Indian Programmer Exposes Code Injection, Gets a Cease and Desist from Injectors • Hacker News Board

Re: Indian Programmer Exposes Code Injection, Gets a Cease and Desist from Injectors

#111

Post by shmerl » Wed, Jun 10, 2015, 9:52 PM UTC

rosser wrote: post #110

shmerl wrote: post #109

Earlier quoted context omitted.

> If copyright worked the way you seem to think it does, then the GP's scenario — where someone using a work under Fair Use terms could still be sued, and then has to prove that their use was legitimately Fair Use — wouldn't be the norm. So where did presumption of innocence go? I know it's tossed out all the time in copyright (that's the core of the whole DRM approach), but it's not supposed to be that way. If they…

I'm not even sure why I'm bothering any more. You seem determined not to hear what anyone else is saying, but instead just keep talking about how things should be, how they're supposed to be. Which might be an interesting discussion to have, if you were aware enough of how things actually worked to understand the difference between civil and criminal court proceedings. "Presumption of innocence" exists in criminal ca…

Since I'm not a lawyer, please explain why presumption of innocence isn't applied in civil cases? That would be more productive than expecting that everyone should know that just because you do.

Re: Indian Programmer Exposes Code Injection, Gets a Cease and Desist from Injectors

#112

Post by wvenable » Wed, Jun 10, 2015, 10:16 PM UTC

shmerl wrote: post #104

wvenable wrote: post #100

Earlier quoted context omitted.

Injecting ads into content has been what television stations have been doing for decades. Users of the network service may even have agreed to this in the terms of service for using the network. It's a crappy thing to do but not all crappy things are illegal.

This example was not about injecting ads. It was about collecting data about users which is violating their privacy (i.e. it's malware).

What are you basing this on? Flash Networks said "The javascript mentioned does not collect or store any user data but is used to deliver user messages." and I haven't heard anything to contrary.

In fact, it doesn't sound like it was even going to be used to inject ads except for offering users to upgrade to larger plan when they were near their data expiration.

I agree that any code injection is shady and unwanted but you're just making stuff up.

Re: Indian Programmer Exposes Code Injection, Gets a Cease and Desist from Injectors

#113

Post by wvenable » Wed, Jun 10, 2015, 10:25 PM UTC

shmerl wrote: post #109

rosser wrote: post #107

Earlier quoted context omitted.

If copyright worked the way you seem to think it does, then the GP's scenario — where someone using a work under Fair Use terms could still be sued, and then has to prove that their use was legitimately Fair Use — wouldn't be the norm. But it is. So, there's how you appear to think it works, and there's how it works in the world outside your skull. It turns out, that things in the real world are sometimes sloppy, or…

> If copyright worked the way you seem to think it does, then the GP's scenario — where someone using a work under Fair Use terms could still be sued, and then has to prove that their use was legitimately Fair Use — wouldn't be the norm. So where did presumption of innocence go? I know it's tossed out all the time in copyright (that's the core of the whole DRM approach), but it's not supposed to be that way. If they…

Presumption of innocence doesn't prevent you from having to go to court and defend yourself. However, the DMCA provides safe harbor for sites and networks, essentially removing them from the conflict entirely, if they quickly act to remove contentious materials. Then there is a process by which the two sides actually involved can dispute over the materials can make their case.

The DMCA favors copyright complainants but it also completely absolves providers of liability. So it's a messy compromise.

Re: Indian Programmer Exposes Code Injection, Gets a Cease and Desist from Injectors

#114

Post by shmerl » Wed, Jun 10, 2015, 10:43 PM UTC

wvenable wrote: post #112

shmerl wrote: post #104

Earlier quoted context omitted.

This example was not about injecting ads. It was about collecting data about users which is violating their privacy (i.e. it's malware).

What are you basing this on? Flash Networks said "The javascript mentioned does not collect or store any user data but is used to deliver user messages." and I haven't heard anything to contrary. In fact, it doesn't sound like it was even going to be used to inject ads except for offering users to upgrade to larger plan when they were near their data expiration. I agree that any code injection is shady and unwanted b…

On the article:

> “This is a standard solution deployed by telcos globally to help their customers keep track of their data usage in terms of mega bytes used. It is therefore meant to improve customer experience and empower them to manage their usage. One of our network vendor partners has piloted this solution through a third party to help customers understand their data consumption in terms of volume of data used.”

The same thing was claimed about various malware in the past, which was found capable of doing all kind of weird things way beyond "improving customer experience".

Re: Indian Programmer Exposes Code Injection, Gets a Cease and Desist from Injectors

#115

Post by shmerl » Wed, Jun 10, 2015, 10:47 PM UTC

wvenable wrote: post #113

shmerl wrote: post #109

Earlier quoted context omitted.

> If copyright worked the way you seem to think it does, then the GP's scenario — where someone using a work under Fair Use terms could still be sued, and then has to prove that their use was legitimately Fair Use — wouldn't be the norm. So where did presumption of innocence go? I know it's tossed out all the time in copyright (that's the core of the whole DRM approach), but it's not supposed to be that way. If they…

Presumption of innocence doesn't prevent you from having to go to court and defend yourself. However, the DMCA provides safe harbor for sites and networks, essentially removing them from the conflict entirely, if they quickly act to remove contentious materials. Then there is a process by which the two sides actually involved can dispute over the materials can make their case. The DMCA favors copyright complainants b…

> Presumption of innocence doesn't prevent you from having to go to court and defend yourself.

That's right, but you have to defend against what they should prove to the court. But @rosser is claiming that it's not even applicable in the civil law. That's really surprising to me (IANAL just to be clear), so I want to understand why.

Re: Indian Programmer Exposes Code Injection, Gets a Cease and Desist from Injectors

#116

Post by wvenable » Wed, Jun 10, 2015, 10:55 PM UTC

shmerl wrote: post #114

wvenable wrote: post #112

Earlier quoted context omitted.

What are you basing this on? Flash Networks said "The javascript mentioned does not collect or store any user data but is used to deliver user messages." and I haven't heard anything to contrary. In fact, it doesn't sound like it was even going to be used to inject ads except for offering users to upgrade to larger plan when they were near their data expiration. I agree that any code injection is shady and unwanted b…

On the article: > “This is a standard solution deployed by telcos globally to help their customers keep track of their data usage in terms of mega bytes used. It is therefore meant to improve customer experience and empower them to manage their usage. One of our network vendor partners has piloted this solution through a third party to help customers understand their data consumption in terms of volume of data used.”…

You are not stating any facts and so this doesn't add anything to the discussion.

Re: Indian Programmer Exposes Code Injection, Gets a Cease and Desist from Injectors

#117

Post by wvenable » Wed, Jun 10, 2015, 10:59 PM UTC

shmerl wrote: post #115

wvenable wrote: post #113

Earlier quoted context omitted.

Presumption of innocence doesn't prevent you from having to go to court and defend yourself. However, the DMCA provides safe harbor for sites and networks, essentially removing them from the conflict entirely, if they quickly act to remove contentious materials. Then there is a process by which the two sides actually involved can dispute over the materials can make their case. The DMCA favors copyright complainants b…

> Presumption of innocence doesn't prevent you from having to go to court and defend yourself. That's right, but you have to defend against what they should prove to the court. But @rosser is claiming that it's not even applicable in the civil law. That's really surprising to me (IANAL just to be clear), so I want to understand why.

@rosser is wrong, there is presumption of innocence in civil cases as well (at least in the US). Or to rephrase, the the necessity of proof always lies with the person who lays charges.

Re: Indian Programmer Exposes Code Injection, Gets a Cease and Desist from Injectors

#118

Post by rosser » Wed, Jun 10, 2015, 11:19 PM UTC

wvenable wrote: post #117

shmerl wrote: post #115

Earlier quoted context omitted.

> Presumption of innocence doesn't prevent you from having to go to court and defend yourself. That's right, but you have to defend against what they should prove to the court. But @rosser is claiming that it's not even applicable in the civil law. That's really surprising to me (IANAL just to be clear), so I want to understand why.

@rosser is wrong, there is presumption of innocence in civil cases as well (at least in the US). Or to rephrase, the the necessity of proof always lies with the person who lays charges.

Burden of proof isn't presumption of innocence. Burden of proof always lies with the party making the positive assertion. In criminal trials, that's something like "Shmerl did it, with a pipe, in the pantry" or whatever.

This is why, for example, a criminal defense of insanity must be proven by the defense — and why such a defense is risky. The defense is stipulating to the fact that the defendant committed the act, but arguing the defendant didn't have the requisite mens rea to make their actions a crime. That eliminates the State's burden to prove that they did it, and assumes the burden of proving the defendant's state of mind/lack of culpability at the time.

In a civil case, the question is more one of "Here's why Shmerl is responsible (and, consequently, liable) for what happened." The facts (that Shmerl did whatever, to whomever, at whatever time) are often stipulated to. The positive assertion being made by the plaintiff against him is the degree of liability.

Consider the oft-mocked case of Liebeck v. McDonald's. No one disputed for a second that she bought the coffee at McDonald's, that it was the temperature it was, or that it was spilled. That wasn't remotely the question. Rather, the question was, "Should they have known better, to a degree that makes what happened to her their fault?"

Does that distinction make sense?

Re: Indian Programmer Exposes Code Injection, Gets a Cease and Desist from Injectors

#119

Post by anandpdoshi » Thu, Jun 11, 2015, 12:28 AM UTC

acomjean wrote: post #48

anandpdoshi wrote: post #44

Doesn't using HTTPS prevent such an injection?

I would hope so, unless there is some monkey business with the SSL Certs like the "superfish". A lot of pages aren't https yet though.

AFAIK Mozilla is trying to make https certificates free for everyone.

Edit: Here's the link: https://letsencrypt.org

Re: Indian Programmer Exposes Code Injection, Gets a Cease and Desist from Injectors

#120

Post by shmerl » Thu, Jun 11, 2015, 1:06 AM UTC

rosser wrote: post #118

wvenable wrote: post #117

Earlier quoted context omitted.

@rosser is wrong, there is presumption of innocence in civil cases as well (at least in the US). Or to rephrase, the the necessity of proof always lies with the person who lays charges.

Burden of proof isn't presumption of innocence. Burden of proof always lies with the party making the positive assertion. In criminal trials, that's something like "Shmerl did it, with a pipe, in the pantry" or whatever. This is why, for example, a criminal defense of insanity must be proven by the defense — and why such a defense is risky. The defense is stipulating to the fact that the defendant committed the act,…

> The facts are often stipulated to

But they have to prove that those facts constitute a violation of copyright, don't they? And that's not given, since that should mean they have to prove it's not fair use (since fair use can be viewed as a right). If it's not viewed as a right, then what you said is correct. But how it's viewed is decided by the judge ad hoc (since the law is ambiguous). Or there is some other logic there?