GitHub's 2015 Transparency Report

https://github.com/blog/2202-github-s-2015-transparency-report

by Chris911 • 10 years ago

194 68 10 years ago

github.com

codezero3• 10 years ago

I noticed a bunch of DMCA takedowns coming from UCSD's CSE131 class in the DMCA repo: https://github.com/github/dmca

If you search for cse131 you'll find a bunch of repos still up.

This kind of whack-a-mole is typical of DMCA and requires a lot of resources to manage.

justinlardinois2• 10 years ago

That's interesting. I can understand a professor wanting to control access to the starter code they provide to students, mostly to prevent cheating, but I've never heard of it coming with an explicit license. I know a few of my former UCSC classmates have school projects up on GitHub and haven't gotten any grief about it.

codezero3• 10 years ago

Yeah, I am pretty sympathetic to the instructor (a license is a license after all!), but at the same time wonder if the starter code and subsequent exercises being open makes the course too easy, and/or harder for the professor to grade aptitude, it may be a problem with the course itself.

Bartweiss3• 10 years ago

Speaking from experience, it may not be a professor's concerns. Campus administration occasionally runs amok and specifies licensing and IP standards for individual courses out of fear of lawsuits, producing all sorts of weird results like this.

AdmiralAsshat• 10 years ago

Can you DMCA a student's repo for hosting their own solution to a coding exercise? In programming books, when the exercise is often closely related to the sample code submitted (e.g. "Exercise 3.2. Rewrite the above sample to use a for loop instead of a while loop"), I imagine a large number of independently-derived solutions might look very similar.

codezero3• 10 years ago

I'm not 100% sure. I do know that sets of questions are able to be DMCAed, so solutions to problem sets are likely to fall under that, though IANAL. I have worked for a company that took down answers to such questions in response to a DMCA. Our lawyer pointed out a specific clause that made it risky. In almost any DMCA case, there is some set of case law that backs up one side or the other, and all you're doing is deciding whether you think the content is valuable enough to go to court over to protect. It's usually not worth going to court over :/

To be really tested, it'd have to go to court.

I noticed when searching a lot of solutions were still up for this course, so maybe the solutions alone are OK, and it's only the base code being DMCAed. That said, there is a lot of base code still up too, so it's likely that this person just hasn't come around on their whack-a-mole cycle yet.

lettergram2• 10 years ago

Yes, kinda. At least UIUC did that to students who had libraries from the coding exercises.

For example, the cs225 course provides an image processing library, and you need it for the assignment, so if you put the library in the repo they DMCA'd.

Similarly, many courses give you a framework of code. If you filled in the framework they would DMCA.

They did this a bit, but there was a pretty massive back lash. I don't think they are doing it atm

williamscales2• 10 years ago

Can't one just write new assignments each year? Of course the students will share the answers. These ones are just sharing the answers publicly. You can DMCA all the public repos but there will still be groups of students who pass the answers on to next year's class.

In fact, I'd argue that in the case of the solutions being shared publicly, at least everyone can benefit equally instead of only those who are part of the clique doing the sharing.

The only real answer is to either write new assignments each year, OR, simply assume that all students will have the solutions to the assignments.

A good way to tell if students are really doing the homework is to have a 10 minute homework quiz in class where the students answer a question very similar to a homework problem. Those who have truly done the homework will be done quickly and those who haven't will struggle mightily.

munin2• 10 years ago

Can't one just write new assignments each year?

the budget / resources doesn't exist for that

Fiahil• 10 years ago

As a former TA, I can say that finding out if a student completed a project/exercise on its own is _very_ easy. Poking around the code asking questions for around 2 minutes is largely enough. Instead of DMCA-ting github repos, I find it way more effective to have a five minute talk about what is "cheating" and what is not at the beginning of the semester. Collaborative brainstorming is encouraged, helping struggling others is fine, giving them solutions is not (because you're just stealing their reward).

After a while they would eventually stop looking up solutions and just ask their peers for some advice/code review. My job became surprisingly easy when I started treating students like adults.

ademarre2• 10 years ago

0–249 National Security Orders received?

"we are not even allowed to say if we've received zero of these reports—we can only report information about these types of requests in broad ranges"

Interesting. What are they really telling us with that range? Could they not get away with saying "1–249"?

Edit: Nevermind. The document they cite[0] clears it up.

[0] https://www.justice.gov/iso/opa/resources/422201412716042240...

icehawk219• 10 years ago

I believe this is what the security canary used to be that companies would use to skirt the rules until the rules were changed. It used to be that you couldn't say how many you received but you could say you hadn't received any. Now you aren't even allowed to say that.

petercooper• 10 years ago

How does that work then? If I were American (I'm not) is it illegal for me to simply say or publish the sentence "I have received no National Security Orders"?

Bartweiss3• 10 years ago

Since when?

Last I heard canaries were still going strong, although they're generally limited to one bit (letters: yes or no?) rather than any more detail.

schneidmaster5• 10 years ago

No, nothing has changed on that front. If you have not received any National Security Letters, it is legal for you to say "I have never received an NSL" (as other commenters have suggested). Warrant canaries rely on the idea that it is much more legally difficult to compel speech than to restrict it. There is no (non-secret) case law indicating that a NSL recipient could be compelled to lie and include the warrant canary paragraph in a future transparency report, while there is case law indicating that NSL recipients can be prevented from actively disclosing the letter (gag orders are fairly well-established in particular aspects of our legal system).

The reason why warrant canaries are binary is that once an NSL has been issued, the case law that the parent commenter linked comes into play: companies may only indicate in buckets how many they have received (0-249, 250-499, etc). So you couldn't have your warrant canary say "I have never received more than 3 NSLs" then "I have never received more than 5 NSLs" etc.

tibbon2• 10 years ago

This confuses me too. I am allowed (as a private citizen or company who has never had an interaction with the feds) to say that I've had zero reports/requests like this right? Or is just uttering that a federal crime (did I just fuck up by saying that?)

It would seem that it's perhaps illegal to say anything once you've gotten at least one of them, and they tell you that you can't do this anymore right?

ChristianBundy• 10 years ago

IANAL, but I believe you could say "I've had zero" until you get one, at which point you can only say "I've had between 0 and 249".

anonicode• 10 years ago

Edit: Nevermind. The document they cite[0] clears it up.

That didn't exactly clear it up for me. Would you mind saying how that clears it up? Does it really mean 1-249 after all?

espadrine• 10 years ago

It means in bands of 1000 starting with 0-999.

euyyn• 10 years ago

Yes.

ademarre2• 10 years ago

I still don't grok the dos and don'ts of NSLs and canaries, but that document establishes the origin of the range 0–249, which is expressly permitted. See also: https://canarywatch.org/faq.html

I suspect they would not be using the 0–249 band if they were not gagged by a previous order. My uninformed interpretation is that they have received an NSL or FISA order, but not necessarily in 2015. So the 2015 number might be zero after all.

Maybe someone more informed could confirm or debunk this interpretation.

jnewland• 10 years ago

While we're here, http://www.nytimes.com/2015/03/31/technology/china-appears-t... also happened in 2015. Not a legal request to remove content, per-say, but something...slightly different.

biogeneration• 10 years ago

Does anyone have any idea what happened with all of the DMCA takedown requests in September?

zardeh• 10 years ago

Among other things, someone sent 20 requests for removal of their fonts (each request contained numerous files), and jetbrains requested the removal of ~500 product keys from across GH.

voltagex_• 10 years ago

It looks like JetBrains got a whole lot of keygens removed, plus one poor person's Hadoop demo code (which happened to have a filename of keygen.java).

embiggen• 10 years ago

At least they still publish it. That's worth something, right?

ghettoimp• 10 years ago

Since nobody else has mentioned it, let me just point out that it's really great that Github is taking the time to compile and publish this kind of information.

mtgx• 10 years ago

The FBI is trying to make it easier to give out NSLs as well:

http://www.wyden.senate.gov/news/press-releases/wyden-places...

Contact your Senator/Representative if you don't want that to happen. Even though a similar amendment failed in the Senate last week, it was a close call.

Also, next there they are supposed to vote on the renewal of the FISA Amendments Act, and I'm sure they'll try to further expand their spying powers some more then, too.

ryanmarsh• 10 years ago

Oh my god the "fast die" take down request from Russia. Is that a real business?

https://github.com/github/gov-takedowns/tree/master/Russia/2...

http://fast-die.github.io/

ComodoHacker• 10 years ago

You mean request or Fast-Die? The former is a real business. The latter is an example of trolling of Russian internet censorship agency.

danbmil99• 10 years ago

I don't get why employees don't leak the real stats anonymously. Perhaps companies should not try so hard to compartmentalize this information - trust 40 or 50 key people, enough to spread suspicion and enable plausible deniability.

When a law is clearly unethical, don't work so hard to abide by it.

anchpop• 10 years ago

The government could easily prevent that by punishing the company whenever there is a leak, instead of trying to punish the specific person. This may be what they do already

nitrogen• 10 years ago

Unfortunately (or fortunately?) not everyone cares whether their actions harm their employer.

olalonde• 10 years ago

If the stats were leaked anonymously, how could we tell it was a legitimate leak versus some random troll?

hartator• 10 years ago

0-249 for national security orders. I think it's safe to assume 249.

mod• 10 years ago

If you read elsewhere in the comments here, you'll see that it's not a safe assumption at all--"0-249" is the specificity allowed by the law.

Your assumption was also my own until reading here.

Sir_Cmpwn• 10 years ago

If any GitHub folks are watching this thread: please sue the government for the right to disclose the number of NSLs you've received, or better yet to have NSLs declared unconstitutional in general.

nsqe• 10 years ago

Twitter's already suing the federal government for the right to disclose NSLs. In March, their lawsuit was dismissed. However, the EFF is still working on it...

https://www.eff.org/deeplinks/2016/04/disappointing-ruling-n...

http://thehill.com/policy/technology/278448-judge-dismisses-...

GitHub's 2015 Transparency Report

Related Stories