News for hackers. Stuff that matters.
Re:Tainting the CSAM client-side scanning database by nopurpose on Friday October 13, 2023 @11:38AM (#37871803)
what is happening in Youtube world?
Re:Tainting the CSAM client-side scanning database by Macha on Friday October 13, 2023 @12:00PM (#37872057)
People claiming (via manual reports or via content ID) content that is not theirs to either obtain other people's ad revenue or cause the takedown of content they disagree with
Re:Tainting the CSAM client-side scanning database by jabroni_salad on Friday October 13, 2023 @12:00PM (#37872060)
This one happened just a month ago so it might be what the parent comment is referring to. Basically, somebody made a fake company to make bogus copyright claims against someone to hurt their channel. Youtube refuses to deliver counterclaims unless the YTer puts their government name on it (he originally tried to deliver it via an attorney).

Additionally, the other party is actively trying to compromise the YTer's other accounts and identity to damage him, so any new data point given to this person represents risk.

I don't really care for this YTer (they made a video essay about someone who doesn't really want to be in the media circus anymore, could just MYOB) but the methods documented in this video can be used to doxx any user that uploads a video. All you gotta do is convince youtube that you own some piece of common non-royalty media that a youtuber uses to gain leverage on them. A lot of this kind of media is old with unfindable owners, so even if YT does want to spend the time to validate, there's nowhere to go with it.

https://www.youtube.com/watch?v=hixwIOd_C44

Re:Tainting the CSAM client-side scanning database by omscs99 on Friday October 13, 2023 @04:31PM (#37875280)
What I don’t get is this: why does youtube still have such a monopoly after all this time? It’s had a shitty reputation since I can remember, why don’t creators just band together and take their viewership somewhere less hostile?
Re:Tainting the CSAM client-side scanning database by pseudalopex on Friday October 13, 2023 @05:23PM (#37875792)
Many people with YouTube channels are on TikTok, Twitch, Patreon, Nebula also. But leaving YouTube would reduce their incomes.
Re:Tainting the CSAM client-side scanning database by viridian on Friday October 13, 2023 @12:02PM (#37872081)
Not sure if its what the poster above is talking about, but there's definitely a hash collision type attack that's common on Youtube with regards to classical music. The attacker in question uploads very standard renditions of thousands of pieces of classical music, and claims copyright on them. Content ID then flags any video using one of these pieces as potentially violating the rights of the rightholder.

The attacker then claims the video, and claims revenue on the video rather than taking it down. There's an appeal process which seems to work about 0% of the time, and after that the only recourse the uploader has is to submit a copyright counter notification, which becomes the start of a potential lawsuit.

The attackers in question will then typically relent if challenged with a copyright counter claim, but most videos don't get counter claimed once this happened.

This pattern of behavior seems so common that it has led to two interesting patterns of behavior that I've seen.

1) Any video that uses popular public domain music will be claimed not once, but dozens or hundreds of times, because there are so many channels operating this way now, and

2) If you post a video and immediately get hit with a huge wave of claims, rather than going through Youtube's process, most uploaders just delete the video, remove whatever audio caused the problem, and reupload.

Re:Tainting the CSAM client-side scanning database by flkenosad on Friday October 13, 2023 @01:12PM (#37872948)
Wow what a mess. At what point do we move on from copyright laws? Or more broadly intellectual property, in general. Even the words "intellectual property" sound ridiculous together when you think about it.
Re:Tainting the CSAM client-side scanning database by novok on Friday October 13, 2023 @01:23PM (#37873103)
If you think deeper about it, the general concept of property is similarly ridiculous too. An arbitrary piece of land being ‘owned’ is similarly arbitrary human social concept, enforced by law and a registry
Re:Tainting the CSAM client-side scanning database by j16sdiz on Friday October 13, 2023 @01:33PM (#37873209)
Music have no registry. It is much worse than land property
Re:Tainting the CSAM client-side scanning database by flkenosad on Friday October 13, 2023 @02:03PM (#37873565)
Maybe true, but one step at a time IMO.
Re:Tainting the CSAM client-side scanning database by rjbwork on Friday October 13, 2023 @02:46PM (#37874055)
If you're interested in reading about this sort of thing, some fun keywords are "enclosures", "Lockean Priviso", and "monopoly on violence".
Re:Tainting the CSAM client-side scanning database by kelnos on Friday October 13, 2023 @06:28PM (#37876316)
I agree that it's an arbitrary social concept, but it's not ridiculous at all, deeper thought or not. I think it's completely reasonable to expect that my house is my house, and others aren't allowed to enter it or live on my property without my consent. If you think we all should live commune-style and have no property or physical privacy, that's certainly fair for you to believe, but the vast majority of the people in the world would staunchly disagree with you... hence the concept of property ownership.

Certainly there are issues with how we've implemented property ownership, but I don't think the concept itself is inherently flawed or ridiculous.

Re:Tainting the CSAM client-side scanning database by opan on Friday October 13, 2023 @01:46PM (#37873381)
>Even the words "intellectual property" sound ridiculous together when you think about it.

For this reason, many would suggest not using it. It's a vague way of combining the separate issues of copyright, patents, and trademarks. It also illegitimately tries to equate those things to property, which changes how many feel about it.

https://www.gnu.org/philosophy/words-to-avoid.html#Intellect...

Re:Tainting the CSAM client-side scanning database by flkenosad on Friday October 13, 2023 @02:19PM (#37873742)
Thank you for that information. In the future I'll direct my criticism more precisely. To clarify, it is mainly copyright laws I have a bone to pick with. Trademarks make sense. Patent laws sort of make sense in some circumstances, less in others.
Re:Tainting the CSAM client-side scanning database by timschmidt on Friday October 13, 2023 @08:15PM (#37876969)
As we get closer to Star Trek replicators, patent law begins to look similarly inapplicable.
Re:Tainting the CSAM client-side scanning database by gnopgnip on Friday October 13, 2023 @01:19PM (#37873042)
That’s not what a hash collision is.

Uploading popular (public domain) music and claiming you own it is just fraud

Re:Tainting the CSAM client-side scanning database by 0xffff2 on Friday October 13, 2023 @01:40PM (#37873302)
I don't have any direct knowledge of this, but I assume the hash collision comes in because Youtube uses some kind of fuzzy hash, so a generic music performance will flag videos using the same piece of music, but not necessarily the same performance.
Re:Tainting the CSAM client-side scanning database by viridian on Friday October 13, 2023 @02:13PM (#37873670)
I agree that it's not hash collision, but the fingerprinting strategy makes precise language on this topic a bit difficult/tedious.

The CSAM detection isn't proper hash collision either, in so far as I understand it. There's some fuzzy matching formula that generates the fingerprint, it's not simply a byte for byte hash taken of the image, and therein lies the comparison.

The fraud in question is reliant on content ID attempting to fuzzy match audio content, in this specific instance.

Re:Tainting the CSAM client-side scanning database by SAI_Peregrinus on Friday October 13, 2023 @04:43PM (#37875420)
It's a hash, but it's not a cryptographic hash.
Re:Tainting the CSAM client-side scanning database by josephcsible on Friday October 13, 2023 @01:21PM (#37873075)
I wish that willful false copyright claims carried the same $250,000 penalty that copyright infringement does.
Re:Tainting the CSAM client-side scanning database by GuB-42 on Friday October 13, 2023 @02:30PM (#37873864)
That would be ridiculous.

But there are penalties for false claims. There is a fine for claiming copyright you don't own, and if you go further and ask for takedowns, you are also liable for damage.

The problem is that these are rarely enforced. Even a $100 fine for a false claim on YouTube would be enough to weed out bots and click farms. And for the most serious cases, have the infringer pay damage and a bigger fine. No need to change the law for that, it just has to be enforced.

Re:Tainting the CSAM client-side scanning database by Hizonner on Friday October 13, 2023 @02:55PM (#37874140)
> That would be ridiculous.

Why is it ridiculous, in a world where the penalty for sharing a single music file is $250,000?

Re:Tainting the CSAM client-side scanning database by kelnos on Friday October 13, 2023 @06:24PM (#37876277)
That's an argument to reduce the penalty for sharing a single music file, not for making the penalty for a false report also ridiculous.

Then again, I personally do think that knowingly filing a false report of law-breaking should be treated as a very serious crime. I think the harm of filing a false report of copyright infringement is greater than the act of infringing copyright itself.

Re:Tainting the CSAM client-side scanning database by tuhriel on Saturday October 14, 2023 @07:56AM (#37879810)
I mean it should be AT LEAST be handled like a copyright infringement itself. As you propose as owner of the copyright...

For stuff that is actually copyrighted that probably could only be triggered by the actual rights holder.

Re:Tainting the CSAM client-side scanning database by LeifCarrotson on Friday October 13, 2023 @04:48PM (#37875452)
Consider the penalties given for a crime, and compare those to the penalties given when police or prosecutorial or judicial misconduct falsely, incompetently, or corruptly imprisons someone for that crime.

The latter are overwhelmingly more rare, but overwhelmingly larger. Society in general thinks false penalties for crimes are worse than the crime itself.

"It is better that 10 guilty men go free, than that one innocent man should suffer." I think that if the penalty for copyright infringement is $250,000, the penalty for a false claim should be $2,500,000.

You're right that a $100 low-effort, frequently-enforced counterclaim process would weed out ContentID bot farms (just like a $0.01/email transaction cost would weed out spam). But remember that the whole ecosystem is already ridiculous; if the pro-copyright MPAA/RIAA are pushing for $250k/infringement you have to be equally ridiculous to balance counterclaims.

Re:Tainting the CSAM client-side scanning database by LorenPechtel on Friday October 13, 2023 @05:55PM (#37876055)
The penalty for a *knowingly* false allegation should be the same as the penalty for the actual act.

(And, yes, I would apply that to the criminal justice world.)

Re:Tainting the CSAM client-side scanning database by kbelder on Monday October 16, 2023 @02:56PM (#37904442)
Why? I've long thought that, as a general principle, willfully false accusations of a crime should carry the same penalty as the crime itself.
Re:Tainting the CSAM client-side scanning database by pests on Friday October 13, 2023 @02:35PM (#37873930)
It's not even a copyright claim. It's just a process in YouTubes inter al system.
Re:Tainting the CSAM client-side scanning database by Bewelge on Friday October 13, 2023 @03:23PM (#37874481)
I have some, though maybe outdated, experience with that: In 2008, I was 15 and had the idea of creating youtube videos using MIDI files of classical piano songs that had entered the public domain. They're free to use and in theory, videos stay up forever and these classical songs are timeless, so that means after uploading I'd earn passive income forever!

Or so I thought... Every single video was copyright claimed. Youtube falsely thought it was a recording (which do have copyright). The second a claim was created I stopped earning money. I would then dispute the claim, explaining that it's not even a sound recording and they had a month to react to my answer.

In almost all instances the claims were retracted but it would only take a couple of days until another claim would be filed on that video. Answering all those claims took up more time than producing the videos so I gave up after a while.

But in my experience it wasn't really malicious actors filing these claims but youtube's filter simply not managing to distinguish between a recording of a classical piano piece and a well synthesized version of it. I actually remember most claims being filed by Sony.

It's interesting to hear that it's still this way because I don't really believe that nowadays, youtube still can't distinguish between different recordings of classical music. I guess they have no incentive to improve in that regard.

But I think the fact that nobody but the large labels are able to earn money with classical music on these large platforms is actually an excellent argument against upload filters and in my experience it's an argument that non-tech people can much better relate to than hash-collisions.