• chevron_right

      Twitter obtains subpoena forcing GitHub to unmask source-code leaker

      news.movim.eu / ArsTechnica · Wednesday, 29 March, 2023 - 15:24

    Twitter's bird logo is displayed on the the outside of its San Francisco headquarters building.

    Enlarge / Twitter headquarters in San Francisco on February 8, 2023. (credit: Getty Images | Anadolu Agency )

    Twitter has obtained a subpoena compelling GitHub to provide identifying information on a user who posted portions of Twitter's source code.

    Twitter on Friday asked the US District Court for the Northern District of California to issue a subpoena to GitHub . A court clerk signed off on the subpoena yesterday.

    GitHub user "FreeSpeechEnthusiast" posted Twitter source code in early January, shortly after Elon Musk bought Twitter and laid off thousands of workers. Twitter reportedly suspects the code leaker is one of its many ex-employees.

    Read 9 remaining paragraphs | Comments

    • chevron_right

      Twitter source code was leaked on GitHub shortly after Musk’s layoff spree

      news.movim.eu / ArsTechnica · Monday, 27 March, 2023 - 16:01

    Illustration of a person's hand holding a magnifying glass over the Twitter logo.

    Enlarge (credit: Getty Images | Future Publishing)

    Portions of Twitter's source code recently appeared on GitHub, and Twitter is trying to force GitHub to identify the user or users who posted the code.

    GitHub disabled the repository on Friday shortly after Twitter filed a DMCA (Digital Millennium Copyright Act) takedown notice but apparently hasn't provided the information Twitter is seeking. Twitter's DMCA takedown notice asked GitHub to provide the code submitter's "upload/download/access history," contact information, IP addresses, and any session information or "associated logs related to this repo or any forks."

    The GitHub user who posted the Twitter source code has the username "FreeSpeechEnthusiast," possibly a reference to Twitter owner Elon Musk casting himself as a protector of free speech.

    Read 10 remaining paragraphs | Comments

    • chevron_right

      Twitter Hunts Down Github User Who Leaked Company’s Source Code

      news.movim.eu / TorrentFreak · Monday, 27 March, 2023 - 08:26 · 2 minutes

    pirate twitter On February 21, 2023, Twitter chief Elon Musk published a tweet suggesting that Twitter’s algorithm would be “ made open source ” before the end of that month.

    Before he took ownership of Twitter, Musk said that having the code out in the open would be a smart move, but the end of February came and went, without any code appearing in public.

    On March 17, Musk raised the topic once again. “Twitter will open source all code used to recommend tweets on March 31st,” he tweeted . With the clock ticking on that event, someone with apparently similar plans but a more urgent publishing schedule, has taken Twitter by surprise.

    FreeSpeechEnthusiast Presents: PublicSpace

    On March 24, Twitter sent a DMCA takedown notice to GitHub targeting a repo named ‘PublicSpace’. The repo was created by a GitHub user called FreeSpeechEnthusiast, but with no description, nothing stood out as particularly interesting or out of the ordinary.

    Logs obtained by TorrentFreak suggest that the allegedly infringing content appeared on the PublicSpace repo early Friday morning, around 02:25. When GitHub received the initial DMCA notice isn’t clear, but some interaction between Twitter and GitHub appears to have taken place before 10:15.

    At 17:12 Friday afternoon, GitHub removed the repo and the code. Just one minute later, GitHub advised Twitter that the content was gone. That was a pretty swift removal but it appears Twitter was in a real hurry.

    “Proprietary Source Code For Twitter’s Platform”

    While the repo itself appeared without fanfare, Twitter’s DMCA notice is clear on why it should be taken down.

    In response to GitHub’s request to identify the infringed content, Twitter revealed that it was “Proprietary source code for Twitter’s platform and internal tools.”

    Knowing exactly what was made available isn’t straightforward without a live repo, but whatever the contents were, Twitter seems to be taking things very seriously.

    Twitter Files DMCA Subpoena Application

    On the same day the content was uploaded and then removed from GitHub, Julian Moore, Twitter Director and Associate General Counsel, filed an application for a DMCA subpoena at a federal court in California.

    “On March 24, 2023, I submitted on behalf of Twitter a DMCA notification, via GitHub’s online DMCA notification form…identifying the Infringing Content on GitHub’s systems and providing the information required by 17 U.S.C. § 512(c)(3)(A) ,” Moore’s declaration reads.

    “The purpose of Twitter’s DMCA Subpoena is to identify the alleged infringer or infringers who posted Twitter’s source code on systems operated by GitHub without Twitter’s authorization, which postings infringe copyrights held by Twitter.”

    Identifying the Infringer

    Not satisfied with simply taking the repo and content down, Twitter is now trying to identify the person behind the username FreeSpeechEnthusiast on GitHub. As the image below shows, Twitter believes GitHub may have a lot to offer.

    There’s no doubt that GitHub will have all of this information to hand, but whether it will be of use to Twitter remains to be seen.

    Some basic information is easy to determine without any special help from GitHub, including the date when the account was created – January 3, 2023 – and when there was activity on the repo.

    The note from Twitter claims they have no contact information for FreeSpeechEnthusiast but TorrentFreak was able to identify an email address linked to a specialist encrypted provider. Unsurprisingly, FreeSpeechEnthusiast did not respond to our request for comment.

    Twitter’s DMCA subpoena application can be found here ( 1 , 2 , pdf)

    Image credit: geralt/pixabay

    From: TF , for the latest news on copyright battles, piracy and more.

    • chevron_right

      The time has come: GitHub expands 2FA requirement rollout March 13

      news.movim.eu / ArsTechnica · Friday, 10 March, 2023 - 22:36

    A GitHub-made image accompanying all the company's communications about 2FA.

    Enlarge / A GitHub-made image accompanying all the company's communications about 2FA. (credit: GitHub )

    Software development tool GitHub will require more accounts to enable two-factor authentication (2FA) starting on March 13 . That mandate will extend to all user accounts by the end of 2023.

    GitHub announced its plan to roll out a 2FA requirement in a blog post last May. At that time, the company's chief security officer said that it was making the move because GitHub (which is used by millions of software developers around the world across myriad industries) is a vital part of the software supply chain. Said supply chain has been subject to several attacks in recent years and months, and 2FA is a strong defense against social engineering and other particularly common methods of attack.

    When that blog post was written, GitHub revealed that only around 16.5 percent of active GitHub users used 2FA—far lower than you'd expect from technologists who ought to know the value of it.

    Read 7 remaining paragraphs | Comments

    • chevron_right

      How to Automatically Generate Commit Messages for GitHub using aicommits

      TREND OCEANS · Tuesday, 28 February, 2023 - 04:47

    Sometimes you may feel overwhelmed or uninspired to write commit messages for the changes you make in a codebase, but not anymore, thanks to aicommits!

    Read more

    #linux #ubuntu #debian #dev #devops #developers #ai #openai #github

    • chevron_right

      Mojang Targets Repositories of Browser-Based Minecraft Copy ‘Eaglercraft’

      news.movim.eu / TorrentFreak · Friday, 24 February, 2023 - 22:58 · 2 minutes

    eaglercraft Minecraft is, without doubt, one of the most iconic and recognizable videogames of recent times.

    The game was originally created by Markus “Notch” Persson, who also founded Mojang Studios, which continues to develop the software today.

    In the years following its first release in 2011, Minecraft captured a truly massive audience. With more than 238 million copies sold, it’s also the best-selling video game in history, a reign that looks set to continue.

    Minecraft’s success inspired a subset of players to get creative by tinkering with the original game. Homebrew Minecraft mods and hacks that spice up the action are in plentiful supply.

    Mojang is totally fine with this, as long as people don’t charge money or distribute modded copies of the game. Mods can’t use substantial content or code from the original game either, so when the rules get broken, Mojang reserves the right to step in and take action.

    Eaglercraft Crackdown

    This week, the Microsoft-owned game studio did exactly that. Mojang sent a DMCA takedown notice to its sister company GitHub, targeting 92 copyright-infringing repositories. All repositories are reportedly linked to copies of Eaglercraft.

    Eaglercraft is a Minecraft variant playable in a web browser. This can come in handy for people who want to bypass blocking measures, which are common on some networks, schools included. Another main perk is that this Minecraft variant is totally free.

    After seeing enough, Mojang urged GitHub to take the repositories offline, citing trademark and copyright infringements.

    “The Repo and corresponding websites are a remake (decompile) of Minecraft 1.3. Their repo states this and the website running their code clearly shows a 100% reuse of our code and assets,” the game studio writes .

    “This user has presumably decompiled and reverse engineered portions of our code to find how to reuse/repost. Their code goes against our EULA and Terms of Use by modifying and reposting source code and the game.”

    minecraft github takedown

    The takedown request was successful and the repositories were swiftly removed from the developer platform. Instead, visitors will now see a notice pointing them to the DMCA takedown request.

    github dmca

    This isn’t the first time that Mojang has gone after browser-based copies of Minecraft, and Eaglercraft isn’t a new target either. Over the past several months, Mojang has been working hard to take these free copies offline.

    Eaglercraft Developer Gets Creative

    Eaglercraft developer “lax1dude” took down the code from his own website after running into trouble with Mojang. However, he didn’t stop tinkering; on the contrary.

    Lax1dude’s GitHub account currently lists an “ EaglercraftX 1.8 ” repository that provides tools and instructions on how to decompile Minecraft 1.8.

    Mojang may disapprove of this repo, but Lax1dude believes the game company can’t take it offline. The repository doesn’t include any copyrighted code or other infringing content.

    “Attention Mojang/Microsoft employee assigned to stalk me: this repository does not contain your intellectual property. Filing a false DMCA is illegal and immoral,” the developer writes in all caps.

    Whether Mojang agrees is yet to be seen. Simply using Minecraft images and the trademark can already cause trouble, depending on the context, so this dispute might not be completely over just yet.

    At the time of publication, Lax1dude’s EaglercraftX 1.8 repository is still online.

    mojang no stalking

    From: TF , for the latest news on copyright battles, piracy and more.

    • chevron_right

      GitHub: DMCA Repo Shutdowns Up 31% in 2022 But There’s No Need to Panic

      news.movim.eu / TorrentFreak · Monday, 20 February, 2023 - 08:15 · 4 minutes

    github-2 GitHub’s user search page currently reports a healthy 108 million users but that still means a few billion internet users are missing out.

    While notable alternatives exist , GitHub is a goldmine of information, ideas, and free education. That’s before considering the mountain of open source software available for download.

    From those building promising software from scratch to those who just love to tinker, GitHub has something for everyone. But like all sites hosting user-generated content, GitHub regularly finds itself in the middle of third-party copyright disputes in need of a solution.

    Software that may appear problematic at first glance cause almost no problems for Github. Powerful torrent site search tools, indexing software, and automatic content downloaders are rarely an issue. The same can’t be said for dedicated movie and TV show downloading apps advertised precisely for that purpose.

    Other pieces of code exist in contested gray areas, with the 2020 takedown of youtube-dl perhaps the best example. That matter is effectively ongoing, with GitHub making a stand for the future freedoms of developers in the appeal of Yout vs. RIAA .

    Since GitHub publishes all DMCA notices publicly, everyone gets an opportunity to see the law in action, beginning to end.

    GitHub Transparency Report 2022

    In 2022, GitHub received and processed 2,321 valid DMCA notices, an increase of almost 27% over the 1,828 notices reported for 2021 . For reasons we’ll outline later, this shouldn’t be considered a major issue.

    All DMCA notices for 2022 are available for viewing in GitHub’s DMCA repo , covering instances where GitHub took content down or asked users to remove infringing content instead.

    Asking GitHub users to remove or modify content can help to prevent an entire repo from being taken offline – particularly useful when other projects rely on the original repo’s code.

    Processing Erroneous, Abusive, and Other Notices

    Thanks to transparency reporting in general (Google is the largest contributor by volume), abuse of the DMCA takedown system is regularly exposed. Most commonly, fraudulent notices are used to wipe out legitimate content.

    In other instances, DMCA notices may go further than the law allows, contain errors, or even massive blunders. The targets of those notices can object via a DMCA counter notice. If the notice sender does not initiate timely legal action in response to a counter notice, disputed content is reinstated.

    Some notices may present an opportunity to fix problems less formally, and GitHub can sometimes play a role in helping the parties reach an understanding, including by the sender retracting the complaint. Reversals apply when a seemingly valid DMCA notice is processed by GitHub but then invalidated by subsequent information.

    “[W]e received and processed 36 valid counter notices, one reversal, and seven retractions, for a total of 44 notices that resulted in content being restored in 2022. We did not receive notice of any legal action filed related to a DMCA takedown request during this reporting period,” GitHub reports.

    In any event, GitHub seems to work harder at resolving issues than other major platforms, which is a plus in a widely abused takedown system.

    Anti-Circumvention Complaints

    Narrowly-defined exceptions aside, software designed to circumvent technological protection measures, in place to protect underlying copyrighted content, is likely to violate section 1201 of the DMCA . Manufacturing, importing or offering these tools to the public is prohibited so if GitHub receives a complaint, a response is required.

    As the continuing youtube-dl controversy demonstrates, a middle ground exists where rightsholders believe they have a clear anti-circumvention claim but others completely disagree . As a result, GitHub routinely scrutinizes claims made under section 1201.

    When rightsholders file an anti-circumvention complaint with GitHub, the platform seeks additional information before taking action against a repository. Complainants are asked to supply information on the technical measures , explain how they effectively control access to copyrighted material, while showing that the project on GitHub circumvents those measures.

    A unique feature of anti-circumvention notices is the lack of an official counter notice. That may explain why so many rightsholders have used them in place of regular takedown notices over the past several years. GitHub has certainly seen an increase.

    “The proportion of takedown notices that allege circumvention increased significantly in 2022 compared to 2021,” GitHub reports.

    In 2022, 15.7% of all notices sent to GitHub alleged circumvention, compared to just 5% in 2021. In 2020, similar allegations appeared in just 3% of notices.

    Back in 2018, less than 2% of notices carried a circumvention claim. GitHub says it’s conducting an investigation to shine more light on the growing popularity of these notices.

    Content Taken Down Overall

    In 2022, GitHub took down 25,501 projects , including repositories, gists, and GitHub Pages sites. After processing counter notices, retractions, and reversals, 114 projects were subsequently reinstated. The final figure for 2022 was 25,387 projects permanently taken down, a 31% increase over the 19,276 projects reported in 2021. GitHub appears unconcerned.

    “The number 25,387 may sound like a lot of projects, but it’s less than .02% of the more than 200 million repositories on GitHub in 2022,” the Microsoft company notes.

    Receiving no complaints for 99.98% of uploaded content is quite an achievement but for some rightsholders, that’s still not good enough.

    In notices sent to Google, they demand the removal of Github URLs from search results. They fail to achieve that goal 90% of the time showing once again that if content needs to be removed, the only effective method is targeting the source.

    GitHub’s Transparency Report 2022 can be found here

    From: TF , for the latest news on copyright battles, piracy and more.

    • chevron_right

      GitHub and EFF Back YouTube Ripper in Legal Battle With the RIAA

      news.movim.eu / TorrentFreak · Friday, 10 February, 2023 - 17:58 · 5 minutes

    yout logo In 2020, YouTube ripper Yout.com sued the RIAA , asking a Connecticut district court to declare that the site does not violate the DMCA’s anti-circumvention provision.

    The music group had previously used DMCA takedown notices to remove many of Yout’s appearances in Google’s search results. This had a significant impact on revenues, the site argued, adding that it always believed it wasn’t breaking any laws and hoped the court would agree.

    Dismissal and Appeal

    Last October, the Connecticut district court concluded that Yout had failed to show that it doesn’t circumvent YouTube’s technological protection measures. As such, it could be breaking the law.

    Yout operator Johnathan Nader opted to appeal the decision. Nader’s attorneys filed their opening brief last week at the Court of Appeals for the Second Circuit, asking it to reverse the lower court’s decision.

    The YouTube ripper is not the only party calling for a reversal. Yesterday, Microsoft-owned developer platform GitHub submitted an amicus brief that argues for the same. And in a separate filing, the EFF also agrees that the lower court’s decision should be overturned.

    GitHub’s Amicus Brief

    GitHub’s brief starts by pointing out that the company takes no position on the ultimate resolution of this appeal, nor does it side with all of Yout’s arguments. However, it does believe that the lower court’s interpretation of the DMCA is dangerous.

    The district court held that stream rippers can violate the DMCA’s anti-circumvention provision. The court noted that these tools allow people to download video and audio from YouTube, despite the streaming platform’s lack of a download button.

    According to GitHub, this conclusion is premature, dangerous, and places other software types at risk.

    “[T]he district court’s expansive interpretation of the DMCA’s anti-circumvention provision compels GitHub to point out how the court’s rationale needlessly threatens countless other software tools in widespread use,” GitHub writes.

    The developer platform is not new to this issue. The RIAA previously tried to remove the open-source software youtube-dl – upon which Yout.com relies – from its platform. After initially removing it, GitHub later decided to reinstate the project , arguing that it doesn’t violate the DMCA.

    In the present lawsuit, GitHub reiterates that stream-ripping tools should not be outlawed. The fact that YouTube doesn’t have a download button doesn’t mean that tools that enable people to download videos circumvent technological access restrictions.

    “YouTube’s decision not to provide its own ‘download’ button, however, is not a restriction on access to works. It merely affects how users experience them,” GitHub writes.

    If the court order is allowed to stand, GitHub warns that a broad group of developers could be exposed to criminal liability, effectively chilling technological innovation.

    “The district court’s expansive interpretation is particularly alarming because, unlike most copyright provisions, the DMCA imposes criminal penalties. At a minimum, those penalties underscore the importance of rejecting a construction that sweeps in a broad range of widely accepted conduct.”

    Browser Extensions, Screen Readers, Ad-Blockers and More

    YouTube download tools are not the only types of software at risk, according to GitHub. There are many others that affect ‘how users experience’ online websites. These could also be seen as problematic, based on the district court’s expansive interpretation of the DMCA.

    GitHub lists several examples, including browser extensions such as ‘Dark Reader,’ ‘Google Translate,’ and ‘OpenDyslexic’. The same also applies to screen readers, ad blockers, and media player software such as VLC, which plays YouTube videos outside of a web browser.

    These widely accepted tools could put their creators at risk if the DMCA is interpreted too strictly, GitHub warns.

    “On the district court’s erroneous theory, the developers who offer those widely embraced applications could be criminals facing hundreds of thousands of dollars in fines or years in prison.”

    EFF’s Amicus Brief

    The Electronic Frontier Foundation ( EFF ) also submitted an amicus curiae brief yesterday. The digital rights group takes interest in copyright cases, particularly when they get in the way of people’s ability to freely use technology.

    In this instance, EFF points out that stream-rippers such as Yout.com provide a neutral technology with plenty of legal uses. They can be used for infringing purposes, but that’s also true for existing technologies – the printing press, for example.

    “Like every reproduction technology — from the printing press to the smartphone — these programs, colloquially called ‘streamrippers,’ have important lawful uses as well as infringing ones.

    “Video creators, educators, journalists, and human rights organizations all depend on the ability to make copies of user-uploaded videos,” EFF adds.

    In common with GitHub, EFF notes that the absence of a download button on YouTube doesn’t imply that download tools automatically violate the DMCA, especially when there are no effective download restrictions on the platform.

    ‘No Encryption’

    The DMCA’s anti-circumvention provision is aimed at tools that bypass effective technological access restrictions. That doesn’t apply to YouTube’s Javascript-based code, EFF argues.

    “The YouTube website code at issue in this case is different: it was not clearly designed to limit access to videos, or the ability to copy them. YouTube videos arrive at a viewer’s device with no encryption or scrambling. No login, password, key, or other secret knowledge is required to gain access.

    “Tellingly, YouTube does use encryption and a password-controlled login to limit access to subscribers of its separate pay-TV service, YouTube TV,” EFF adds.

    According to EFF, Yout and similar tools provide the same functions as video cassette recorders once did. They allow people to make copies of videos that are posted publicly by their creators.

    In addition, these tools are vital for some reporters and useful to creatives who use them for future work.

    “Journalists and human rights monitoring organizations need to be able to save copies of eyewitness videos documenting notable events, conflicts, and malfeasance. Even copyright holders and their licensees rely on tools like Yout.com to download copies of their own or licensed works.”

    “This Court should reject the unwarranted expansion of Section 1201 liability, and reverse the dismissal of Yout.com’s claims,” EFF concludes.

    The RIAA has yet to respond to Yout’s appeal brief. Considering the importance of the case, it seems likely that they will also receive support from other rightsholders or their representatives.

    A copy of GitHub’s Amicus Curiae brief calling for the reversal of the lower court’s decision in favor of the RIAA is available here (pdf) and EFF’s brief can be found here (pdf)

    From: TF , for the latest news on copyright battles, piracy and more.

    • chevron_right

      Pirate Bay Proxy Defeats Police’s GitHub Takedown with DMCA Counternotice

      news.movim.eu / TorrentFreak · Saturday, 4 February, 2023 - 15:21 · 3 minutes

    pirate bay logo Various courts around the world have come to the conclusion that The Pirate Bay is a copyright-infringing website.

    As a result, Internet providers in dozens of countries are required to block access to the site. This works well, but blocking measures are also quite easy to circumvent.

    Some people may resort to VPN services, for example, or replace the default DNS resolver provided by their ISP with independent alternatives. Dedicated ‘proxy’ sites have also become quite popular.

    These proxies act as a copy of The Pirate Bay, making the site accessible through an alternative domain name. These platforms are thorns in the sides of rightsholders, who fight back by adding proxy site domains to existing blocking orders targeting The Pirate Bay.

    This cat-and-mouse game inspired the development of sites that provide an overview of working Pirate Bay proxy sites. ‘The Proxy Bay’ is just one of many similar examples.

    Police Take proxybay.github.io Offline

    The Proxy Bay has been operating in the ‘proxy information’ niche for many years. Aside from its main domain name, it also uses a proxybay.github.io version, which is linked to the Microsoft-owned developer platform GitHub. This variant has also been available for years, but last month found itself abruptly pulled offline.

    The takedown was requested by City of London Police’s Intellectual Property Crime Unit ( PIPCU ). On behalf of music group BPI, PIPCU sent a takedown request to GitHub, alerting it to the alleged criminal activity taking place on its domain.

    “This site is in breach of UK law, namely Copyright, Design & Patents Act 1988, Offences under the Fraud Act 2006 and Conspiracy to Defraud,” PIPCU wrote.

    “Suspension of the domain(s) is intended to prevent further crime. Where possible we request that domain suspension(s) are made within 48 hours of receipt of this Alert,” the notice added.

    DMCA Counternotice

    GitHub honored the takedown request and proxybay.github.io was redirected to a 404 error. However, The Proxy Bay operator clearly disagreed with this decision and responded with a formal DMCA counternotice .

    “The person claiming DMCA doesn’t understand, that there is no content hosted on proxybay.github.com hence why it is wrong to send a DMCA request for it,” the site owner wrote.

    “There are no content/media of any kind hosted on proxybay.github.com, if there is – again ask mister DMCA robot to provide with exact links of media files which were infringed and I will be glad to remove them from repository.”

    dmca bay

    That ‘mister DMCA robot’ was none other than the UK police didn’t seem to impress The Proxy Bay operator. Since there are no links to copyrighted content, the domain should be reinstated, they argued.

    The legality of these sites can be debated. In the UK, thepirateproxybay.com and similar sites have been added to court-sanctioned blocklists in the past, making this a tricky situation when blended with DMCA notices relevant under United States law.

    GitHub Restores The Proxy Bay

    Despite the sensitivities, the DMCA counternotice was successful and this week GitHub decided to restore the domain and the site. As a result, proxybay.github.io is available once again to the public at large.

    proxy bay back on GitHub

    The reinstatement doesn’t mean that GitHub has taken sides. The DMCA simply dictates that disputed content has to be restored between 10 and 14 business days , unless the rightsholder takes legal action.

    Apparently, no legal action was taken in this case, so the logical response was to reenable the domain name.

    Interestingly, GitHub had an easy out if it wanted to keep The Proxy Bay offline. The counternotice listed the wrong domain name, as it referred to proxybay.github.com instead of proxybay.github.io. This .com domain doesn’t exist, which could render the DMCA takedown protest moot.

    From: TF , for the latest news on copyright battles, piracy and more.