The RIAA, GitHub, and youtube-dl [LWN.net]

The RIAA, GitHub, and youtube-dl

Posted Nov 11, 2020 23:28 UTC (Wed) by Sesse (subscriber, #53779)
Parent article: The RIAA, GitHub, and youtube-dl

Uh… why is youtube-dl available in the dmca repository? I assumed there was a thing on GitHub where you could ask for any blob in any repo (and it would look like it belonged to that repo, even though it didn't), but that blob didn't work in another random one I tried… is it somehow counted as a fork of youtube-dl, which is why it works?

to post comments

The RIAA, GitHub, and youtube-dl

Posted Nov 11, 2020 23:34 UTC (Wed) by pkern (subscriber, #32883) [Link] (6 responses)

Yup. It's not any random repo, it's that all forked public repositories share the git object storage. Effectively one storage area per project. And apparently making a repo private disconnects you from that.

The RIAA, GitHub, and youtube-dl

Posted Nov 11, 2020 23:41 UTC (Wed) by Sesse (subscriber, #53779) [Link] (5 responses)

And the dmca repo is… forked from youtube-dl?

The RIAA, GitHub, and youtube-dl

Posted Nov 11, 2020 23:45 UTC (Wed) by lkundrak (subscriber, #43452) [Link] (2 responses)

No, but supposedly someone forked the DMCA repo and pushed youtube-dl into their fork.

The RIAA, GitHub, and youtube-dl

Posted Nov 11, 2020 23:51 UTC (Wed) by Sesse (subscriber, #53779) [Link]

Ah, that's a neat trick. Although I thought GitHub had banned the specific blobs, but evidently not (yet?).

The RIAA, GitHub, and youtube-dl

Posted Nov 14, 2020 14:54 UTC (Sat) by k8to (guest, #15413) [Link]

Someone committted the entire sourcecode to the DMCA project via a bug that github has refused to fix as a form of protest of both parts.

The RIAA, GitHub, and youtube-dl

Posted Nov 12, 2020 13:22 UTC (Thu) by jak90 (subscriber, #123821) [Link] (1 responses)

No. Somebody uploaded a clone of the youtube-dl repository and referenced its HEAD in an issue on the DMCA repository, which makes that specific reference from the global object storage available through the "victim" repository. This meant you could checkout the master branch of the youtube-dl repository like this:

git clone -n https://github.com/github/dmca.git youtube-dl && \
	cd youtube-dl && \
	git fetch origin 416da574ec0df3388f652e44f7fe71b1e3a4701f && \
	git checkout FETCH_HEAD

They finally fixed that on October 28th, though.

fatal: remote error: upload-pack: not our ref 416da574ec0df3388f652e44f7fe71b1e3a4701f

The RIAA, GitHub, and youtube-dl

Posted Nov 12, 2020 15:24 UTC (Thu) by pkern (subscriber, #32883) [Link]

In my understanding it still required forking the dmca repo and uploading to that fork. The reference from an issue just made it permanent. Note that GitHub threatened to ban users who keep doing that, according to https://www.bleepingcomputer.com/news/software/github-thr...