Indian Programmer Exposes Code Injection, Gets a Cease and Desist from Injectors • Hacker News Board

Re: Indian Programmer Exposes Code Injection, Gets a Cease and Desist from Injectors

#91

Post by shmerl » Wed, Jun 10, 2015, 7:29 PM UTC

dkersten wrote: post #81

shmerl wrote: post #52

Earlier quoted context omitted.

Is illegal code (i.e. malware) protected by the copyright to begin with? If it is, then all antiviruses blatantly violate copyright. But something tells me they don't need to ask any permission from malware authors.

Regardless of whether or not it is, the article makes statements about how its " freely downloadable via any browser" and how "The crime, it seems, was the uploading of public code to a public repository". The point is that (legal or not), the code is not public and shouldn't be treated as such. No other code (eg javascript from all the HN starstups' web apps) that is downloadable is automatically "public code". Inno…

> The point is that (legal or not), the code is not public and shouldn't be treated as such.

I brought a few examples (like antiviruses). How publishing security research even into the public repository with the code of malware that's involved wrong? Fair use should cover it. If it's indeed illegal, then all antiviruses are illegal too, because not only they publish - they redistribute that said code.

Re: Indian Programmer Exposes Code Injection, Gets a Cease and Desist from Injectors

#92

Post by shmerl » Wed, Jun 10, 2015, 7:32 PM UTC

rosser wrote: post #88

shmerl wrote: post #52

Earlier quoted context omitted.

Is illegal code (i.e. malware) protected by the copyright to begin with? If it is, then all antiviruses blatantly violate copyright. But something tells me they don't need to ask any permission from malware authors.

Yes, malicious code is protected by copyright. Antivirus software isn't distributing the copyrighted virus, and I can't begin to wrap my head around the conception you must have of how they work, in order to think they do. Copyright is utterly irrelevant to the relationship between computer virii and antivirus software.

> Antivirus software isn't distributing the copyrighted virus

Why not? Many of them include patterns for detecting viruses, which literally contain originals in some way (partially at least). There are tons of malware types, including one that's not polymorphic.

Regardless, even if they include malware in full, it should be perfectly fine under fair use. I.e. that malware souldn't be protected by the copyright in such case (because it's for the purpose of security).

Re: Indian Programmer Exposes Code Injection, Gets a Cease and Desist from Injectors

#93

Post by biot » Wed, Jun 10, 2015, 7:33 PM UTC

shmerl wrote: post #52

wvenable wrote: post #29

Earlier quoted context omitted.

Just because code/webpages are delivered to you over the web doesn't mean you can take them and republish them somewhere else.

Is illegal code (i.e. malware) protected by the copyright to begin with? If it is, then all antiviruses blatantly violate copyright. But something tells me they don't need to ask any permission from malware authors.

Antivirus software is based upon code signatures. When you install some AV software, it does not come with complete, unabridged copies of every single sample and every mutation of every piece of malware ever. Not only is that a bad idea from a copyright standpoint (regardless of whether any malware author would bother to enforce their rights), but also because the AV software would completely fill up your hard drive and it would give everybody (including competitors) access to complete copies of malware.

Re: Indian Programmer Exposes Code Injection, Gets a Cease and Desist from Injectors

#94

Post by rosser » Wed, Jun 10, 2015, 7:39 PM UTC

shmerl wrote: post #92

rosser wrote: post #88

Earlier quoted context omitted.

Yes, malicious code is protected by copyright. Antivirus software isn't distributing the copyrighted virus, and I can't begin to wrap my head around the conception you must have of how they work, in order to think they do. Copyright is utterly irrelevant to the relationship between computer virii and antivirus software.

> Antivirus software isn't distributing the copyrighted virus Why not? Many of them include patterns for detecting viruses, which literally contain originals in some way (partially at least). There are tons of malware types, including one that's not polymorphic. Regardless, even if they include malware in full, it should be perfectly fine under fair use. I.e. that malware souldn't be protected by the copyright in suc…

Fair use doesn't remove a copyrighted work's protections. What ever gave you that idea?

Think of it in criminal law terms: it's like the "affirmative defense" that having a medical marijuana card gives you in states that have such programs. Pot is still illegal, but if you get caught with some, and have a card (and are compliant with the restrictions of your local MMJ program), then the charges are dismissed.

It doesn't change the law; it changes how the law applies to you.

Re: Indian Programmer Exposes Code Injection, Gets a Cease and Desist from Injectors

#95

Post by shmerl » Wed, Jun 10, 2015, 7:56 PM UTC

biot wrote: post #93

shmerl wrote: post #52

Earlier quoted context omitted.

Is illegal code (i.e. malware) protected by the copyright to begin with? If it is, then all antiviruses blatantly violate copyright. But something tells me they don't need to ask any permission from malware authors.

Antivirus software is based upon code signatures. When you install some AV software, it does not come with complete, unabridged copies of every single sample and every mutation of every piece of malware ever. Not only is that a bad idea from a copyright standpoint (regardless of whether any malware author would bother to enforce their rights), but also because the AV software would completely fill up your hard drive…

So aren't those signatures derivative works then?

Re: Indian Programmer Exposes Code Injection, Gets a Cease and Desist from Injectors

#96

Post by shmerl » Wed, Jun 10, 2015, 7:57 PM UTC

rosser wrote: post #94

shmerl wrote: post #92

Earlier quoted context omitted.

> Antivirus software isn't distributing the copyrighted virus Why not? Many of them include patterns for detecting viruses, which literally contain originals in some way (partially at least). There are tons of malware types, including one that's not polymorphic. Regardless, even if they include malware in full, it should be perfectly fine under fair use. I.e. that malware souldn't be protected by the copyright in suc…

Fair use doesn't remove a copyrighted work's protections. What ever gave you that idea? Think of it in criminal law terms: it's like the "affirmative defense" that having a medical marijuana card gives you in states that have such programs. Pot is still illegal, but if you get caught with some, and have a card (and are compliant with the restrictions of your local MMJ program), then the charges are dismissed. It does…

> Fair use doesn't remove a copyrighted work's protections.

It doesn't remove them, it just says that that they aren't even applicable in that case. I.e. there is nothing to remove when it's not there to begin with.

I agree that it's somewhat poorly defined that's why there can be different ways to view it. See https://w2.eff.org/IP/eff_fair_use_faq.php

Approach of "affirmative defense" doesn't sound logical to me. Approach of limiting copyright applicability makes more sense. I.e. fair use defines some borders beyond which copyright can't reach.

Re: Indian Programmer Exposes Code Injection, Gets a Cease and Desist from Injectors

#97

Post by nightpool » Wed, Jun 10, 2015, 8:08 PM UTC

TheDong wrote: post #43

webkike wrote: post #2

I wonder, if I write some HTML/JS code and deny the write to modify, can I send Flash a cease and desist for violation?

You don't have to do that; there are plenty of webpages with GPL'd html and injecting such code into that html without also providing the code under GPL on request to any user is a violation of the GPL. I'm curious if the above copyright infringement would stand in court or not... Copyright infringement normally does need intent and I'm not sure if this is really intent or not.

Its clear intent on the part of the programmer who wrote the code, in my opinion. They obviously designed it to modify webpages, and its not doing anything out of the ordinary or unexpected when its modifying GPL'd webpages. Just because the programmer didn't consider that there may be licensing restrictions attached to modifying web pages doesn't mean that they should be exempt from them.

Re: Indian Programmer Exposes Code Injection, Gets a Cease and Desist from Injectors

#98

Post by wvenable » Wed, Jun 10, 2015, 8:08 PM UTC

derefr wrote: post #87

wvenable wrote: post #29

Earlier quoted context omitted.

Just because code/webpages are delivered to you over the web doesn't mean you can take them and republish them somewhere else.

"Just because", no. But: 1. The server has no access restrictions for the Javascript URL, presumably. So, if you trust the server's configuration to match the owner's intent, then the owner was saying "this page is intended for public consumption." Which is to say, importantly, not only for their customers to view in exchange for their subscription fees (which would put the ad-injector script under license of whateve…

> The server has no access restrictions for the Javascript URL, presumably. So, if you trust the server's configuration to match the owner's intent, then the owner was saying "this page is intended for public consumption."

That argument did not help weev with AT&T. If they are distributing the code, they are allowed to do that as the copyright owner. That's why it's called copyright. But that doesn't grant anyone else the right to distribute the content. By your argument, any content posted anywhere publicly on the Internet is not subject to copyright restrictions. Which is clearly not the case.

> The owner never put a copyright claim against anyone else making copies of this work.

It's unlikely they are aware of anyone else distributing their work. This may be the only unauthorized distribution of this work so far.

> transformative use (it's visible source code, not an executing program!),

There is nothing transformative about this.

> of a small part of their copyrighted work (it's just the Javascript!),

It must be very small; an excerpt. This is not an excerpt of the program.

> There's probably even more arguments than these.

If they're of the same quality they're unlikely to make a difference. These are poor arguments. Fair use never* applies to copying a complete work.

* It's perhaps possible; but this case certainly doesn't qualify.

Re: Indian Programmer Exposes Code Injection, Gets a Cease and Desist from Injectors

#99

Post by wvenable » Wed, Jun 10, 2015, 8:13 PM UTC

shmerl wrote: post #95

biot wrote: post #93

Earlier quoted context omitted.

Antivirus software is based upon code signatures. When you install some AV software, it does not come with complete, unabridged copies of every single sample and every mutation of every piece of malware ever. Not only is that a bad idea from a copyright standpoint (regardless of whether any malware author would bother to enforce their rights), but also because the AV software would completely fill up your hard drive…

So aren't those signatures derivative works then?

Excerpts of materials are fair use. A signature is even a transformative excerpt. You can't reconstruct the original malware from the signature.

Re: Indian Programmer Exposes Code Injection, Gets a Cease and Desist from Injectors

#100

Post by wvenable » Wed, Jun 10, 2015, 8:14 PM UTC

shmerl wrote: post #73

wvenable wrote: post #61

Earlier quoted context omitted.

It seems like illegal works should be protected by copyright[1] But that begs the question, as ad injectors are probably not illegal. [1] http://www.cardozo.yu.edu/sites/default/files/Eldar%20Haber,...

I'm not sure they are not illegal. At least they shouldn't be any less illegal than many other types of malware. But I'm not familiar what laws that falls under.

Injecting ads into content has been what television stations have been doing for decades. Users of the network service may even have agreed to this in the terms of service for using the network. It's a crappy thing to do but not all crappy things are illegal.