GitHub Source Code Leak
resynth1943.net
resynth1943.net
GitHub hasn't been hacked. We accidentally shipped an un-stripped/obfuscated tarball of our GitHub Enterprise Server source code to some customers a couple of months ago. It shares code with github.com. As others have pointed out, much of GitHub is written in Ruby.
Git makes it trivial to impersonate unsigned commits, so we recommend people sign their commits and look for the 'verified' label on GitHub to ensure that things are as they appear to be.
As for repo impersonation – stay tuned, we are going to make it much more obvious when you're viewing an orphaned commit.
In summary: everything is fine, situation normal, the lark is on the wing, the snail is on the thorn, and all's right with the world.
Some people think RIAA’s DMCA notice is not legally valid, arguing RIAA is not the copyright holder and there is no infringing material. DMCA takedowns are for taking down works you own the copyright to; not for enforcing any arbitrary aspect of legislation.
It’s my understanding that service providers do not need to comply with illegal requests.
For example, if I DMCA’d <an oil producer>’s repository on accused violations of environmental protection acts, I don’t think it would be taken down, would it?
If GitHub was an independent company advocating for open source; would it have acted any different?
Note: Microsoft is a member of the RIAA.
Apple made waves and built lots of favour for resisting the FBI and challenging quasi-legal processes. They took risks and demonstrated their principles (Suing the FBI over a terrorist’s iPhone is unlikely to be the first recommendation from their legal counsel).
This smells like a qausi-legal process, and it would look great for GitHub/Microsoft if you do.
It's really, really, really stupid, because it presumes guilt before innocence, standing in opposition to most general legal principles.
If anything, Microsoft via Github would do well to assert itself by not conforming, forcing the court to examine the DMCA's legality and process.
So shouldn't the next US-American recipient of one of these notices refuse to comply on the grounds that the law is unconstitutional?
The U.S. Court of Appeals for the Fourth Circuit in 2006 begins a discussion of possession with:
"That possession is nine-tenths of the law is a truism hardly bearing repetition. Statements to this effect have existed almost as long as the common law itself."
Willcox v. Stroup, 467 F.3d 409, 412 (4th Cir. 2006).
It doesn’t mean whoever possesses something is automatically the owner. It means that absent evidence of superior title, possession generally suffices to show ownership.
ETA: And yes, if you submitted a DMCA takedown which has any reasonable chance (from the recipient/provider's perspective) of being valid, it would get taken down. Otherwise, the provider takes on their customer's liability. Very few (and zero free) providers are willing to do so.
> DMCA takedowns do not need to be from the copyright holder themselves. They can be from ANY authorized agent of the copyright holder
I think it's clear that "RIAA is not the copyright holder" is shorthand for "no member of the RIAA is the copyright holder". Even if you don't accept that, you can easily deduce that no member of the RIAA is the copyright holder by looking at the immediately following claim, "there is no infringing material".
Given that there is no infringing material, it can't really matter whose agent the RIAA purports to be.
The EFF has a write-up about it [1].
[1] https://www.eff.org/deeplinks/2020/11/github-youtube-dl-take...
OTOH, your comment violates a number of HN rules and probably should be deleted for dang kills your account for a few days.
I'm sometimes baffled that people miss that point when it comes to internet security. The biggest real difference is the global nature of the internet and thus problems with jurisdiction, which obviously doesn't apply if both sides reside in the same jurisdiction.
There are other examples in the real world tho, where the distribution/creation of the tool is already illegal (e.g. certain weapons or explosives), because only reacting after damage is done is infeasible.
If fair use tells us that it's ok to use parts of copyrighted works for certain purposes, then there must be a legal avenue for obtaining those parts.
There is massive legitimate use for downloading videos, yet the alleged harm is purely monetary.
Clearly what is most important is the intent. In this case, it is very clearly RIAA's intent to make the aforementioned videos obtainable publicly via the use of HTTP agents. Browsers are HTTP agents. youtube-dl is an HTTP agent. Either they are all infringing or they are all not infringing.
On the other hand, it is clearly the intent of my door and lock to keep people out.
https://github.com/github/dmca/blob/master/2020/10/2020-10-2... says:
> The clear purpose of this source code is to ... reproduce and distribute music videos and sound recordings owned by our member companies without authorization for such use. ... We also note that the source code prominently includes as sample uses of the source code the downloading of copies of our members’ copyrighted sound recordings and music videos, as noted in Exhibit A hereto. For example, as shown on Exhibit A, the source code expressly suggests its use to copy and/or distribute the following copyrighted works owned by our member companies: • Icona Pop – I Love It (feat. Charli XCX) [Official Video], owned by Warner Music Group • Justin Timberlake – Tunnel Vision (Explicit), owned by Sony Music Group • Taylor Swift – Shake it Off, owned/exclusively licensed by Universal Music Group
https://www.eff.org/deeplinks/2020/11/github-youtube-dl-take...
What we call DMCA takedowns, coloquially, with the whole counter notification process etc, are notices submitted under Title II. That title deals with copyright infringement, not anti-circumvention.
That means treating such notices as a typical DMCA notice, as GitHub has done, is incorrect. GitHub may well choose to follow the takedown if it considers it valid and the repo infringing, but what they've done is treat it as a copyright takedown. And that is clearly, unambiguously wrong, as it goes against their own DMCA policy, linked from the youtube-dl repo's disabled notice, which says:
> The DMCA notice and takedown process should be used only for complaints about copyright infringement. Notices sent through our DMCA process must identify copyrighted work or works that are allegedly being infringed.
So yes, GitHub messed up here. That doesn't mean they shouldn't have taken down youtube-dl, but they way they went about doing it is wrong.
You'll notice that the EFF, in that article, never goes into the details of the takedown process that happened. They never said what GitHub did was proper. They are just talking about the anti-circumvention law in general.
On the other hand, if they DO comply with it, the RIAA is extremely unlikely to sue them, whether this is covered by the safe-harbor provisions of Title II or not.
"That's some nice software you got there... be a shame if something were to... happen... to it. So, you better keep paying us for our locked-down content, and don't even think about trying to pick those locks. Or else."
> they'd be in for a costly legal battle.
https://www.eff.org/deeplinks/2020/11/github-youtube-dl-take...
In fact, in the US, that is the _only_ way for a citizen to challenge a law. One cannot challenge a law that they have not been charged with breaking in the United States.
The Title II provisions are irrelevant, as they do not cover circumvention devices. The RIAA could sue them regardless of whether they comply or not.
Did you even read the comment you replied to?
Anyone can sue anyone for any reason.
Therefore there is only risk and no benefit for a service provider not to comply with any notices they might receive.
Almost all of the lawyers at HN, and the lawyers at the EFF, and the guy at Popehat, are all generally in agreement that there was nothing wrong with what the RIAA or what GitHub did. It should tell you something when the people most in a position to evaluate the situation don't see anything amiss.
If you object to people following the law because you feel they don't hold the same views on the matter at hand, the point is moot, unless of course you feel they should break the law.
Which leads back to, if you don't like a law then lobby for it to be changed.
Signed: CEO's of the US.
I've changed the laws in two countries through my lobbying efforts, though saying which two countries (and which laws) would be too identifying given that this is my quasi-anonymous account.
But on that note, businesses change laws through lobbying all the time. That is indeed one of the complaints about our current system of government: that it is too susceptible to lobbying.
Of course laws change in response to business interests. The context of this discussion is changing laws like the DMCA, though, which protect capital interests.
https://www.eff.org/deeplinks/2020/11/github-youtube-dl-take...
* RIAA was legally welcome to send a DMCA letter which didn't conform to DMCA requirements. Anyone can legally send a legal demand letter saying more-or-less anything, and plenty people do.
* Since this letter didn't conform to DMCA requirements, github wasn't required to take down youtube-dl, but was well within its right to do so.
* github wasn't required to take down other instances of youtube-dl, not referenced in the letter, and ban users, but github can probably fire customers without cause, so there was nothing illegal.
... and so on.
RIAA may or may not have a legal leg to stand on with the DMCA anti-circumvention stuff, depending on what exactly Google does, and I haven't dove into the system in enough detail to know. I don't think Youtube implements DRM, but perhaps it does and perhaps youtube-dl circumvents it. That should be between youtube-dl and RIAA, nor between RIAA and github.
My own opinion is RIAA can't have it both ways. If they don't want people to copy, they should use tools designed for that: iTunes, Amazon Music, etc. If they want to use viral networks used for sharing personal videos, they should respect that those networks are designed for, well, sharing. If my mom uploads a video of my son playing with her to Youtube, yes, family members might want to download that if she's okay with it.
The friction here is that centralized media, whom decentralized is disrupting, wants to now use decentralized media (and by "decentralized," I'm talking from a social perspective -- anyone can publish versus a few people can publish -- not a technology one).
What the EFF actually said: https://twitter.com/EFF/status/1319787243184123904
OP lied. The EFF never said this. I can't find Ken White ("the guy at Popehat") saying anything similar either, but perhaps someone will post a link. And I don't know what "lawyers at HN" he's referring to either.
This is how things work; it may not be how you'd like things to work, but I doubt you've ever been involved in any part of a DMCA takedown request (as the sender, receiver, or the person that had their stuff taken down).
That doesn't make the notice facially invalid, if they have made the required representations (which they have, as they have alleged specific infringement of their works on a contributory infringement theory as well as alleging that the works in question violated DMCA anticircumvention provisions, and particularly alleging that the combination of the anticircumvention violation plus the specific identification of works of RIAA-represented owners as targets was the basis for the contributory infringement claim.)
Unless Github wants to expose itself to both upfront costs and potential liability by judging the details of the legal theories and fact claims in facially-valid DMCA takedown notices, it makes sense for them to react to facially-valid notices and wait for a facially-valid counter-notice before restoring user content.
tl;dr there probably isn't anything inherently wrong with the RIAA's claim, and there's definitely nothing wrong with github's response.
As for DMCAing an oil producer's repository for something unrelated to DMCA, github would still take it down, but it's quite likely that you'd end up with a lawsuit from the oil company for damages. As long as GitHub is run by a US company, it doesn't matter how advocating they are of open source, nothing would change...they'd still take down the repository after receiving a DMCA takedown request.
And the last point, my understanding is apple wasn't actually required to assist the FBI, but american companies are required to follow DMCA.
It seems to me that this could be used to cause a lot of damage – target a popular open source project with a totally bogus DMCA notice, even if they instantly file a counternotice they still get made unavailable for 10+ days.
(Also, why 10-14 days? Why not just 10 days or just 14 days?)
That's how section 512 works. The RIAA letter referenced section 1201, not 512. There is no copyright infringing material to identify. The letter relates to distribution of copyright protection circumvention technology.
Maybe Github needs a new page explaining section 1201 takedowns.
https://cdn.loc.gov/copyright/1201/1201_background_slides.pd...
Does the DMCA actually define these, or is the entire concept of a "section 1201 takedown" a courtesy GitHub is extending to rightsholders, but not legally required to provide? I am only familiar with the DMCA outlining a takedown process for copyrighted content.
An MP3 patent, such as 6,009,399, covers methods and apparatuses for encoding a digitised audio signal. Writing source code that uses a claimed method is arguably not infringment but as soon as anyone besides the patent owner or her licensees compiles the source code and tests the binary, then there is a much stronger argument that infringment has occurred.
Let's pretend for the moment that the original youtube-dl DMCA had been valid, or that you removed youtube-dl due to an innocuous mistake. If I post youtube-dl to MY account, you have NO reason to take it down until you receive another takedown request from the RIAA for my repo. You certainly have no reason to ban users. There is nothing in your ToS which this violates.
I work on education projects which use youtube-dl in legal, non-infringing ways. I don't think the RIAA has a legal leg to stand on for reasons I'm not going to get to in this post.
Until github starts following DMCA processes properly, I CANNOT respond to the existing takedown request, since I have no standing. It's not my repo.
The right course of action for me would be to:
(1) Consult my lawyer and figure out if this is a fight I want to pick. I'm pretty sure I'd win in court if this went all the way, but I might go bankrupt first.
(2) Post youtube-dl to my repo.
(3) Wait for a DMCA takedown notice.
(4) Respond to it with a counternotice, and litigate with the RIAA.
Because github has decided to act as an arbiter on behalf of the RIAA, rather than a neutral third party, I cannot follow this process. github short-circuits this process at #2 by threatening to remove the repo and ban my account.
I'm sorry that you've chosen to side with the RIAA against the Internet. I'm gradually moving my business to gitlab. This is approximately what people thought would happen as a result of the Microsoft purchase.
In the same way, it seems GitHub is preemptively telling people that if they re-post youtube-dl on GH, they'll be banned, even though GH has no legal responsibility to do so. It's really sad that they're siding with big business in all this, rather than their users, without whom they'd be nothing.
GitHub seems to be acting without a backbone. They’re owned by Microsoft, and can definitely stand up to legal challenges like this. Look at BitTorrent: The protocol and it’s code are legal despite being used for piracy. I don’t see why GitHub caves to every request to take down code that is clearly not violating any copyrighted material.
Also, the code itself does not break any copy protection and even if it did.. the code itself needs a user to execute it. Isn’t this how LAME was able to exist without violating mp3 patent laws?
You need to re-read the Github TOS, because this is absolutely covered by it already (see Section F of their TOS).
You potentially also lose your safe harbor restrictions in the process.
That is false. They could lose their safe harbor if they did not respond to a presumptively valid DMCA notice.
Until github starts following DMCA processes properly, I CANNOT respond to the existing takedown request, since I have no standing. It's not my repo.
Pretty sure that the Legal Dept at Github knows more about the DMCA process than a random non-lawyer on HN. It's something they deal with on a regular basis.
Because github has decided to act as an arbiter on behalf of the RIAA, rather than a neutral third party, I cannot follow this process. github short-circuits this process at #2 by threatening to remove the repo and ban my account.
This is false.
Because github has decided to act as an arbiter on behalf of the RIAA, rather than a neutral third party, I cannot follow this process. github short-circuits this process at #2 by threatening to remove the repo and ban my account.
That is probably for the best. Customers with unrealistic expectations are not worth the effort to keep.
Section F says they can take down RIAA's account, not mine. Here is the section in full: "If you believe that content on our website violates your copyright, please contact us in accordance with our Digital Millennium Copyright Act Policy. If you are a copyright owner and you believe that content on GitHub violates your rights, please contact us via our convenient DMCA form or by emailing copyright@github.com. There may be legal consequences for sending a false or frivolous takedown notice. Before sending a takedown request, you must consider legal uses such as fair use and licensed uses. We will terminate the Accounts of repeat infringers of this policy."
The relevant policy is here: https://docs.github.com/en/free-pro-team@latest/github/site-...
> That is false. They could lose their safe harbor if they did not respond to a presumptively valid DMCA notice.
Had it been a valid DMCA notice, the required response under the DMCA is taking down the youtube-dl repo.
Their thermonuclear bomb was to take down other people's repos, ban accounts, and make random threats.
> Pretty sure that the Legal Dept at Github knows more about the DMCA process than a random non-lawyer on HN. It's something they deal with on a regular basis.
I'm pretty sure they do too, which is why their aggressive and technological legal response, combined with their CEO making public statements of sympathy for their victims, is so cynical, dirty, and dishonest.
They can be the good guy, and fight the RIAA. They can be a neutral party, and do their duty under DMCA. But fighting the RIAAs battles for then, and then making comments like Nat's? Sketchy and sleazy.
Even eighties/nineties Microsoft didn't do that. They went after people, but they were at least open about what they were doing -- they called Linux a virus and all sorts of other nasty things. They didn't pretend to like Linux while spreading FUD and mounting legal attacks.
On the other hand, I'm pretty sure the other random guy on the internet (you) doesn't know more than the first random guy on the internet (me).
> That is probably for the best. Customers with unrealistic expectations are not worth the effort to keep.
Depends on the cost, the context, and how those expectations manifest. Talk to any luxury good company serving the ultrawealthy for how not catering to customers with unreasonable expectations would serve them. Or any company selling to an athlete to promote a product. Or many small businesses who just won multimillion dollar B2B contracts. Or...
But in either case, I don't think expecting github to act honestly is an unrealistic expectation. Each time I've dealt with a dishonest company, no matter how good the deal looked, I came out behind. I think people were holding their breath to see what happens with github post-acquisition, and we just learned.
The TOS says that Github will take down the offending content (or if, necessary, account), not the copyright owner's account. Most copyright owners do not have Github accounts. Github is not a thing people use outside of programming.
Their thermonuclear bomb was to take down other people's repos, ban accounts, and make random threats.
This is the proper response to the petulant behavior of techies flaunting the original takedown. The end result would simply have been the RIAA issuing more requests, possibly even formal requests, which Github would have led Github to doing the same thing it did proactively.
You know why did it? To protect people from the legal consequences of their stupidity. Lawsuits are expensive, especially when you're in the wrong and the other side has a very large legal budget.
They can be the good guy, and fight the RIAA. They can be a neutral party, and do their duty under DMCA. But fighting the RIAAs battles for then, and then making comments like Nat's? Sketchy and sleazy.
Being the good guy in this situation is not fighting the RIAA. It's doing what the law requires to prevent disruption of services to their other customers, most of whom aren't opening flaunting the law.
Outside of the tech world, to the extent that people care about this conflict, they're wondering why techies are so intent on bullying non-techies just trying to protect their work. Outside of tech, people are struggling and many are unemployed. This is a PR battle that tech is losing.
No. It doesn't say "offending content." It says "repeat infringers of this policy," referring to the aforementioned paragraphs.
> Github is not a thing people use outside of programming.
Which is increasingly close to zero major industries.
> The end result would simply have been the RIAA issuing more requests, possibly even formal requests, which Github would have led Github to doing the same thing it did proactively.
Exactly, and the opportunity for people with non-infringing uses, such as myself, to pick up the torch. It's a lot easier to take down youtube-dl than it is to take down obviously non-infringing educational tools used by kids to learn from home during a pandemic.
> It's doing what the law requires to prevent disruption of services to their other customers, most of whom aren't opening flaunting the law.
The law requires a very specific process. github went above and beyond that process, for no positive reason. The safe harbor provisions in DMCA hinge on being a "service provider," which is not very well defined, but the provisions were inspired by the concept of a common carrier.
If all I'm doing is hosting people's content, with no control over that, or providing bandwidth, or a caching layer, I shouldn't be liable for the actions of those people. Comcast has no liability for what I send over their network. If I run something illegal on AWS, that's not AWS' liability either. That's reasonable.
There's a fuzzy line from there to a service like github or Youtube, to a service like pip or npm, to something like the Debian package repository. If the Debian package repository, which is controlled and curated by Debian, has infringing content, Debian would almost certainly be liable.
github can be viewed as "like Comcast/AWS" or "like Debian," depending on how much control it exerts over what goes on github. Exerting more control than it absolutely needs to -- as it did in this case -- increases their liability in the long term. This shouldn't put them out of the service provider category, but a pattern of exerting control might.
I'll post cites to sources, and then I'm done here.
> GitHub Asks User to Make Changes.
Just curious, what would the effects be if one were to use multiple accounts to automate the submission of DMCA takedown notifications for all <content> hosted on <content provider>? Does <content provider> honor takedowns only from or in preference to blessed accounts? Could one DoS <content provider> in such a manner? If a human has to review all DMCA complaints, would a flood of false claims DoS the human reviewers?
Asking for a friend.
https://docs.github.com/en/free-pro-team@latest/github/site-...
mentions:
> The DMCA requires that you swear to the facts in your copyright complaint under penalty of perjury. It is a federal crime to intentionally lie in a sworn declaration. (See U.S. Code, Title 18, Section 1621.) Submitting false information could also result in civil liability — that is, you could get sued for money damages. The DMCA itself provides for damages against any person who knowingly materially misrepresents that material or activity is infringing.
That's interesting; is US copyright law enforceable everywhere?
I think many would argue that the takedown notice wasn't "sufficiently detailed", especially when you consider the 1201 vs 512 issue.
There is a way forward, Nat. You can reinstate that repo today, and tell the RIAA that they cannot use your online tool. They have to send your legal representation (in Alaska to slow it down) a certified, hand-signed letter through snail mail. Make a big public show of this process, and get public mindshare on your side.
The DMCA works in much the way that its authors, the telcos and the MPAA and RIAA intended it to. To indemnify ISP's in return for their becoming enforcers for rights-holders ridiculously over-broad "anti-circumvention" clauses[0] which lead to outrageous abuses of the law (including anti-trust violations, attacks on the rights of consumers, academics, etc).
Now, Microsoft's lobbying machinery must have been in its infancy back then so the blame can't entirely be laid at their feet. But Microsoft don't seem to be doing anything to help either.
Fundamental to the problem is that youtube-dl (and many others) seem to be obvious candidates for exceptions to DMCA 1201. But the process around those exceptions seems not be working at all. Something which Microsoft appears completely tone-deaf and oblivious to[1].
So, with respect, I suggest you... get a grip to how you guys are going to be being perceived in this situation.
[0] Fritz Attaway, policy advisor MPAA. https://www.wired.com/2008/10/ten-years-later/ [1] https://beta.regulations.gov/document/COLC-2015-0012-0054
>With potential damages multiplied across millions of users, cloud-computing and user-generated content sites like YouTube, Facebook, or GitHub probably never would have existed without the DMCA (or at least not without passing some of that cost downstream to their users).
Talk about backwards logic
I am going to believe that. Github CEO wanted a reason to open source it, and used a rogue leak in a win-win situation.
Why he didn't sign it to prove it was him? because the desktop client doesn't even have this basic git feature implemented ¯\_(ツ)_/¯ ...and everyone knows managers only uses GUI, Q.E.D.
Unless you’re referring to the generic “our hands are tied” tweet that said nothing: https://twitter.com/natfriedman/status/1321221940774723584?s... in which case, I suppose we’ll agree to disagree on what “all within their power” actually means.
Thank you.
[0] you failed to read the 1st paragraph of the linked article :)
> This is GitHub.com and GitHub Enterprise
It also contains linting config, ci workflows, dockerfiles, and other build related files that you probably wouldn't put in an "un-stripped/obfuscated tarball of our GitHub Enterprise Server source code"
I am not advocating it - I am making people aware that is what leaks mean.
[I randomly picked 20. Because it's usually a lot of options when you have source code access]
Your comment amounts to "Github's security team should be making sure the dependencies in their Gemfile don't have vulnerabilities". Which is an obvious and pointless statement, yes, of course github's security team should make sure github's code doesn't have vulnerabilities. That's the most important duty of their job.
The fact that the Gemfile has been leaked changes nothing about what the security team should be doing.
Your comment doesn't really contribute to discussion because it's not presenting novel information, and it's misleading because, per the reasons above, their security team's priorities goals/responsibilities/behaviors/etc aren't really impacted by this, and your comment sorta implies otherwise.
That's what I was getting at. It means this list - has more avenues & more options for on-prem risk. For someone who has internal network access to lateral subnet (small example). Because one who chose to can start analyzing methods for privileged code access. CISOs would want to add additional review of the surrounding on-prem network and hardware. Just my thoughts.
> It increases downstream risk to GH enterprise
I disagree with that. People have been able to de-obfuscate and read github enterprise's source code for pretty much as long as github enterprise has existed. Researching security vulnerabilities in it is not really any different.
> Because one who chose to can start analyzing methods for privileged code access.
As above, people already could do this; the deobfuscated GHE code is pretty easy to get your hands on. And the chance of there being a remotely exploitable vuln that exfiltrates code or gives you an admin account.. well, that seems to remain at "pretty unlikely".
If this were to logically follow, than no one would run Gitlab, an open source equivalent, because the source code is available for people to "analyze methods". However, I have a similar level of respect for github and gitlab's security teams, and I tend to think the security of both of them is pretty decent, irrespective of whether the code is leaked, open source, or proprietary.
> CISOs would want to add additional review
I also disagree with that understanding. A CISO in the past would have already decided "We trust github's security practices enough to run GHE here and put our code in it." The fact that the code has leaked changes that not-a-wit. The CISO still trusts github's security practices, and those practices haven't changed.
The readme seems clearly aimed towards developers of GitHub.com
Insane.
(Reading docs...)
The desktop client explicitly does not support this, why is that?
Git does not make it trivial to impersonate commits. http://www.linuxjournal.com/content/signing-git-commits
As you yourself mentioned, very, very, very few projects/people sign their commits. Even fewer actually verify them.
In the same vein, one can spoof email - but DKIM, SPF, DMARC together as controls make it much more difficult.
I am well aware that you can sign commits with Git. I do, personally and professionally, and my coworkers and I are required to, by policy that I wrote. That has absolutely no bearing on the topic at hand even tangentially.
It’s popular because it’s free.
Gitlab has always seemed a little clunky to me from the perspective of running a smaller operation.
There are hidden costs to going open source as well as expected ones. Could you imagine the number of PRs, issues and discussions over trivial shit the GitHub userbase would create against an open GH repo? Nightmare. Not to mention code cleanliness expectations and buildability expectations and so on.
Of course they "could do this" or "do it that way," but the fact that they don't should tell you their priorities lie elsewhere, and that's fine. Closed source isn't evil and we have other open source git hosting platforms.
No, it is not.
One issue is that you are loading profile images and creating links based on unverified emails (if I click the little picture next to the commit message I get to the impersonated profile). I mean I get that a proper solution might introduce unacceptable friction, but you can't really blame users for misunderstandings in the current state either.
Maybe add a checkbox in your profile like "Specifically mark unsigned commits" or even "don't associate unsigned commits to my account" as well.
> (!) This user usually signs their commits, but this commit is not signed. [Learn more]
Is what I've been surprised there isn't something like in the past.
Funds are safu?
You "hacked" yourself. A majority of commits are not "verified", and a majority of users don't know to "look for" the verified label. Why didn't you make signing mandatory if you recommend it?
As for repercussions to your mismanagement, I will certainly stay tuned.
In summary: you're fucked.
Also, if users don't know the very basics of how Git works, they probably shouldn't be using it, and certainly not trusting it.
But Github uses the same single Git repository for all forks, and they have an issue where you can access a branch/commit of a fork from the main repository if you know its hash. They should probably fix that at some point.
Ah I see, thanks for the explanation. I didn't know this was the case. I thought each fork would have its own `.git` folder. Seems like this approach could allow forkers to mess with the original repo, but maybe Git is designed in a way that this is mostly safe.
bit of a Wodehousian twist there. appreciated.
Robert Browning, Pippa Passes (1901)
A nice one. I didn't know it.
https://www.goodreads.com/quotes/314320-the-year-s-at-the-sp...
Security by oh yuck it's Ruby.
Instead of making conflict messages clearer and easier to work with using local files, contributors keep thinking the users are too dumb and adding (and changing) merge resolution hacks.
This boils up to github, as can be seen by teams who do not understand the very basic about git commits, and enable "squash commits by default" on their repos. With these teams, git commit history cease to be bit sized changes in a larger changeset, and become useless displays of the author interacting with the remote server while they upload small changes to tests to make the continuous builds get green.
By the way the serious design flaw where GitHub forges signatures on merge commits I told you about when you joined as CEO... Still not fixed.
The fact a commit can be shown as "verified" in the interface when I didn't sign it with my Yubikey is totally broken.
Are you aware of the fact that it is irony in the original work?
https://en.wikipedia.org/wiki/Pippa_Passes
Have you read the newspaper in the last months?
I suspect irony on your side and if it's true you are kind of funny...
This URL has been excluded from the Wayback Machine."
I remember reading somewhere that once You include some url in robots.txt archive.org even though can have it archived it will stop showing it to the public.
https://blog.archive.org/2017/04/17/robots-txt-meant-for-sea...
They have some interesting nuggets in their robots though like `/ExplodingStuff/` and `/account-login` both of which seem to be some accounts.
Or probably more possible - they just got in contact with the archive.org people.
Apart from the code linked above, I don’t think you’re missing any significant information that was on that archived page whose URL is now excluded. The screenshot at the top of this article matches what I remember of that page: https://arstechnica.com/information-technology/2020/11/githu....
To describe the screenshot in words, for the sake of those who prefer text to images for whatever reason: the commit was an orphan with no parent; it had no commit history. The message was as SethTro quoted it: “felt cute, might put gh source code on dmca repo now idk”. GitHub’s interface suggested the committer was https://github.com/nat, but there was no “Verified” label. The interface described the commit as having been created “1 hour ago” at 2020-11-04 05:00:26, the time of crawling.
EDIT: Anyone looking to try doing this, please support open alternatives instead: https://gitea.io/en-us/
- If it is so easy to shoplift, why don't stores just give out everything for free?
It's not that people do not pick locks because locks are so secure. It's because lock is polite way to say "do not enter here" and almost everyone respects that. If someone wants not to respect it, there are a multitude of YouTube channels showing how trivially easy it is to bypass it. But then, the legal aspect kicks in and punishments follow.
The same with stealing. It is trivially easy to steal. Moral code stops most people. Legal code punishes the rest.
Anything in our world can be "so easily acquired" if one does not care about laws and ethics. In that sense, the question posed in the original comment seems utterly bizarre to me. If anything that could be easily acquired were to be released for free, almost everything in the world should be released for free.
I generally like to open-source all my work. I'm working on a closed-source app, right now, but I think that it should be made open-source, once the embargo has passed. The backend is already open-source, as is the SDK.
I like to use the MIT license, which says that you can use the code how you like, but don't come whining to me, if you pooch it.
But I will, sometimes use a license that says "Here's the code for you to look at. It's not authorized for copying."
I think that it's a good idea to have it available. I seriously doubt there's anything in my stuff that is so proprietary that I'm afraid it will get ripped off. I do the same stuff everyone else does; maybe not as cleverly.
I just feel that it's good to show folks what's under the hood, if at all possible.
It depends. Figuring out how to design a large system still takes an appreciable amount of time even if you only end up gluing a bunch of other stuff together at the end of the day. And chances are you have something original in there somewhere. If the market is particularly cutthroat it might be a bad idea to risk giving your competitors even a slight edge.
I do appreciate the sentiment of proprietary source available projects though!
Most likely support. GH probably doesn’t want to support an open source version (triaging issues, reviewing 3rd party pull requests, having an open roadmap). Likewise it would probably be bad PR if they just dumped the code base and were really slow (or didn’t) respond to bug reports.
Being open source requires a lot more than just the source code being available.
Well, you don't necessarily have to do those things. See for instance Apple's XNU Kernel. :)
Well, "maximum engineering secrecy" would be not releasing the source code to XNU. Apple is very secretive overall, to be sure, but not in this one respect.
I'm glad that XNU's source code is available—it lets you do a number of neat things. I wish more was available, but I'll take what we can get.
By extension, I don't support the idea that there's no point in releasing source code if you can't also release documentation and review outside pull requests. Making a tool available to the public is always better than hoarding information. All the other stuff is even better, but code is code.
---
All of that said, I recognize that for Github specifically, releasing code and not engaging with it might be a bad look, because their product is a code sharing platform. I don't think that applies to most companies, though.
The GitHub way of working has only been around since GitHub launched. Accordingly, the free software and open source communities that predate GitHub had their own ways of working before GitHub came along. Despite the widespread perception that GitHub makes doing open source easy, it comprises a set of practices that can be and are frequently more taxing than the alternatives. If GitHub is all you know, though, or you've forgotten, or you've just not noticed and never measured it, then it's easy to think that the GutHub way embodies the essentials of development in the open, even though its workflows are pretty bloated.
I'm not trying to be mean or sarcastic or anything. Just look at how maintainers are treated for a week and you'll see exactly what I mean.
Just because something is open source, does not mean you have to engage with the "community". Slapping GPL on some code on a git repo somewhere, with a big sign saying if you don't like it you have the right to fork, so please fork off, is also open source, and a totally ok thing to do if you don't want to develop a community [Open source maintainers don't owe the world anything beyond what they freely want to give it]
why does anything needs to be open source in the first place?
Open-sourcing something should add value. Github doesn't see any value in doing so (and i would agree). It's not like github has any secret ingredient that makes github source special - gitlab has replicated most of github's functionality, and so has many open hosting platforms.
The value of github is mindshare, rather than anything code wise.
Not help you learn.
Not advocating FOSS approach for anything, and I'm not strictly speaking of GH in that context, but generally, malicious code loves being hidden into closed source software since it's the best effective way to keep it hard to control and correct. When privacy, security, safety, accountability become important, the FOSS approach might solve a problems or two. Of course the downside is that everyone can look at it, so building a billions worth business out of a fork + 10 line changes + renaming of a FOSS project cannot work without violating the license by keeping it closed.
I'm also genuinely curious how many people actively review all the code they actually run. I doubt anybody but the very largest tech companies and high-end government would actually be able to afford and resources such a feat, and even then they would have DMZ-type areas to detonate unaudited software.
This is GitHub.com and GitHub Enterprise.I've used it as a local-network git remote and generally enjoyed my experiences with it. It's not quite as developed of a web interface as Gitlab or Github, but as a git remote with a web frontend it's very usable and quick to deploy.
Zipped source (140 MB) mirror https://web.archive.org/web/20201104050247/https://codeload....
Similar things happened with Sony over Other OS. Sadly I bet there will be further attacks and leaks as time goes on here.
Come out against the RIAA if you must do something. Better still to let the process work, you don't win legal battles by committing crimes.
GitHub (via their owners Microsoft) is a member of the RIAA. They give the RIAA money to do stuff like this.
That being said, it also seems like GitHub is well within their rights to choose not to host a project accused of violating the law.
It's unreasonable to expect that the individual who took this action could go to court against the RIAA and extract their deeply embedded claws from the legislative, executive, and even cultural environment in which they've entrenched themselves.
Instead, it's reasonable to expect that somewhere in a conference room at say, Gitlab, Sourceforge, etc., sometime in the near future, some lawyer is going to mention "We got DCMAs from X for repo Y, and foo for repo bar, and from the MPAA for the popular repo (insert software tool here), obviously we should remove all of those repos." Maybe someone familiar looks up and says "that sounds a little silly, isn't that tool just a general-purpose media player?" And the lawyer might respond "We don't care-we don't have the budget to determine if the DCMA notice looks valid or not, if it turns out to be valid we have to do it and if it's not valid it costs us nothing to take it down". Actions like this provides a reasonable response of "But, as we saw with GitHub, some of our users and maybe even some of our own employees will resent us for this. It could cost us users, cost us bad publicity, or cost us real money. Let's put a couple people on this for an hour or two to estimate the pros and cons."
Github was just a middleman, responding rationally to their existing financial, legal, and moral incentives, in a battle between their little users and the RIAA. Like a little flock of oxpecker birds riding a rhinoceros, we wouldn't even register in a fight against a tiger, we can only warn our larger intermediary of the danger we perceive. The RIAA doesn't care that you're against them. We need to change the incentives for companies like Github that have a chance to be heard.
Tell that to the Civil Rights movement.
Quite possibly one of the most incorrect things I've ever read.
After the youtube-dl event many people became aware of those "hacks" because someone used it to "upload youtube-dl into the DMCA's repo".
Since those hacks are known by GitHub but they won't fix it, someone thought that the best way to "protest" against the decition was to push GH's source into the DMCA's repo impersonating GH's CEO.
That's my theory, a protest.
edit: DMCA
What's sad about this?
They don't have a mantra of all information wants to be free, and indeed their entire business model relies on hosting private repos.
I understand people wanting to host their open source on a server that's also open source. There's an argument it makes business sense if the closed source setup creates a long-term drift to GitLab or elsewhere. Nevertheless, I don't see the closed source as a contradiction.
You can love open source while producing a mix of open and closed source. Building a sustainable business often means being selective about it and seeing open source as a tool you can benefit from (enlightened self-interest), rather than an ideology you must adhere to at all times.
Which at the time of writing read as follows "It's not open source because the open source "community" is a liability and you want them far away from you at all times.
I'm not trying to be mean or sarcastic or anything. Just look at how maintainers are treated for a week and you'll see exactly what I mean."
Regarding it's current, although waning, top choice for hosting open source software, I certainly do think we are starting to see the trade offs the open source community has been making.
There are tons of hosted GIT solutions. I've started using sourcehut [1] which seems like an rising platform that is also opensource. Hopefully youtube-dl ends up there instead of risking it on another big provider.
[1] https://sr.ht/
[1] http://theorangeduck.com/page/reproduce-their-results#source...
This is not a bug, it's a part of how Git fundamentally works. If you want to mitigate it you have to sign your commits. GitHub could only attribute commits in the UI if they're signed, but I suspect that this is considered too much friction to enable.
https://www.reddit.com/r/programming/comments/jnpufo/using_t...
Using the same trick as the one with youtube-dl, I uploaded the entire GitHub backend source code to GitHub's own DMCA repo. Maybe now not only GitHub can have the chance to fix the "bug", but the entire community as well? ;)
Of course Drew DeVault thinks this way. He's trying to monetize his own github-like product, the sourcehut, so less people using GitHub means more people using sourcehut.
2) They most certainly did not "impersonat[e] Nat Friedman using a bug in GitHub's application"; they impersonated him using a design feature in Git.
I believe this isn't an existential threat to the company by any means.
https://pbs.twimg.com/media/De17PIKXUAE27W6.jpg:large
...and show that making it work in any browser, even text-based ones (as far as possible), is not hard.
I'd love to hear more about that.
I'd love to study it but not if just viewing it is a gray area
You can read bomb-making instructions, for heaven's sake. You can certainly look at this code. Just don't base a product on the ideas you got from looking at it.
Are there any verbatim copies of the original in your project. Did you sign an enforceable ip ownership or non-compete agreement with GitHub about trade secrets learned while working on their source code?
If the answers to those questions are no, there is a very long, very steep, uphill battle facing GitHub.
How many people can actually push to that repo? I wonder if it would be easy to figure out who actually did it...
For example, if I were to 'git clone' a project currently on gitlab, create a github repo for it, add that origin, and push... Well, that pushes commits authored by every single person who ever committed to that other repository. Do I have to make all of them re-push only their own commits in order? Can robots not mirror repositories anymore? What about commits authored by people without github accounts?
There's also the obvious issues of me merging a coworker's commit into my branch, or cherry-picking, or rebasing a third-party contributor's commits to update them before merge.
I think the case of "push an existing repo with N authors to a new repo" is a really compelling reason though for why that sort of "you can only push commits with your email" thing would not work.
All of the commits in that branch I pulled, regardless of who committed them (not me, presumably) should still be attributed to their original authors, and that's what will happen on the fork I push to GH.
This is fundamentally necessary to how the distributed nature of git works. If you want to assure others that commits really came from you, you need to sign your commits. But so few people do that, so the default is just to trust that commits are from who they say they are.
Perhaps GitHub could have a feature whereby you could toggle a setting so they won't link a commit to your GH user account unless it's signed by you. That still comes with its own problems (like say you submit a PR to some project, but the maintainer rebases master onto your branch before merging, which will kill the signatures).
But still, signing every commit is not really necessary. I personally only sign release tags, which implicitly cover all commits leading up to those releases.
Github does the thing where a cloned repo shares the object space with all repos of the origin, so you can use the same commit sha1 on any of the repos. All someone would have to do is clone the repo, make the commit to their clone, then share the link with the sha1 in the origin repo.
The sha1 blob may not actually appear in the main repo timeline.
Microsoft are running Bartertown and and are doing a pretty good impression of Master Blaster. Ironically youtube-dl just got dragged into the thunder dome.
You can trade outside Bartertown but it’s going to have low visibility.
People are afraid that they will do that again after relying on them as a foundation for their product or experience based on some trite promise of "we changed". So when something happens, the attribution and a hypothesis is already formed.
Unfortunately, based on my experiences attempting to fight their universal telemetry, the promise they made is invalid. So why should I trust any of their other promises? I think a lot of people are there too.
Specifically, the way GitHub "embraced and extended" git (even before the Microsoft acquisition) is to have quite a few things outside the repository - like issues. You can take your source anywhere you want, but a project with 30,000 issues is going to have trouble migrating those issues.
Or is there something specific you are accusing Microsoft of?
To give an analogy, I think the Internet is great. But I dislike the individuals who exploit it to send spam and propagate worms etc.
Capitalism offers a reward for those who are willing to put in the work.
Microsoft has helped billions of people around the world find employment, build software, use a computer, save time, money, and achieve something or another across pretty much every field in existence. For that, the capitalist system lets them dominate the market and gain all kinds of advantages. They deserve it as far as I'm concerned.
I'm wondering when one of the 1000s of services with write access to 100s of thousands of github run repos gets hacked or tokens expropriated and lots of repos suddenly get malicious commits.
I saw the headline and assumed this was a leak of someone else's source via stolen tokens.
https://web.archive.org/web/20201104050247/https://codeload....
mirror: https://anonfiles.com/Jax980m9p6/dmca-565ece486c7c1652754d7b...
c51717e6755ac0efdf22f7421e372f5b061724d61. is not equal to making it open to collaboration.
2. does not mean they can’t keep making money from it.
You haven't licensed the material so it's copying or possession by you is an illegal act in most jurisdictions. Your awareness of the nature of the content and its licensing status establishes intent.
Of course, if you don't redistribute it you shouldn't have any problems (at least in the US) because an IP address alone isn't sufficient to pursue someone in court here.
I really don't think any of that applies here though. This is an isolated leak of materials which you very clearly do not have any rights to access, copy, or possess in any manner whatsoever. I just can't see how "research purposes" helps you here. (Unless you happen to be an established researcher with an ongoing project that involves surveying source code leaks over time, perhaps? But again, you'd really need to consult a lawyer before doing something like that.)
> This is an isolated leak of materials which you very clearly do not have any rights to access, copy, or possess in any manner whatsoever
I think that's backwards - you don't need the right to posess something, you need to make sure that nobody has the right to stop you from posessing it. The default state in the absence of someone else's right interfereing is information gets to be free. So the question is, are you violating any of github's rights if you download the code for "personal research" or curiosity?
As far as copyright/fair use goes, the fact its a leak doesn't seem that applicable to me - you do not need permission from the copyright holder for fair use to apply (in fact that would defeat the entire point of fair use). "Research" might apply here, because in the united states you can basically ignore copyright if its for research purposes (although there is a lot of fine print on that and its really complicated). In particular, if your personal research is non-commercial and unlikely to affect github's bottom line, it further increases the liklihood fair use applies.
https://en.wikipedia.org/wiki/Fair_use#U.S._fair_use_factors
Personally i think trade secret law is more appropriate than copyright here, but afaik that only applies to people who have a responsibility to keep github's code confidential. I don't think that applies to randoms on the internet who are just curious what github's source looks like.
And again, IANAL.
Viewing classified top secret nsa documents is not illegal unless you have agreed to never viewing them when gaining classified clearance. Anyone who does not have classified clearance is free to look at them.
You are not liable for what you read. Those posting it may be liable for infringement, and you could be liable if you infringement upon it. But reading is not yet illegal in the usa.
Reading something isn't inherently illegal itself, true. I'm fairly certain that intentionally navigating to a website that you know contains pirated content is a violation of copyright law though. (Of course no one is going to bother prosecuting you for it, but still.)
The laws surrounding classified information in the US are quite different from copyright law. They aren't relevant here at all. (https://en.wikipedia.org/wiki/Classified_information_in_the_...)
Click "Code". I'm not suggesting you download it, that would be naughty.