Live data from Hacker News

Indian Programmer Exposes Code Injection, Gets a Cease and Desist from Injectors

techcrunch.com

41–50 of 125 posts

Re: Indian Programmer Exposes Code Injection, Gets a Cease and Desist from Injectors

#41

It's not really a big deal but why do they need to say Indian programmer as apposed to just a programmer?

Because the story takes place in India, and since TechCrunch is an American publication, people would otherwise assume the story was taking place in the US.

Good point.

Re: Indian Programmer Exposes Code Injection, Gets a Cease and Desist from Injectors

#43
post #2

I wonder, if I write some HTML/JS code and deny the write to modify, can I send Flash a cease and desist for violation?

You don't have to do that; there are plenty of webpages with GPL'd html and injecting such code into that html without also providing the code under GPL on request to any user is a violation of the GPL.

I'm curious if the above copyright infringement would stand in court or not... Copyright infringement normally does need intent and I'm not sure if this is really intent or not.

Re: Indian Programmer Exposes Code Injection, Gets a Cease and Desist from Injectors

#45
post #37

Earlier quoted context omitted.

Google is in the unusual situation of receiving a lot of blatantly invalid DMCA takedowns. Like, a movie studio (or a company under contract to them) will do a Google search for something broad, like "download game of thrones", and issue a mass takedown for every single link that shows up, often without even looking at the links . So a lot of perfectly legal content (e.g, a news article that says "Game Of Thrones is…

The ridiculous thing is that there are no consequences for the groups sending out those invalid DMCA requests. Every other week I read about how someone uses DMCA to censor a YouTube video or article that's critical of them, but apart from the loss of face with the public they don't see any of the legal or financial penalties that are supposed to result from invalid DMCAs.

Part of the problem there is that the DMCA (and arguably the legal system in general) doesn't deal well with pseudonymity. Contesting a DMCA takedown requires that you send your real name and contact information to the service provider and to the sender of the DMCA. This ends up making the DMCA a dangerous harassment tool; targeted individuals end up with an unpalatable choice between allowing their harassers to force any content of theirs to be taken offline (which will often cause their accounts to be suspended on sites like YouTube!), or giving their harassers their personal information.

But more generally -- yes, it's a huge problem that the DMCA has few consequences for "spray and pray" takedowns. While there are some provisions in the law for damages against knowingly issuing an invalid takedown, it's incredibly hard to prove (I'm not sure if it's ever happened!), and in any case, it doesn't apply if the takedown was simply sent in error. Even if you make that error repeatedly, and don't do anything to prevent it.

Re: Indian Programmer Exposes Code Injection, Gets a Cease and Desist from Injectors

#46

Earlier quoted context omitted.

Just because code/webpages are delivered to you over the web doesn't mean you can take them and republish them somewhere else.

Just because fingerprints were found at the scene of the burglary doesn't mean you take them and republish them somewhere else.

Doesn't that fall under vigilantism? Publishing fingerprints might get you in trouble.

In most countries you are forbidden to take photos in a private setting without permission, and in some even in public.

wvenable's comment is on point. Just as public websites aren't public domain, publishing information delivered on request might not be legal.

Re: Indian Programmer Exposes Code Injection, Gets a Cease and Desist from Injectors

#47

Earlier quoted context omitted.

Just because code/webpages are delivered to you over the web doesn't mean you can take them and republish them somewhere else.

Just because fingerprints were found at the scene of the burglary doesn't mean you take them and republish them somewhere else.

Fingerprints are not copyrighted, code is.

You might claim fair use if you published it as part of an article, but probably not on GitHub which is intended for using and editing code.

Re: Indian Programmer Exposes Code Injection, Gets a Cease and Desist from Injectors

#49
post #43
post #2

I wonder, if I write some HTML/JS code and deny the write to modify, can I send Flash a cease and desist for violation?

You don't have to do that; there are plenty of webpages with GPL'd html and injecting such code into that html without also providing the code under GPL on request to any user is a violation of the GPL. I'm curious if the above copyright infringement would stand in court or not... Copyright infringement normally does need intent and I'm not sure if this is really intent or not.

I'd never considered that angle before, that's a good thought! If they intend to modify the source of a page then that would be considered a derivation, and obfuscated code is not considered a source code release.

I'd love to hear a more professional analysis on this angle.

Re: Indian Programmer Exposes Code Injection, Gets a Cease and Desist from Injectors

#50
post #8

Wow! I was using the WiFi at the Bangalore or Mumbai airport one day when I realised that half of the websites appeared broken in some way. I looked into the code and realised that the WiFi provider was injecting JavaScript ad codes in all the web pages I was visiting. I talked to some people about it, but no one seemed perturbed. Such invasions of privacy are a hallmark of Indian companies. Even more perturbing is t…

Well, you should always be able to tell if you limit yourself to HTTPS sites. If they offered their own devices and had hacked them to make middle-manned HTTPS sites appear safe, that would be crossing the line for me.
Post reply on HN