It looks like this is the corresponding PR: https://github.com/github/dmca/pull/8142

if you have the dmca repo on your computer, you can checkout this PR via git fetch upstream pull/8142/head:pr-8142&&git checkout pr-8142

Should work even if they blackhole the pr.

There’s no need to create that pr-8142 branch, which will otherwise hang around indefinitely which is most commonly not what you want:

  git fetch upstream pull/8142/head
  git checkout FETCH_HEAD

Isn't it more like the following?:

  git clone https://github.com/github/dmca.git
  git fetch origin pull/8142/head
  git checkout FETCH_HEAD

Maybe this pull request is being censored/shadowbanned right now. Opening the page takes tens of seconds and returns "Unicorn! This page is taking too long to load. Sorry about that. Please try refreshing and contact us if the problem persists.". However, PR #8142 is indeed listed in the list of open PRs at https://github.com/github/dmca/pulls?q=is%3Aopen+is%3Apr .

Heh, I didn't expect to get much attention for this. I thought it would be funny to push a merge commit between the 2 repo's latest commits. As a result, the git history is accessible from the dmca repo if you know the commit hashes. Since I didn't rebase, all the commit hashes were preserved with signatures. Another fun discovery is that deleting my fork of github/dmca didn't affect the PR like I thought it would, so it seems a mirror of youtube-dl's commits are stuck in the ether until GH deletes my PR and garbage collects the repo.

This is such a great hack. I approved the PR, naturally.

Note that a hack is not a fix.

All of you, write to your representatives about that if you care. In EU when they were going to put some similar laws we all organized and wrote massively to the parliament and they backed down. It is a lot of effort but it works.

And what should we ask for?

There is stuff to complain about with the DMCA, but the core process is reasonable.

Someone claims copyright infringement by a user, and the website takes the content down.

The user claims no copyright infringement, the website restores the content.

The website is immune from liability, the alleged copyright owner can settle things in court with the user if they want to.

The problem is that there is no penalty for fraudulently issuing claims.

You should ask for immunity for tools that could potentially be used to infringe copyright, but that are not actually infringing copyright.

If guns don't kill people, people kill people, then certainly congress can accept that software doesn't pirate copyrighted works, people pirate copyrighted works.

I get the analogy, but guns are typically purposed for lethality.

Software is not typically purposed for piracy.

Maybe "trying to hit someone with your car"? Not sure.

It's a perfect analogy because it is so extreme. The powers that be have already accepted that way of thinking (because guns are not illegal) and it's therefore even less of a stretch to apply the same concept to software tools.

Actually I found the statement "guns don't kill people, people kill people" very oxymoronic.

Sure one might argue that if you have the intent to kill, it's not necessary for one to use a gun, you have alternatives such as grenades, knives, chainsaw or even your bare hand if it's lethal enough. This is how you derive that "the gun is not evil, it's the people who are" statement.

But guns, under the category of firearms (not only guns, what about rocker launchers?), are almost-certainly designated to kill, and what is the top priority of firearm? Aim to be the most efficient killing machine.

So if you use a gun, it's not necessary that you are going to kill people, but it is very likely that you are imposing a threat to do so, regardless of if you're attacking/defending.

Therefore, trying to apply the gun analogy to current state of youtube-dl is an injustice to youtube-dl, as you compared an intrinsically evil entity to another.

There is nothing intrinsically evil about a gun. You might as well say that a knife, pen or any other inanimate object is intrinsically evil. Also, there is nothing intrinsically evil about defending yourself.

There is stuff to complain about with the DMCA, but the core process is reasonable.

it absolutely is not in any way reasonable.

you must take down the content without question and then, after filing a counter-notice wait 10-14 days minimum before it can be restored [1]:

"After a counter notice has been received, a service provider must wait 10-14 days before they can reactivate the claimed infringing content."

frivolous complaints can completely cripple a business with little risk to the supposed claimant.

https://odinlaw.com/what-is-a-dmca-counter-notice/

That is, to be fair, an aspect that could be improved on.

However, how do you do this?

For example, perhaps a large-business exemption where they are required to follow through with legal proceedings if a claimant files a counter-notice (so they can't do the whole claim, counter-claim filed, they don't follow up, like with PopcornTime, usually because the DMCA was bogus).

But then this encourages further litigation, so it discourages people taking the risk to file a counter-claim. But unless they follow through with legal action, nobody can assess if the initial notice was "fraudulent". It's a real thorny problem.

There are many possible solutions, e.g.

- A company that files a fraudulent request loses DMCA rights (that way, it doesn't have to be proven repeatedly, just once)

- Liability for false takedowns w/ punitive damages, criminal liability with actual enforcement for malicious attempts or even negligence. Potentially a deposit requirement once a false claim has been made.

For one I’d like there to be some punishment for repeated abuse of DMCA. GitHub policies state that repeat offenders can get their accounts suspended/deleted. Why can’t repeat offenders (RIAA) get banned from the system at least? Some increasing back off after a rejected claim was posted? Anything that would make it un-economical to just spam the system with notices wherever you like it because there is no downside to it.

I wonder if anyone has written something to find and independently assess the validity of these bulk false DMCA take downs.

Honestly, I'm guessing a ambitious law firm could actually make a good class action suit against these offenders.

Seems like broad, real damages could be justifiably demonstrated.

Reform copyright. It was based on the assumption that taxing copy production is a reasonnable way to fund creation. It was an incredibly good system in the days of the press where making copies requires heavy capital investment.

It is hilariously wrong nowadays when everybody own a copy-making machine in each pocket.

I don't understand what's going on here. Can you explain?

I might not be able to explain well, but from what I understand about how github works, when you fork someone else's repo, github only stores 1 tree but you have your own set of tags / branches. This led to an issue that was probably fixed where if you set a repo to private, anyone who had a clone could guess commit hashes from their fork's remote. Another interesting thing about git is that you can have 2 root commits (the Linux kernel has 4 root commits iirc).

Because of these 2 "features", when I clone dmca and run `git pull some_ytdl_git_mirror master --allow-unrelated-histories`, I end up with a giant source tree that consists of both repos joined by a merge commit. Because no rebasing happened, no history was changed and it can be pushed without force permissions. Now that all the youtube-dl commits are in the same tree as the dmca repo, you can access them regardless of what fork you've cloned via `git fetch origin <hash>`.

I hope that makes sense?

This seems like a security issue, no?

Another fun discovery is that deleting my fork of github/dmca didn't affect the PR like I thought it would

Making the pr will put the branch in the target repo under pull/<number>/head

the commit will forever be referenced

Just curious, why is this possible with an unmerged PR? Just a weird setup on GitHub's end?

It's due to how git works. In order for git tools to compare and otherwise work with two commits, both commits need to be in the same repo.

If "forking" a repo on github really cloned it in their infrastructure, they'd require far more data. So all forks of a github repo point to the same repo, only with different branches.

Note that git clone only clones the actually present branches of the upstream you point it to, but on the backend, all branches of all forks are present.

This isn’t simply because of how Git works. You can configure Git to look in multiple places for repo objects. For whatever reason, the GitHub devs either didn’t know this, or they didn’t want to implement their forking and pull request systems this way.

As someone else mentioned, this may be an intentional design to make it simpler to implement pulling down remote PRs from the destination repo.

You can configure Git to look in multiple places for repo objects.

What do you mean by multiple places for repo objects? Do you mean multiple remotes? The remotes are fully inside your local database if you run commands like git pull or git remote update, they are just not in your checkout. Commands like git show <commit hash> work on commit hashes in those remotes as well, even if it's not in one of your local branches.

Or do you mean configuring git to use multiple .git/objects directories? I haven't heard of that feature, can you give a link?

The feature’s called alternates. You can use it on-the-fly without modifying any repos by using the GIT_ALTERNATE_OBJECT_DIRECTORIES environment variable.

If you want the effect permanently, there’s the .git/objects/info/alternates file. For HTTP remotes, there’s apparently a .git/objects/info/http-alternates file as well (no idea how that works though). I’m assuming these files allow multiple alternates as the environment variable does.

There's a lot of reasons it's possible, but the one that sticks out is that the repo owner needs to be able to modify the commit before the PR is merged. AFAIK, the way that's done is by incorporating the remote repo's commit history into the destination repo underneath a pr-specific branch, which naturally brings all of the commits themselves into the repo's git database.

Follow up question, are these commits or pr-specific branch accessible in target repo's `git` (not GitHub)?

I think it's because GitHub wants to allow repo maintainers to merge in PRs without them having to add separate remotes themselves, ie `git remote add` isn't required to `git merge`.

This basically means that any content can be injected into anyone's GH repo (since PRs can't be turned off), but really only in terms of being able to view it on the GitHub website. To give an example, pull 437 on torvalds/linux[0] hasn't been merged in, but if you go to the commit hash in the browser, suddenly main/init.c has the relevant changes and commit that condense the file into one line[1].

This very well could be abused - imagine framing (or just 'canceling') someone with [insert illegal content here] by PRing their repo with a commit with a forged author[2] then linking people to their repo with the commit tree showing the illegal content.

0: https://github.com/torvalds/linux/pull/437

1: https://github.com/torvalds/linux/blob/2793ae1df012c7c3f13ea...

2: https://stackoverflow.com/a/60900120/3878893

yuck, yet another reason to get people to do commit signing - and enforce it by github not attributing unsigned commits.

Does commit signing really solve this? I believe you can restrict branches to only allow signed commits, but since these commits are not in any branch on that repository it looks like that wouldn't change anything. Correct me if I'm wrong, though.

The end result will be GitHub taking down this repo and possibly blocking PRs. Congratulations on making life difficult for other people.

Congratulations on making life difficult for other people.

Tell that to the RIAA...

It's funny to see the Streisand Effect happen with this one.

US copyright law has teeth for stuff like this.

If the RIAA goes after the OP for statutory damages, he's basically fucked for life. And they love to make examples of people. Did everybody forget Kazaa and Limewire?

Not remotely on the same level.

Kazaa and Limewire were moneymaking companies with fairly undefensible behavior from a legal perspective. This is an individual using a website the way it’s supposed to be used, for documentation purposes. A judge would “expeditiously” send the RIAA packing with a large bill for defendant’s legal fees.

Would closing the PR be enough to remove it, or does it actually have to be deleted? I didn't think PRs could be deleted, only closed.

This is hilarious, well done.

I realized something while :+1:-ing your PR: I was thinking about how digg deleted my account over posting the AACS key, I really couldn't care less if Microsoft deleted my account over it.

Very interesting considering that even just 2 years ago I never would have done this for fear of my account being deleted. All of my work and personal projects are moved to gitlab (the CI/Kubernetes/etc integration are just too good to pass up).

I know a sample size of 1 has an effectively 100% error rate, but, I think Microsoft is losing mindshare with GitHub. Stuff like this doesn't help. I could see a small company like GitLab needing to toe the DMCA line, but, Microsoft has the deep pockets and could have built some major community will here by handling this better. Unfortunate that they didn't.

Anyway, fun hack, I wonder how long it will last, or will they merge it? It must be the most approved PR in GitHub history at this point!

I know a sample size of 1 has an effectively 100% error rate, but, I think Microsoft is losing mindshare with GitHub. Stuff like this doesn't help. I could see a small company like GitLab needing to toe the DMCA line, but, Microsoft has the deep pockets and could have built some major community will here by handling this better. Unfortunate that they didn't.

If MS didn't comply with the DMCA takedown notice, then the RIAA could go to court and get an injunction to force it down. Depending on how spiteful the RIAA and the judge are feeling, the injunction could be worded to take down the entirety of GitHub over a single repository. And the impact of actions like these is to make it more likely that such an expansive injunction is sought or granted.

RIAA taking down all of GitHub would instantly pit them against all of Microsoft, and make every developer who already hates their guts to pick up the pitchforks and march. They won't try doing it.

And as much as RIAA is mostly a slimey pit of lawyers, they would stand no chance again msft's goblin hoard of attorneys.

More attorneys does not convince judges more. The RIAA has some merit, therefore they can preliminary injunction github to remove the repo. If github doesn't comply then they receive sanctions. That's simply how it works.

I doubt they'd fear the PR backlash. They didn't fear it before SOPA, and even when SOPA was defeated, it was largely because the backlash was driven by efforts by sites like Wikipedia, Facebook, and Google advertising counter-SOPA messaging, and that drives far more traffic than sites like GitHub.

Taking down GitHub would instantly make millions of developers at thousands of companies unable to do their work.

I am well aware of that. But RIAA likely doesn't care one iota about that damage. The injunction they'd write would be along the lines of:

"It's necessary that the entirety of GitHub be shut down until this case is decided. As noted here, they have persistently failed to adhere to our DMCA take-down notices, and continue to knowingly host content that circumvents our copyright protection schemes. Furthermore, it is not sufficient to just remove this content, because it has been and will be repeatedly readded, and GitHub has taken no action to remove these extra copies. We are likely to succeed on our merits because <blah>. We are irreparably harmed because <blah>."

That doesn't mean they'd necessarily win on a broad injunction, but they can still push for one (see Apple v Epic for a recent example). And stunts like this one make it more likely that a judge might agree that a broad injunction is necessary instead of a narrow one.

Only for a few days, critically.

GitHub may be the single source of truth, but it’s not the only copy of the data.

Interestingly, my country (Turkey) did ban github (along with google drive, microsoft onedrive etc.) back in 2016. However they reopened it within hours (18 hours to be exact), because systems all over the country were failing. One of the driving reasons was that ATMs stopped working. Appearently they were downloading some updates from github to function.

Stupidity has no limits.

For more info: https://en.m.wikipedia.org/wiki/Censorship_of_GitHub

RIAA taking down all of GitHub would instantly pit them against all of Microsoft

microsoft isn't gonna fight the good fight. There's no reward (to them) for doing so, and there's only a cost. It'd be a stupid business decision.

What is more correct is to lobby legislation changes to copyright. Repeal the DMCA, or change copyright law to such that you cannot abuse it this way. And this lobbying is the civil responsibility of everyone, not just microsoft.

I think Microsoft is losing mindshare with GitHub.

You're not wrong. Sure, the cloudflare browser checks and antibot pages on gitlab are aggravating, but there are a litany of documented reasons people are walking away from Microsofts latest acquisition. maybe the biggest one is the ICE contract they ardently refused to back out of.

https://en.wikipedia.org/wiki/GitHub#Controversies

Its also pretty obvious MS doesnt check any of these DMCA claims, and just rubber stamps the commits with an insulting and sterile "Process DMCA request" commit msg.

gitea and github both host splendidly inside kubernetes or standalone.

Well I've been guessing that github was going to get killed off and rolled into of azure devops at some point.

As for the ICE contract, do you have any idea how much money the U.S. government pays to microsoft, of course they aren't going to back out of a contract. if they did, you can bet an emergency board meeting would be held, and who ever made that call would be axed and the contract reinstated, the JEDI cloud storage contract alone is worth $1 billion a year. not to mentions the 25+ million plus OS lisc. and office 365 contracts, and the GCC contracts.

It's very possible that microsoft as a corporation doesn't even deal with github DMCA until they become a PR issue like this one. Github processed DMCA noticed before they were acquired, and their staff likely still is. Not like that is a hot button issues to convert and integrate in the grand scheme of things.

Just food for thought.

I think you are right, except your first sentence. Azure DevOps will be the one which will be reoriented to GitHub, not the other way around.

Azure Repos and Pipelines are basically duplication in GitHub world. But Azure DevOps issue tracker is superior to GitHubs (or GitLabs but not Jira).

Actually I suppose Skype over lynx is a good example counter to my own point, who knows?

Naming a brand after a concept is an asshole thing to do, sure it puts your product in the search results for anyone googling devops, but it makes looking for anything related to the product painful, so I'm all for another name change.

Microsoft is losing the good will they've worked so hard to rebuild.

Microsoft employees, managers, Satya: do you see what you're doing? I love the direction you've taken over the past five years, but bowing to the RIAA and attempting to disrupt an innocuous tool are horrible decisions. It's a chilling note, and everyone involved in tech can hear it.

Are you telling us Github is not a safe place to develop software anymore? Because I'll believe it and go elsewhere.

Siding with the RIAA and bringing engineers' Github accounts into compliance will tell us who your real customers and allies are.

Don't side with regressive legal trolls that bring zero benefit to the world.

IANAL, but as far as I recall, a site receiving a DMCA notice must immediately remove the stated content. The person who put the content up may then file a counter-notice, which, if uncontested may then be followed by reinstating the content. If contested, the process moves into the courtroom.

Correct. A company cannot not comply with a dmca takedown. When the law was written, the supposed safeguard against copyright holders filing tons of frivolous claims is that a counter claim can be pretty serious. Of course history has shown that this didn't work out as planned.

A company is under no obligation to comply with an invalid notice. Wikipedia ignores invalid DMCA requests all the time.

It is risky though, as the company opens itself up to a lot of liability if its wrong.

That's pretty much it though.

In all honesty, we need a GH alternative hosted outside the US, in any place where absurd laws like DMCA don't exist.

What we really need is a decentralised git forge using something like ActivityPub. We cannot keep relying on companies to host open content for us.

ActivityPub is federated like git is distributed. You can add several remotes from different servers (or peers in case of single user instances hosted at home)

Even though other sites like GitLab exist that GitHub remains a near-monopoly default doesn't bode well for attempting to migrate to a completely decentralized system as default. There are decentralized extensions of git (like git-ssb).

Addenda: Git is also not well suited for a lot of decentralization due to how branches are modeled. Patch-theory based systems like darcs and pijul would need more adoption before code repositories could be decentralized.

What if... you kept github in the loop?

What if you could make a federated/decentralized git that doesn't care whether the git repo is made available by github or my-fancy-federated-git-host?

Yes, like https://forgefed.peers.community/ which is exactly that.

Probably a dumb question, but don't federated services eventually lead to centralization? for example SMTP is federated but most users are on gmail, IRC is decentralized but most users are on freenode server, etc. users tend to choose the services/instances with the most users, which is what makes github currently very valuable.

This is not a DMCA notice; A DMCA notice requires the identification of claimed copyrighted content and this document does no such thing.

The document claims that youtube-dl is illegal for being able to download video and audio from YouTube but not for hosting copyrighted material in the repo or binary distributions. The RIAA is claiming youtube-dl is "circumventing DRM".

They do actually mention 3 specific copyrighted songs used as examples in the tests. Seems to me that was on oversight, and they should have only used open videos as tests in the repo. Similar to how Kodi can't use copyrighted material in app store screenshots or videos.

The tests are testing that youtube-dl can successfully see through three specific varieties of obfuscation as used by those videos. Testing open videos would not work, since Google doesn't obfuscate those in the same way. Uploading special videos with the right configuration wouldn't work, those particular obfuscation methods are only available to specific YouTube partners, not to the youtube-dl authors.

That just proves that Youtube-dl is intended to circumvent copyright protection measures. Those obfuscation measures count as "effective" for the purposes of the DMCA. Trafficking in software to circumvent them is a felony. GitHub and Microsoft could find themselves criminally liable if they do not take it down.

Isn't that evidence for the case though? youtube-dl has code to see through obfuscation methods which are only available to specific YouTube partners. If you're a tool for downloading open, not copyrighted videos, why do you need that?

No, youtube-dl is illegal for including code to decrypt youtube video request signatures, which are scrambled specifically on most music videos, which a german court ruled is an effective technological protection measure.

llegal for including code to decrypt youtube video request signatures

No it's not, in Switzerland for example it's legal to use tools to remove stuff like DRM, if you DONT redistribute the decrypted stuff.

What a German Court says is often not relevant outside germany.

Here's a video of a copyright lawyer agreeing with GP for 1h20min: https://youtu.be/wZITscblMBA

In short, what a german court says will absolutely influence what a US court says in the context of an international copyright treaty.

Switzerland, as well as almost every western country that ratified the relevant WIPO treaties, has broadly similar laws to the DMCA: https://www.admin.ch/opc/en/classified-compilation/19920251/...

It is.

The DMCA makes circumventing "effective" protection measures illegal. "Effective" is a term defined in law and basically means any hoop you have to jump through to get to copyrighted material, no matter how flawed or trivially bypassed. The restrictions in place to allow YouTube videos to be only downloaded through YouTube count.

Youtube-dl is absolutely illegal software.

Youtube-dl is absolutely illegal software.

Not in Italy

What US law says is often irrelevant outside of the US of A

No, the restrictions around circumventing an effective technological protection measures are implemented in Italian law too [1] and more broadly are required to be implemented in every EU member state as a result of EU Directive 2001/29/EC [2]

[1] https://www.wipo.int/edocs/lexdocs/laws/en/it/it211en.pdf

[2] https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A...

Regardless, not honoring a DMCA would mean GitHub is asserting that they think it's false and would need to defend their decision if RIAA were to sue them; it doesn't make sense to verify every single DMCA claim and increase liability by not honoring some.

DMCA covers "circumvention devices".

False in this case.

The 17 USC (2)(c)(1)(C) safe-harbour protections apply only to hosting of infringing works, and neither youtube-dl nor its test suites infringe on any RIAA or member copyrights as averred in RIAA's notice.

https://www.law.cornell.edu/uscode/text/17/512

The RIAA's letter does not claim infringement within the text of youtube-dl source or test suites, though it tries hard to appear so, but rather anti-circumvention of a "copyright protection mechanism", under §1201. That is also part of the DMCA, but falls outside the safe-harbour.

At best, youtube-dl's test suite may be infringing works when run, in which case infringement would accrue to the operator, presumably a tester or Github's CI/CD process. Even that argument is specious.

Given output is discarded, no permanent copy is retained, and the action is for research and development, and numerous Fair Use affirmative defence claims exist under §107, notably (1) and (4), test suite execution falls outside exclusive rights. Any one fair-use test is sufficient, or none at all. Test suite execution could be argued non-infinging under numerous theories, including reverse engineering, research, interoperability, all under §1201, or under general limitations on exclusive rights in §112, §117, or elsewhere.

This is where ... things get interesting....

- The "copyright protection scheme" in question, if it even is one, was written by and is provided by Google/Youtube, not the RIAA.

- It is not even clear to me the RIAA has standing to sue under §1203: "Any person injured by a violation of section 1201 or 1202 may bring a civil action in an appropriate United States district court for such violation." RIAA are not injured due to utilisation of a non-member's mechanism.

- Does not pass the 17 USC 1201 (a)(2)(B) test: "has only limited commercially significant purpose or use other than to circumvent a technological measure that effectively controls access to a work protected under this title".

- Yes, Microsoft / Github may have liability under 17 USC 1201 (a)(2), "offer to the public, provide, or otherwise traffic" the code, subject to the same test above. However there is no safe-harbour provision for such violations.

- Microsoft (owner of Github) is listed on the RIAA's members page. Neither Google LLC, its Youtube subsidiary, nor parent Alphabet Inc. are. The RIAA are threatening a member for a §1201 violation against a nonmember. That's ... weird. https://www.riaa.com/about-riaa/riaa-members/

- There's an exception in §1201(f)(2) "a person may develop and employ technological means to circumvent a technological measure, or to circumvent protection afforded by a technological measure, in order to enable the identification and analysis under paragraph (1), or for the purpose of enabling interoperability of an independently created computer program with other programs".

- Youtube-dl is executing code as a World Wide Web user agent, provided by Google/YouTube, and meant to be accessed and run by user agents in order to access YouTube content. That is, youtube-dl's operation is entirely within YouTube's technical design and intent.

- Any potential copyright infringement which might occur through use of youtube-dl is at the volition of users, not the software's authors, actions would properly be directed at such users for individual acts of infringement, and much of this is subject to the same and other defences listed above.

The remaining question is whether or not this claim should be contested. I argue that it should, on numerous grounds;

1. Though the claim is made under US law, similar anti-circ provisions exist in international law, which is highly standardised in large part thanks to the RIAA, MPAA (video), SIIA (software), WIPO, and other copyright monopoly cartels' special-interest deep-pockets lobbying. Offshore legal safe havens are limited and vulnerable. Defence within DMCA /anti-circ / WIPO / Berne regions is unfortunately necessary. Simply hosting the repository outside US jurisdiction is not sufficient, though a valid immediate response.

2. Such claims are specious at best, carry heavy chilling efects, may be entirely fraudulent, and should carry considerable risk. A countersuit agaist RIAA may help make this cartel, or others, think twice about repeating such attempts, as well as establish precedent agaist future such attemps.

3. The future of software, to which Microsoft claims to have harnessed its own wagon, is open, collaborative, Free Software. As such, the software and information services industry's interests diverge from those of regressive copyright maximalists.

TL;DR: This is not a 17 USC 512 infringement/safe-harbour, RIAA's standing is highly questionable, it is threatening a member for an averred nonmember's §1201 injury, any actual works duplication is not performed by youtube-dl's developers directly, nor is the work itself or its test suite an infringement of RIAA / members copyrights, and numerous defences exist for routine use or incidental transmission or copies made by others. Further, youtube-dl, digital and information liberties groups, Microsoft, and Google/Youtube should fight the RIAA's claim.

Haha! This is absurd:

Microsoft (owner of Github) is listed on the RIAA's members page. Neither Google LLC, its Youtube subsidiary, nor parent Alphabet Inc. are. The RIAA are threatening a member for a §1201 violation against a nonmember. That's ... weird. https://www.riaa.com/about-riaa/riaa-members/

Youtube-dl is executing code as a World Wide Web user agent, provided by Google/YouTube [...]

I'm guessing that's a typo, and this was actually meant to say the following?

Youtube-dl is executing code as a World Wide Web user agent, accessing a service provided by Google/YouTube [...]

No, the code is provided for the purpose enabled by ytdl.

I'll try to clarify that elsewhere:

Youtube-dl is executing code provided by Google/YouTube, for Wold Wide Web user agents, as a World Wide Web user agent, and meant to be accessed _and run_ by user agents in order to access YouTube content. That is, youtube-dl's operation is entirely within YouTube's technical design and intent.

Wait, but it doesn't execute analytics or run ads.

GitHub is not a safe place to develop software that has an association with piracy, nor would any centralized service.

Yeah, there's a difference between Microsoft saying "We love open source now" and Microsoft saying "fuck the police, IP law needs to be rebuilt from the ground up anyway".

The idea that Microsoft should lose some of the goodwill it got doing the first for not doing the second is really naive.

What piracy are talking about?

I think there's more nuance to this. on one hand, they loose individual developer mind-share, but I'm sure that big corporation executives and governments are loving this kind of stuff...

Why github/dmca? Why not e.g. tensorflow or numpy or some other package that people actually depend on?

I hope they did counter claim? RIAA should get a strong kick for this.

The history of that github repo shows that counterclaims would be listed in that particular repo, along with the original DMCA request. There is no PR for a counterclaim for youtube-dl as of this comment.

That's not good then. There were some concerns before that the project wasn't active anymore, so I hope it's not a sign of maintainers deciding to pull the plug.

The claim was filed on Friday. It's been less than 48 hours, almost none of it during business hours. Filing a counterclaim is literally saying "see you in court," and given both that RIAA is known for being litigious and that youtube-dl's defense here is (to my reading of the law) merely decent and not slam-dunk, I would not want to take that step without seeking the advice of a lawyer first.

So even if a counterclaim were to be filed, I would not expect it to have been filed yet.

Edit: the most recent counterclaim I see filed was done on 2020-10-08 (https://github.com/github/dmca/blob/5dfed34cdb3774fcb10cb294...)... for a claim filed on 2020-09-16 (https://github.com/github/dmca/blob/951b7ba132fd6bafab2401a7...). That's almost a month later.

RIAA should get a strong kick for this.

Regardless of this particular case, the world would've been a saner place if copyright holders were held liable for erroneous claims.

Is it legal to file a DMCA claim when the motivation is retaliation? (Assuming that the person filing retaliatory DMCA claim can satisfy the good-faith requirement, that is.)

The RIAA will have to create a takedown notice to takedown their takedown notice, invalidating the former takedown notice?

No, issuing a DMCA claim does not invalidate former claims. The system always works the way a rational human would expect.

"The system always works the way a rational human would expect."

We all wish, we all wish.

Cloned locally, was sad when the original repo was taken down.

Some things actually get worst when you try to prevent people from doing them, hopefully some people realize this.

Can someone remind me which music videos they did not want people to download please?

09 F9...

Out of curiosity, If I were running my own git server can I delete a PR completely?

git clone https://github.com/github/dmca.git .

git fetch origin 416da574ec

git branch youtube-dl 416da574ec

git checkout -f youtube-dl

Didn't work for me with the shorter commit hash, but it worked with the full hash 416da574ec0df3388f652e44f7fe71b1e3a4701f.

I think the long term solution for this problem is the developers of open source software like the bit torrent client, youtube-dl and other similar software will have to host their code outside of the reach of DMCA regualation. That will usually mean something like Github like site hosted in Russia, China or some other bloc where DMCA does not apply.

Right now, lots of users in the US scientific community use Scihub or how millions of US students use libgen, millions of users of open source software will have to get used to a non US controlled domain to get access to their software. Also development of these software will be done in the shadows so as to avoid the reach of the DMCA.

I think the long term solution for this problem is the developers of open source software like the bit torrent client, youtube-dl and other similar software will have to host their code outside of the reach of DMCA regualation

I'm not sure about that. I think the real long term solution is to have a decentralized version of YouTube/video publishing platform that is resistant (invulnerable?) to censorship. I'm not saying that it's not difficult, or even impossible, but I would love to see more discussion regarding true web decentralization, not legal semantics.

Zeronet [0] has implemented a decentralized website model, a Github alternative on there could be more resilient, though it does require additional client software to run. I believe the site owner can update their decentralized website with their cryptographic keys.

Perhaps WebTorrent [1] can be the basis for an in-browser implementation, along with service workers to stay cached and self-update without requiring a running host. Talk about serverless :^)

[0] https://zeronet.io/ [1] https://webtorrent.io/

Relying on other countries can't ever be a long term solution.

That pirate bay and scihub are still around, that their authors are walking around freely, is a miracle that should not be taken for granted.

We need to work on fixing these problems in our own countries. We need to talk about the freedoms we care about, put a good brand to those freedoms and win popular attention and enshrine those freedoms into law. And build a society that depends on those freedoms so much that rolling them back would be unthinkable.

That would be an actual long term solution. It is hard but if we all contribute, we can do it. Probably.

I agree in principle, but a much easier fix would be to host such code on a tor hidden service. That way the physical server can be located more or less wherever.

Then we just have to normalize the use of Tor so that banning it becomes unthinkable ...

In other words, instead of trying to change the laws, which is the whole idea of a democracy, just give up on laws altogether.

That pirate bay and scihub are still around, that their authors are walking around freely

Let's not equate these sites. scihub gives people what they are likely already paid for. Academic publishing business is a fraud. https://www.youtube.com/watch?v=PriwCi6SzLo (recent video on the topic that I liked)

scihub gives people what they are likely already paid for

No, as long as the researcher was not bound by the grant to publish in the open and published in a journal/conference with a copyright, you do not have the legal right to get it, even if taxpayers funded the research.

It’s fucked that the law doesn’t stipulate open publications for taxpayer funded research, but that’s an issue with the law. Academic publishing isn’t a “fraud” in the normal definition.

You're countering what I perceive to be moral argument with a legal one, which would be a category error.

"Peter Sunde, Fredrik Neij, Gottfrid Svartholm and Carl Lundström were all found guilty and sentenced to serve one year in prison and pay a fine of 30 million SEK". I wouldn't call it walk freely.

Yeah, Sweden doesn’t allow for zeroing debts due to legal judgements in personal bankruptcy, IIRC.

This means that they were effectively sentenced to lifelong debt slavery. This is another dark part of the Scandinavian model that most aren’t aware of. Same system in Norway.

I know a friend of one of those 4 mentioned and he is doing absolutely fine (money-wise at least)

Hosting the git repository on ipfs might be a solution.

outside of the reach of DMCA regualation.

What's the latency to the Moon again? :)

2.5s is the minimum roundtrip. Add server and satellite hops and you get something closer to 3s minimum. Every time.

Thanks. Sounds like it'd be workable as a backup target then, but would probably suck being the primary place to grab source code.

That being said, maybe it would be ok as a primary location if there are more localised caches (eg lower response times) commonly available.

It's git - what do you need low-latency for? Download directories, trees, as the initial requests, then send a second request for the source code you want to download. Then the bottleneck is download speed instead of latency.

For just git, sure.

For a web application to present it (eg Gitea, GitLab, etc), then the lower latency would be helpful. ;)

Not a problem for Git or even PR workflow then.

It would not be an issue even in the Earth-Mars case, where the roundtrip latency is 20m-1h15m depending on the time.

... is now part of ...

Can someone please explain what that means? Is the code not accessible anymore? Is it frozen? No commits allowed? What exactly are the implications here?

It's just someone creating a pull request to the dmca repository with the pull request containing the entirety of the youtube-dl repository (and its history). It's mostly a joke

It's a fun hack, but to those thinking about streisanding the source: The strength of ytdl and other downloaders isn't their source code, it's the extensive library of scrapers that are tailor-made for individual sites.

The devs have to constantly maintain and update those to keep working when a site changes its design.

So if the takedown manages to stop ongoing development on ytdl then even existing copies will become mostly useless pretty quickly.

Would it not be possible to move to some decentralized Github alternative?

The problem is finding a good alternative and getting everybody to move there.

“Everybody” is surely not a massive amount of people for youtube-dl. I mean, it’s hardly the Linux kernel... let’s remember that this is just about developers, distribution is a separate (arguably easier to solve) problem.

You can’t decentralise issues and pull-requests.

Edited: as pointed-out, Fossil supports decentralized issues (but not PRs). However, Fossil is a totally different system than Git.

It's amazing that no one has thought to do this yet considering the checkered history of GitHub's compliance with DMCA takedowns.

You mean something like... got? ;)

But I agree with the sibling posts, while decentralised change tracking is pretty much the original idea of git, all the project management stuff (issues, comments, membership/permissions, discoverability) are a lot harder to decentralize.

I also don't think the MPAA or whoever else would be very impressed by that if the end result is still illegal activity: If the developers are known, then they'd either have to pass on the project to someone else or risk liability, whether their project repo is centralised or not.

Just host a gitlab instance through TOR or something, bish bash bosh

GitLab through tor sounds slow...... (Six dots for six hops)

Tor uses 3 middle nodes, so it's only 6 hops if you count the round trip.

It's the latency that kills you, not sheer bandwidth - I can watch YouTube on Tor on a good day when Google doesn't block my exit.

More people should try Tor. It's easier than you think.

The change is gone now, I literally watched it disappear. I really hope that youtube-dl can bounce back from this. I mean what's next, Kodi? NewPipe?

The internet is all fluffed up about the RIAA, people are calling things cancer, and calling things "retarded" in public comments. Don't forget the constant "well they should take down browsers, and Windows, and networking code!" retorts

It's like we've gone back to the mid '00s. With that vibe, https://youtu.be/SnLB8wysMbY

So if I understand this correctly it’s possible for anyone to make someone else liable for copyright or patent violations by creating a PR on their repo then arranging for them to get sued?

perthchat dot org has an interview with an old maintainer about the removal from github.

What bothers me about DMCA the most is the lack of due process. In the US, one would think more than any place else you have the right to a lengthy trial before have a right stripped away.

Both political parties in the USA regularly chip away at our rights in the ever on going battle to capture more votes from extreme positions or 'bring the usa in line with international (read european) standards', in this case WIPO.

How this Christmas gift was ever given to the RIAA is mind blowing.

I still don't get this, though. Why DMCA-ed the entire project?

Isn't simply removing the offending parts on code sufficient?

Copyright is an attack on property rights...

Suddenly, what other people might have done similarly, restricts what you can do with your rightfully owned property.

Can someone explain why government -granted monopolies on human cultural output is a good idea?

I think is valid as long as it protects the right of people creating (now) digital goods, to be payed for if they created that value.

But i think the law is to harsh and actually can even destroy that piece from existing for being too severe over the copies of that work.

For movies or music for instance, something like 3 year period of copyright ownership would be fine.

People would still pay for first access to the piece, while it would be much more likely to find a copy after lets say, 100 years somewhere.

For movies or music for instance, something like 3 year period of copyright ownership would be fine.

Great line of thinking. But I think the idea of earning income from a creative work throughout one's life also has value.

A compromise is to retain the existing copyright periods (after which works go to the public domain),but after 5-10 years of creation, works would become free for non commercial distribution. So Netflix would still have to pay for movies in their catalog. But me torrenting it from people freely sharing it and playing it on VLC would be legal.

https://github.com/github/dmca/pull/8142

now shows a "Unicorn! The page is taking too much to load" - anyone else see this?