouse.
Shit was never on the Common Folk's side.
This doesn't lend it self to a sensible solution.
There's no way that computer code should have ever had any legal similarity to entertainment properties like Disney characters.
Plus so many people don't want to pay any attention to the way there's a big difference between entertaining software like games versus things which are needed before "machines" will even (barely?) run, or run more superbly which is not the same either.
And there's no way any "rights" should exist for an extended period.
Among other things these need to be corrected more so than ever (or AI will do it for us). The problem is it all needs to be sensibly reversed not gutted in one big shockwave. But AI is here to shock. It doesn't even take superintelligence, if the people who gradually caused the problem over the decades were below-average things would have come out better as long as their objectives well less predatory.
Honestly, I was a hoping that giving attention to this problem here at HN might lead to someone from Github actually noticing my problem and looking into it.
I think I will try solving it with a lawyer. But it would be really cool if I could spend my days writing code instead of dealing with lawyers and stuff.
On reflection, it's a great convenience to leave your cart around. So I think cart pushing is a valuable service to provide, and leaving your cart should be fine if it's stable and not in the way of anything.
That kind of thing is explicitly required under HN rules - if a company requires payment, such submissions are only OK if a “workaround” to avoid paying is available.
Additionally, it's explicitly OK:
* For comments to ask how to get around payment requirements, and
* To help other users to get around payment requirements
Source: Official HN FAQ page
The US allows damages per infringement without need to prove an actual loss, and per infringement.
In my experience GH usually does 512(c) takedowns in days; so it taking a month is quite abnormal. OP’s posted response suggests he didn’t file a copyright takedown but rather an anti-circumvention claim; which is a bit special in DMCA law, and generally best avoided when you have merits to do a regular 512(c).
We also don’t have details of the repo. The author has commented on another project that claims to be a LLM _re-implementation_ of Photopea, without directly using source. If that’s the case, it’s entirely understandable why GitHub won’t take it down.
I spent $18k in legal fees over a $22k claim in a construction dispute. I won the suit and was awarded legal fees. So I'm owed $40k plus interest. I've collected exactly $0. The last lawyer I spoke to said I need to cut my losses in legal fees at some point because from a practical standpoint, winning damages isn't the same as collecting them. Especially if the defendant isn't local and has few assets.
It worked for me! And very quickly.
https://news.ycombinator.com/item?id=49832406
But it is a bit crap that this is the only way you can get Github to behave responsibly.
Good luck.