Hacker Newsnew | past | comments | ask | show | jobs | submit | throwayws's commentslogin

They are probably too busy fighting against their own users and subreddits that keep them afloat. Too much ideology in there to make sense, business wise.


Planting false evidence is getting a new twist here. The attacker doesn't even have to make a report! The victim's computer does it for him. Disk encryption malware may have new successor. Effective and scalable extortion as a service.


This is a great point. You don't even need to unlock an iPhone to take a picture. So in theory anyone with access to your phone for a few seconds could incriminate you with little effort.


This is already possible today with things like iCloud Photos, Google Photos, OneDrive etc.


Today: "WTF is this?" delete

iOS 15: "WTF is this?" SWAT team crashes through window


This is not true. The check is only against known CSAM hashes.


Just photograph a known bad picture.


Then that's a different photo and will have a different hash.


These aren’t cryptographic hashes. They are perceptual hashes and a picture of a picture could absolutely end up with the same phash value.


is there really no fuzziness to it? If not, can’t this be defeated by simply reencoding the image?


I think it has gotten more sophisticated to detect cropped images and small changes now: https://inhope.org/EN/articles/what-is-image-hashing

The example is somewhat contrived.

If a 'friend' takes your phone and has access to it and then uses it to take images of CSAM similar enough to the original image that it triggers the hash match and does this enough times to go over Apple's threshold to flag the account after these images are uploaded to icloud without the original phone owner noticing then yes it might cause a match.

At that point the match is probably a good thing (and not really a false positive anyway) - since it may lead back to the friend (that has the illegal material).


Or you know, anyone who wants to plant material on a device and has physical access. Say a disgruntled employee before leaving, or ex, or criminal or...

Or anyone who can just text you since imessage backs up to icloud automatically...


While iMessage backups to iCloud, this measure is only for photos stored in the iCloud Photo Library. So sending a text with the photo is not enough.


Are you sure the hash function literally called "NeuralMatch" running on the device with 2+ gen of AI capable chips won't have "collisions"?


Picture of a picture?


I thought an SRE is contacted when your house burns down due to for example scaling and to improve operations where much more load/customers are expected, no? Where the house is expected to fall but where it is not allowed to happen.


No, you bring the SREs in to consult on designing a fire-resistant house before you turn a shovel. Calling them after you've already designed, built, and burned the house is likely to leave you disappointed.


Which is where the push to general AI comes from.


Even assuming this will be a thing one day, you still need an IT team to integrate and maintain this software.


This sounds like an interesting optimization possibility. Do you know will this be patched?


How does it compare to Terraform, which it is based on?


> You make a simple mistake(like looking weak, with no friends or too smart) and you die, it was as simple as that.

Dying is simple, life living is harder.


Reminds me of the Charles Manson quote: "Living is what scares me. Dying is easy."


I actually got the idea from Hamilton, the musical about the founding father. I loved the Washington-character there.


Anchoring the mind ... small thoughts.

Deciding what to focus on yourself instead of the app showing you random screens which the developer thinks are currently important. The tool being out of the way and only the important things in-front of you. Where only you yourself decide what is important.


Yah, I've been trying to articulate this weird like "leveraging of muscle memory" to increase productivity. App and OS UIs can often put too many small hoops in the way that you use some other part of your brain to jump through them. Muscle memory has a way of like bypassing and cutting to the chase and doesn't have this mental cost associated with a context switch if you will. Somehow doing something physical has some tie in with like a "mental background task" that doesn't disturb the "main thread" high level cognitive processes that I want reserved for matters that deserve deep attention.

I wonder if it has to do with the fact that there's a precision of attention in digital UIs just to click the right button and just all the aiming involved though simple actually has a pretty tight tolerance with fine motor skills and large room for error compared to a quick and dirty gross motion you can get away with for things in the real world. Hopefully that makes sense.


https://support.google.com/youtube/answer/9374251?hl=en

> It’s important that creators always have detailed knowledge about who is claiming content in their videos, where it appears, and what they can do to resolve the claim. That’s why all new manual claims will require copyright owners to provide timestamps to indicate exactly where their copyrighted content appears in videos they claim, and we’ve updated our editing tools to make it easier to automatically release a claim.

Is it a bug with Youtube or do they not follow this policy (consistently)?


Disclaimer: I have extensive knowledge about YouTube Content ID (CID) and DMCA notices, but I'm not a lawyer. This isn't legal advice.

He received a DMCA takedown, which is different from a copyright claim. Copyright claiming is a system made by YouTube for copyright owners to easily monetize/monitor reuse of their content instead of having to take down the content. It also allows splitting revenue in cases where one party owns copyright in specific territories. When you put content in CID, it will automatically claim videos and provide timestamps to the uploader. Sometimes CID fails to claim a video, and the copyright owner can then manually claim a video. There was a time where copyright owners didn't have to provide timestamps when they manually claimed a video. Nowadays, all manual claims need to provide a timestamp. Only highly trusted companies have access to CID, and getting a claim doesn't result in termination of your account.

The DMCA is a law that makes it easier to remove copyright content from the internet. It also makes it so that a service provider isn't responsible for the content they host. It is basically a legal action to take down content you own from the internet without having to start a lawsuit.

It works like this: when a copyright owner sends a DMCA takedown, the service provider needs to take down the content. If the uploader disagrees, they can send a counter notification. Unless the copyright owner that filed the takedown files a lawsuit within 14 days, the service provider needs to reinstate the content. You can be sued for damages in case of an incorrect DMCA takedown.

If YouTube would reject a DMCA, it would make YouTube responsible.


If this is related to a DMCA notification, shouldn't YouTube removing the (alleged) video that violates the law, and not delete the whole channel?

I guess that's how Google's index works, they remove indexed results, but not the whole index.


I'm not sure if it's a legal requirement, but YouTube has the rule that once a channel gets 3 DMCA takedowns (without counter notification) within 90 days, it will suspend the channel. Such a warning is usually referred to as a copyright strike (not to be confused with a copyright claim or a community guidelines strike).

One difference between the Google index and YouTube is that links in the Google index can be service providers like YouTube, while the owner of a YouTube channel is always the one responsible for the content.

Something notable that happened here is that instead of bundling the 5 videos in 1 DMCA takedown resulting in 1 strike, the party sent 5 separate DMCA takedowns causing 5 strikes.


> He received a DMCA takedown

Do you have a source for this? I can't find evidence that this is a DMCA notice. Those are fairly straightforward to appeal on youtube which means the next step is court. I don't think this guy got actual DMCA notices.


3:47 in the video


> the service provider needs to reinstate the content

I believe this is may reinstate the content, I don't think they're obligated too. Also not a lawyer.


Reading the DMCA (512(g)[1]) it seems a little more nuanced than that.

The DMCA provides wide protection to the service provider against liability for taking down stuff due to a DMCA notice (e.g. contractual SLA with customers mean nothing). However that protection disappears if the correct counter claim steps are followed, at which point the service provider becomes liable for not providing a service.

Of course with YouTube, they almost certainly have broad T&Cs that let them delete/disable your content for any reason at anytime (it’s not like creators are paying for hosting). So YouTube never had any liability to be protected from.

The net result, YouTube can do whatever they want with your content, and you have little to no recourse.

[1] https://www.law.cornell.edu/uscode/text/17/512


> all new manual claims

It must not be a manual complaint. That's some nice PR-Legalese.


Video explicitly shows it's a manual complaint.


There's a difference. If someone manually claims a video through YT's content-ID system, they have to provide timestamps (this is enforced by Google).

If someone just sends a regular DMCA notice, they're only required (by law) to provide the URL, and Google has no choice but to take down everything at that URL, until/unless they receive a counter-claim from the poster.

The content-ID stuff is a convenience outside the law, if content owners (who have access to it) choose to use it. Anyone can file a DMCA notice, and Google has to respond in a particular way in order to be compliant with the law, and cannot impose extra requirements (like timestamps) before acting on the DMCA claim.


The law also requires that the DMCA notice describes what copyright is being infringed on. [1]

You can’t just go “this video infringes on my copyright, but I’m not going to tell you which copyright”. That isn’t a valid DMCA notice at all.

[1] § (512(c)(3)(A)(i-vi)) https://www.law.cornell.edu/uscode/text/17/512


To quibble a bit, the video shows that YouTube's control panel tells users that a claim was "manual" and doesn't detail what "manual" means, or provide the DMCA notice (which is a written document, fwiw) that was filed, if one was.

I barely trust the information in the logging functions that I write, and those don't have legal consequences attached to providing extra detail.


They don't care, and they don't follow that policy.

Even if that is "just a technical issue", no one cared enough to spend resources to fix their underlying system to reflect that policy.


DMCA notices are not issued by YouTube. I think you're confusing this with Content-ID, which is youtube's auto-algorithm thingy. That's not what happened here, though, per the video.


OP is talking is quoting a support article about manual claims, and how google require these manual claims must include a timestamp and description.

Something that is notably missing from the strikes shown in the video.

GP is saying that their system shouldn’t let copyright claimants just ignore Google’s policy. Which is clearly what’s happened here. Which just further demonstrates Google’s contempt for its creators.


Those are manual claims via YouTube's non-DMCA system. YouTube still has to respect DMCA claims and YouTube cannot impose requirements on DMCA notices. If it's a valid legal DMCA complaint, YouTube must comply. Google's policy is irrelevant here as it's not law.

The point of confusion here is that there's multiple ways to issue a copyright strike on YouTube. If this is via YouTube's internal mechanisms, then yeah this is bullshit. But if it's not and is instead a DMCA notice, and the evidence suggests it is a DMCA notice, then YouTube has no authority over the matter.


DMCA notices must include:

> (ii) Identification of the copyrighted work claimed to have been infringed, or, if multiple copyrighted works at a single online site are covered by a single notification, a representative list of such works at that site. [1]

Now a timestamp isn’t required in a DMCA notice, but a description of the copyrighted work being infringed upon (i.e. a description of what has been stolen, not just a link to the supposed stolen article) is required to make it a valid notice.

In the video, the creator shows an email and YouTube page where Google claims that they haven’t been given a description of the copyrighted work being infringed upon.

If that’s true, then the DMCA notice given to YouTube is invalid, and once again YouTube demonstrates how little it cares about creators.

[1] https://www.law.cornell.edu/uscode/text/17/512


The creator should have requested the notice be forwarded to them for further inspection. We don't have the notice, we just know the details of it were not entered into YouTube's UI.

But given the channel in question, the notice & details are really not a mystery? If you cover a song, and get a copyright strike, is it not fairly obvious what the strike is about?


> The creator should have requested the notice be forwarded to them for further inspection.

How can they request that? Also, it's Youtube's stated policy that all copyright strikes must include the details. Also also, the creator did request the details of the strikes and Youtube didn't provide any.

> If you cover a song, and get a copyright strike, is it not fairly obvious what the strike is about?

No, it's not. There are numerous instances where companies would issue blanket copyright strikes even for content those companies don't have a copyright to [1]. There are instances where there are copyright strikes for silence and for bird noises [2]. Copyright strikes are anything but obvious, even for cover songs.

[1] https://www.ccn.com/youtube-has-massive-false-copyright-clai...

[2] https://www.bbc.com/news/technology-42580523 and https://thenextweb.com/google/2012/02/27/a-copyright-claim-o...


The video explains that these are DMCA notices but the problem is how YouTube is handling them.


How do you avoid getting spam to random addresses using catchall?


I use a subdomain; making your main domain a catch-all will eventually result in a deluge of spam.

Instead of [everything]@example.com, I set up [everything]@yo.example.com. Discovering subdomains is much harder and the one time I encountered a form that didn't like a subdomain, I just made a forwarding address on my main domain.

Using Fastmail's rules, I have a setup where every message arriving to @yo.example.com gets shunted into a folder unless there's a different rule putting it somewhere else.


> Discovering subdomains is much harder...

Is this because you don’t publish MX records in DNS for the subdomains and the default setting on the main domain is to accept only specific addresses (and reject catch-all addresses)?


Personally I haven't been hit with spam to truly random addresses with my catchall. Is that a common issue people run into?

The spam I've received on my catchall is either based on previously breached sites (which I once signed up to) or to very common mailbox names (e.g. postmaster@, info@). I just add those to an auto-reject postfix filter based on the intended recipient, which keeps my inbox very clean.


Years ago I just set up some filters. There's only about 5-10 email addresses that get hammered with SPAM.

Gmail handles the rest.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: