Indian Programmer Exposes Code Injection, Gets a Cease and Desist from Injectors

Regardless of whether or not it is, the article makes statements about how its " freely downloadable via any browser" and how "The crime, it seems, was the uploading of public code to a public repository". The point is that (legal or not), the code is not public and shouldn't be treated as such. No other code (eg javascript from all the HN starstups' web apps) that is downloadable is automatically "public code". Innocent until proven guilty and all that.

But... since copyright automatically applies to all works, yes, I think it does and should apply to illegal code (and every other code or work out there).

Having said that, I don't particularly see much morally objectionable with what this guy did in this case, even if its not legal.

This has been posted a few times, most notably https://news.ycombinator.com/item?id=9683108.

I had a similar thing happen to me in the USA actually but had a different outcome.

I got on instagram.com (when it was still served over HTTP) one day and noticed an alignment issue. I believe reddit also had the issue. It was caused by a rogue iframe that was being injected into the page.

After some investigating the iframe domain was owned by my ISP. I sent emails to some of the higher ups telling them they should stop and the problem disappeared after about a month, and wrote a chrome extension to block the domains in the meantime. Not really sure what their idea was but it goes to show that you can't trust your ISP anywhere in the world (or anyone on the internet for that matter).

"Just because", no. But:

1. The server has no access restrictions for the Javascript URL, presumably. So, if you trust the server's configuration to match the owner's intent, then the owner was saying "this page is intended for public consumption."

Which is to say, importantly, not only for their customers to view in exchange for their subscription fees (which would put the ad-injector script under license of whatever TOS the customers agreed to), but rather for anyone to view who has no prior relationship with them, for any purpose.

This is the "reproductions are allowed of works of artistic craftsmanship (buildings, sculptures, etc.) that are permanently situated in a public place or in premises open to the public" argument.

2. The owner never put a copyright claim against anyone else making copies of this work. Like the Internet Archive's copy of their website, say (if there is one.) That would suggest this takedown notice is a motivated use of copyright law to attack someone, rather than business-as-usual of them enforcing their IP.

Judges don't like it when you have a history of not caring about people doing something you could have complained about. They take that as evidence you don't care.

3. Fair use! This is a:

• transformative use (it's visible source code, not an executing program!),

• of a small part of their copyrighted work (it's just the Javascript!),

• intended for a purpose that could be said to be both parody (revealing a previously-unnoticed essence of the original work through transformation) and edification (teaching people that the network is doing this thing.)

There's probably even more arguments than these. I hope the poster takes some of them to Github with a counter-takedown to get their repo back up.

What about the copyright of the webpage whose code was altered with these injected ads? It's ironic that a company whose product disrespects the copyright of others would be so sensitive to the issue.