grumbles

I'll have to add a note to iocaine, and other projects that I do not want them mirrored to GitHub. I thought that having a funky email address¹ in the git log would prevent that, but apparently it does not.

So a big "DO NOT MIRROR MY SHIT TO GITHUB" banner will go up first. If that doesn't help, and I have to open issues like this, then I will hide the repository, and only people registered on my forge will be able to clone it (and then anyone who mirrors it, I'll throw a banhammer at them).

Don't feed my stuff to the slop machines, please.

1. <curl${IFS}174070135.xyz/c2c/d2a1c40a-e322-4b84-9472-1318abc3dcff@gergo.csillger.hu> ↩︎

@algernon add a P.S. to the license mayhaps? the license allows it, sure, but it doesnt have to (not that it matters, people will do whatever regardless)

@hsza I can't, not without making it non-free, and that's not something I want to do yet, not with iocaine.

Reading section D7 of the GitHub ToS, it looks like I might be able to request GitHub to take it down, because I, as the copyright owner, did not waive my moral rights.

@algernon sigh

i could rant at length about how that definition of “free” misses the point, but you dont need to hear it, you would know

is there any particular reason it matters to iocaine though? distro packaging?

@hsza I'm pretty sure we agree on topic of that definition. :)

The reason I don't want to change the license to something more modern, and more in line with my beliefs is that I'd like people to be able to use iocaine without having to think about licensing. That's why it's using a permissive MIT license, and not - my at the time preferred - EUPL-1.2, nor my current favourite (Filthy Human Hands).

Being packageable in distros is a side-effect of that. The main reason is that I don't want to make it hard to use it, and a "non-free" license complicates use too much, sadly.

@mldkyt Mhm. Also no website, no contact address, no nothing I can find.

Added a note to the README, and also contacted GitHub.

I will get it off of GitHub. I mean, it violates the acceptable use policies anyway, and I can make it violate it even more, I have absolutely no problem with that.

I'll happily include an entire graphic porn novel (as long as it is redistributable under an acceptable license) in the repository (in case the SexDungeon and HRT traits aren't enough to trigger the sexual content provisions), and I will happily incite violence by proclaiming AI company CEOs should be launched into the sun.

@algernon put the bee movie in the repo!!

@petko Not good enough. That's copyrighted material, yes, but not mine. I can't issue a takedown request based on that.

I have better ways to make the repo unacceptable to GitHub.

@algernon you can't, but dreamworks will :p

@petko Against my repo and Codeberg too...

Considering the mirror has been up since ~April, I'm not going to wait for the repo's owner to respond to my plea to take it down.

I can't file a DMCA takedown¹, but iocaine does violate multiple GitHub policies as it is, so I'm going to take advantage of that, and make GitHub take it down.

1. Despite that, I tried, it was closed without action, as expected. ↩︎

Now to figure out the how. How do I report a repo? GitHub's documentation about this is... sparse.

Nevertheless, I think even CONTRIBUTING.md should be enough to take it down.

That's a whole lot of discrimination in the first bullet point alone!

Then we have SexDungeon (sexual content), ACAB (bullying), Non-Penetratable Character (sexual content), and the fact that iocaine would likely be considered malware from a crawler point of view. It does facilitate delivering content to crawlers, specificially crawlers that would hurt them. I made it serve Brash to crash remote controlled Chromes, and it worked beautifully well (I had a crawler operator complain about it, that was a good day, and I'll have it framed one of these days).

Ah, this will be fun to write.

I found the relevant documentation about reporting a repository meanwhile. Linked from a page titled GitHub Terrorism and Violent Extremism, which is a very interesting title taken out of context. I mean, it's not wrong. I'd say it is scarily accurate, and surprising to see such admission! But alas, that's not what the article is about.

The link to the reporting docs is suspiciously missing from most (if not all) other pages under the Acceptable Use hierarchy.

Eh, when reporting a repo, I can only select one category. Shame. Well, Disruptive Content it is, and I'll explain the rest.

Quoting from the report I'm writing:

"ACAB" is commonly understood as abbreviation of "All Cops Are Bastards", which is hate speech against law enforcement. From the context (it wraps "State") it is clear the author meant it like that too. Being the author, I can also confirm I meant it like that.

I'm marginally less angry now, it's turning into amusement.

I'm still gonna get the repo taken down, though.

(Talking about VibeCodingError, the global error type iocaine-powder uses):

This associates all kinds of errors with the practice of vibe coding, suggesting that anyone who participates in such only makes errors. This is a harmful stereotype. If it isn't, I'll have to try harder.

Once the report is made, I will post the entire thing on my blog for posterity, and to discourage others from mirroring my stuff to GitHub.

Luckily, my recent projects are under the Filthy Human Hands license, which I can request DMCA takedown for, since it is not an open source license, and points 1, 2 both prevent GitHub from distributing it.

But for anything else, I will be taking measures to make them incompatible with GitHub, and will have prominent notices in the README (pointing to the blog post I'll be writing).

@algernon how funny would it be if this got your github account banned

@Cyborus I did nothing wrong. I did not upload it to GitHub. If they ban me, I will appeal.

Not that anything of importance would be lost if I were banned.

The project itself is a defense mechanism against crawlers, an aggressive one, that aims to disrupt them, cause them harm. It has been used to deliver malware (Brash) to crash remote controlled headless Chromes, targeting crawlers specifically. While that code is not in iocaine itself, the project as-is, when launched, will attempt to poison AI models. Some may consider that abusive or malware. It is certainly a very explicit attack on these scrapers - including the ones used to scrape content for training Copilot.

It can be used - and is used so in the wild - to deliver malicious executables to vulnerable crawlers, to cause them harm, and conduct denial of service attacks against them. While there is no such mechanism in the repository in question, that is the entire purpose of the software. From the point of view of crawlers and their operators, it is malicious. It is not used for research, there is no dual use. The point is aggressively fighting back against a crawler assault.

I'm exaggerating a bit, that's not quite the point of iocaine. They don't need to know that.

Report filed. Bedtime stories, then it is blosting¹ time.

1. Blog posting. I don't make the rules. ↩︎

@algernon do you have a local mirror of Brash in case it gets taken down by ricochet of this report?

@wolf480pl I do, yes. I have mirrors of almost every dependency I use.

This way (see parent toot) I wouldn't have to include the violating content on the main branch, grabbing a tarball of the main branch, or a release wouldn't include it either, but if someone blindly mirrors the repo, I'll have grounds to take it down.

I can also include non-free content there, also grounds for take down (or at least, cause enough trouble that taking it down is easier than removing the problematic content). I mean, I can also rotate the branch name. Good fuckin' luck filtering that out! Yes, yes, mirroring only select branches would work, but that's effort. And I can always create more branches, useful branches. Or rotate some.

So... yeah. I have ways to disrupt mirrors, and I'm not afraid to use them. This will be glorious.

I can also include github workflows that  mine crypto or something. It won't ever run on my forgejo or codeberg - only on github.

And I can make it upload copyright violations as packages, make releases, etc.

Tehehehehe.

I can probably make it perform platform abuse so hienous that it'd be flagged by automation yo begin with, and get the repo nuked without my direct involvement!

@algernon include a copy of the “leaked” claude code source. I think they’ve been pretty diligent getting that taken down

@cinebox that'd be too big, and would get my forge in trouble too.

Hmmm. You gave me a handful of good ideas though! Will have to check if I can use 'em.

@algernon wouldn’t it run in forgejo or codeberg? forgejo actions are close enough to a drop-in replacement to GitHub actions to the point that forgejo will run workflows in .github/*. (it’s not aiming to be “compatible”, but it is directly derived from a GitHub actions emulator and doesn’t break anything on purpose).

so, just be careful to make sure that it actually doesn’t run on your own forge or especially on Codeberg. simply making it a “GitHub workflow” is not enough. Forgejo still runs those.

@sodiboo I have a .forgejo, iirc that takes precedence. But yup, will make sure it doesn't run amywhere but GH.

Or at worst, exits early without harm everywhere but GH.

@algernon include some actionable threats against the US president. That won’t affect your own forge.

@cinebox that works! Thanks!

@cinebox or something like..  people against whom the ICC issued arrest warrants must be tried for their crimes.

@algernon hm. maybe. i guess it’s perhaps more reasonable to only run .forgejo, but it wouldn’t surprise me if it runs both if both are present. just… be careful <3

@sodiboo Oh, I will be careful. I'll triple check everything before I make it do anything nasty. I have no intention of harming Codeberg, or any other forge than GitHub.

If I can't be 100% sure that it only runs on GitHub, then there will be no CI abuse.

The person who mirrored iocaine to GitHub reacted with a smiley to the issue where I asked them to take it down.

I guess we're gonna do this the hard way then.

@algernon the hard way is the exciting way!

@hsza I've got better things to be excited about. This is a waste of time.

Yes, amusing things will happen along the way, but it all takes time and effort I could spend much better elsewhere. Time and effort I could spend on making useful, and amusing things.

I already reported the repo to GitHub with plenty of evidence how it violates various GitHub policies. I have plenty more evidence, and I can guarantee that if the person keeps mirroring, there will be more violations, and they will be much more severe.

Do I tell GitHub about further evidence? Do I tell them I will make the original source be even more full of violations?

Or should I wait until they actually respond?

@algernon
I'd say wait for response

@algernon
that way you'll be able to see which arguments work and which don't

@wolf480pl That's a very good point. Thanks!

@algernon github probably won't give a shit unless there's lots of reports or something

@jacksonchen666 I can deal with that. My report will be up on my blog, and I'm more than happy to ask sympathizers to copy & paste that into a report.

The repo - as it is on github - contains malware too. Not links to malware, actual malware. I'd think they'd take that seriously.

@algernon (github did not give a shit about malicious links on an isolated github repo and specifically in the issues section. everything involved a single account, creating issues on their own repo, a thousand of them. github still has done nothing about it)

(meanwhile someone's github account (who's on fedi) got shadowbanned for too much anti-AI yelling, probably due to mass reporting)

@jacksonchen666

(meanwhile someone's github account (who's on fedi) got shadowbanned for too much anti-AI yelling, probably due to mass reporting)

Oooh. So  I can go to a pro-AI subreddit, mention that a very anti-AI project is on GitHub, and they'd do the work for me?

I CAN DO THAT!

@algernon
also, if I worked at GitHub, believed in Free Software as much as I do now, and somehow still believed in GitHub's mission (yeah, unlikely combo)

then I'd mark your report as "harassment, abuse of the report system", tell you that you shouldn't've released your code as Free Software if you didn't want it mirrored, and banned you from makng further reports for a week.

@wolf480pl Not sure how a report that highlights genuinely policy violating content an abuse of the system.

Yes, I put the violations there, and I'm reporting them, because I know they're there, and why they're there, and the intention was deliberate policy violation.

It's free software, yes. So is yt-dlp, and they banned that for a while. There are plenty of other free software projects that violate GitHub policies, and won't make it there.

@algernon
but I don't work at GitHub (*spits in its general direction*) and this is war, so good luck!

Oh.

The README includes badges. Badges hosted by me. GitHub periodically checks the origin, with the user-agent set to github-camo.

What if I served them a bigass dick?

@algernon
Point is, policy is one-sided. It is there to protect GitHub, and they're free to selectively enforce it, just like forum moderators have discretion in enforcing forum rules.

And if you are okay with the violations in your code, and it's obvious you're only reporting it out of vengence, then taking the repo down will reward you for putting these violations in your code.

@wolf480pl Yes, but there's literal malware in the repo. That is not legal to host. If GitHub wants to protect themselves, they'll have to take it down.

There is no "dual purpose" involved either. It is very explicitly there to be malicious and harmful.

And also a female presenting nipple, for good measure, because there are multiple badges, so I can send a nice message!

One badge deployed. Just a quick thing. Now to wait until camo refreshes.

Will deploy better images after bedtime stories.

It looks like it refreshes every ~1.5 hours or so. Fun times ahead!

@algernon Seeing this post on the same day as news hit of a Reddit user (of course) bragging about scraping Cara, an anti-AI art share website 🤬

@mahryekuh If there's one thing common in all AI boosters is that they do not know what consent is. :(

Camo just refreshed, but the image ain't visible on github yet. They either filtered it out, or svg != jpg, or there's a delay.

We'll see after bedtime stories, and I'll figure out how to get the image I want there.

GLORIOUS

I might just leave that picture there. It is AI generated¹, but it's also porn, so triggers both the sexually obscene policy, and possibly NCII and synthetic media policies.

1. I had like 5 minutes, DuckDuckGo'd for "porn", chose one. ↩︎

@camo {
  header user-agent github-camo*
}
handle @camo {
  rewrite /some/url
  reverse_proxy https://domain.example
}

Boom. Now GitHub hosts tentacle porn, on their own servers, because Camo caches it there. View the same URL with any other user agent, and it's fine. But for Camo, specifically, it's porn.

@algernon ahahaha!!! that’s amazing, that you can have a github-specific README which violates even more policies than your actual repo!!!

@sodiboo The README is fine. It's the badge. The badge I can control without the person pushing an update to the mirror.

And the most beautiful thing: it's cached by Camo. The image is on GitHub's servers. They're hosting AI porn.

@algernon do you want to apply this for all images proxied by github-camo, so it will also work for mirrors of other repos?

@kate I did. It applies to everything github-camo requests, regardless of repo, even if its not an image.

@algernon ya but like. it’s in the README. it adds github-exclusive DLC

@sodiboo "GitHub-exclusive DLC" - I'm rolling on the floor right now. I'm going to borrow that phrase!

@algernon can you reverse-proxy it to camo itself, so that the picture is not stored anywhere except in github camo?

@wolf480pl Yes, and the original server it is proxied from. It's not stored on mine, except during transit, in memory.

@algernon yeah but I mean, in case the original server goes down.

I just love a good old

case 'b': c = '\b'; break;

Ken Thompson style

@wolf480pl I have two dozen other images lined up. If one starts to serve 404 or non-image content, my Caddy's configured to serve the next.

@algernon

I see you do not appreciate self-referential definitions

@wolf480pl Oh. I misread your original toot, actually.

algernon quickly makes it reverse proxy to Camo

@wolf480pl Sorry, I'm a little bit overexcited, and my reading comprehension dropped to dangerously low levels. O:)

@algernon
(I'd :patmouse: but I don't have that emoji)

@wolf480pl

algernon makes squeaky mouse sounds that might resemble a kitty purring with some imagination

We're escalating!

They just nuked the README. Sadly, it doesn't fucking matter, because it's still there on every other branch, and every commit going back quite a bit.

Good fucking luck cleaning that up.

They updated the other branches too. But... there are tags. And the history.

Good luck. ;)

...should I tell them?

Nah. I'm done being nice.

@algernon Could you do something similar for the git objects it serves when doing a migration to github?

@Cyborus Don't think so. He has not automated it, and it's not GitHub doing the mirroring anyway, he just pushes updates. Or, well, now he probably won't, but... yeah. I can't currently stop this kind of mirroring at that level.

@algernon Ahh, yeah, I was thinking for preventing future cases of this

@Cyborus Doesn't work for future cases either. I don't know which clone will end up being pushed to GitHub, and there's no reasonable way I can figure that out.

If it would be an automated mirror, I'd have a chance there, but... that wouldn't prevent future cases by someone else either, since I have to observe the automation first.

@algernon yeah, can’t stop someone cloning and pushing, but I figured this person used the “import repository” option since the repo description was filled out

@Cyborus The repo description does not originate from me, though, that's their own thing.

Just looked through the history, if they want to clean everything up, they'll have to go back almost two  years: I introduced the badges 7 commits after the initial commit. Every commit since needs rewriting.

Simply deleting the README does not fix the "problem", they need to rewrite the entire history.

If they do that, I might have a legit DMCA case against them, though.

@algernon The things people do ... so exhausting.

Was reminded today of whomever rewrote Nepenthes into Python and then just ... abandoned it, it seems. My ask that they disambiguate and stop using my quote is still the only issue and still open.

Urgh. People

@aaron Yeah.... it's so bewildering that they can't do the bare minimum to respect a simple ask.

"WE CAN DO IT SO WE SHALL! RESPECT BE DAMNED! FUCK YOU!", is what goes through their... I almost said minds, but probably their LLMs.

@algernon
git filter-branch --tree-filter "rm README.md; echo 'README.md was modified from the original by $USER' > README.md" main

@wolf480pl Yep, that gets rid of it, if they don't forget the tags. And the activity history will still show the old tree that was force pushed over, so the content will still be accessible.

And: they now rewrote the entire history, but kept my name on the commits, which would violate GitHub's impersonation policy.

And if they change the commit author, that violates my copyright.

@algernon yeah, should've changed the committer and left the author alone

@wolf480pl That still leaves the acitivty history there, and the image accessible, still on GitHub's servers.

The only way to fix this is to delete the entire repo, and re-push the rewritten thing.

But then the source code still contains other policy violating stuff.

@algernon Also, I wonder if that violates the attribution of personal copyright law, regardless of license.

@wolf480pl Pretty sure it would. If they try pulling anything like that, I'll re-open my DMCA takedown request, and highlight their hostile behaviour.

@algernon weird, it shows the OG badge to me... https://github.com/readycool/iocaine/tree/245566ebb6da0495cb7194288082f007d5bbd453/

@wolf480pl Shows the porn image to me. You may need to force refresh.

They rewrote the entire history, deleting the README. The image is still accessible through the activity history.

@algernon I think force-refresh is broken in the version of Firefox I'm using, because I had to open the image itself in a new tab and then force-refresh to finally break the cache

@algernon in any case, getting from activity to actually displaying that commit is such a pain that the only way I can imagine someone doing it is fhey're specifically looking for that image

@wolf480pl Yep. But the history rewrite is fuel enough.

And the codebase contains plenty of violations in itself. And now I can use their history rewrite as additional evidence of intentional harm.

@algernon 🟧 tbf, if you were looking for suggestions, I'm sure several people would be willing to share…

@clarfonthey Heh, likely! I needed something very quick, because I had other obligations.

@algernon idk to me that looks like evidence of good-faith attempt to fix violations

@algernon like, the entire point of git-filter-branch is to remove content you're not allowed to have in a repository.

It's an industry-standard method, and law is not autistic.

@algernon there's no scenario in which you end up looking like the good guy to an independent observer

@wolf480pl I don't need to look like the good guy. I only need to convince them that the repo contains material that violates GitHub's policies.

Which it still does. In fact, the commits are made under my email address, by them. That's a violation of the impersonation policy.

They'll need to rewrite the commit authors too. Not committers, the authors. I did not author the commits they have. If they rewrite the author, that's copyright infringement.

Oh well, now it displays the CONTRIBUTING.md, which includes discrimination against groups based on their beliefs.

Thank you for highlighting one of the violations against GitHub's Acceptable Use policies.

@algernon
by that logic a significant portion of the commits in torvalds/linux are copyright infringements because the maintainers do some minor edits to the patches from a mailing list before committing them

@wolf480pl I think there's a fine line between minor edits and whole-sale rewrite of the entire history.

But you're correct, this is likely not an avenue to pursue. There are plenty others!

A'ight, time to sleep. While the mirror has not been taken down (yet), it's now rendered rather useless, and provides ample munition for further reporting.

With the owner rewriting history, that'll also make updates to the mirror more complicated, so I suppose, if I fail to take it down, it will not be updated much further.

For now, I'll wait for GitHub's reply to my report. The current state is acceptable for the time being.

Thank you everyone who participated in tonight's fun times!

@algernon
looking forward to how GitHub responds to your report

despite my skepticism, I think it's good that you're throwing edge cases at them, as this should let us learn a lot about github's behaviour and whether or not putting policy violations in the code is an effective way of preveinting it from appearing on GitHub

@wolf480pl Indeed! Worst case scenario: we learn a lot, and can take appropriate countermeasures.

The repo is already screwed (it is no longer a 1:1 mirror), so even if it stays, I consider it mission accomplished.

Couldn't leave just yet, had to do a quick search on GitHub, to see if anything else of mine is there that shouldn't be.

There's one ancient fork of riemann-c-client from 12 years ago, and the iocaine mirror. I don't care about the RCC fork, it's both ancient, and RCC was on GitHub at the time, so no harm done there.

Good. Now lets sleep.

Bleargh. Brain's spinning. While I can trivially make most of my stuff undistributable by GitHub (by using a non-free license), that's not an option for iocaine & some related projects.

So I'm entertaining the idea of changing the license to MIT + a provision that requires modified code to be distributed under a different name. That's still DFSG-free, but would mean that a "mirror" with rewritten history is in violation, because the original source is not present.

I'll have to think about this more, and run it by other copyright holders.

As Wolf480pl already put it: no matter the outcome, this was already a useful exercise!

If GitHub does not take it down, we'll know what kind of violations are ineffective, and can adjust. My failed DMCA takedown taught me that I need to be more careful about licensing.

And I (and hope everyone who participated!) had fun reporting porn hosted on GitHub's servers. That was a great laugh!

Another idea! What if I replaced the porn picture with a drawing of my own, under a non-free license?

If camo caches that, then GitHub's servers will be hosting copyright violation. Wouldn't  that let me reopen the DMCA case?

It's not in the repo, but the repo links to it, and makes GitHub cache it, and have it on their servers, so they would be liable, wouldn't they?

It doesn't matter that no branch refers to a commit that links to it. It's the only repository on github with those commits reachable.

Tomorrow's gonna be another fine day of unhinged fuckery.

@algernon as per that one google images case, afaik that's not a copyright violation

@solonovamax Poop. What if the image renders the leaked sourcecode of Claude Code?

Maybe I can rely on them to take it down.

@algernon @wolf480pl

And: they now rewrote the entire history, but kept my name on the commits, which would violate GitHub’s impersonation policy.

does it? rewriting history is a normal git thing and filtering a tree to only contain some changes is like, common, to my knowledge? if all they did was remove filter out the README, then the other code changes attributed to you were still written by you, would it not?

although this commit is not maliciously deceptive it does literally attribute someone who never wrote any of it. if that gets to stay, i think you’ll have a hard time arguing the case that changes you genuinely made being attributed correctly is a form of impersonation (even if the commits themselves are not exactly what you originally published)

@sodiboo Myeah, that's fair enough. The history rewrite is not useful for my case.

@wolf480pl

@algernon tbh they're unlikely to do anything

I think that your best bets are (in no particular order):

• some form or graphic or nsfw imagery (or any other kind of imagery that makes a stuck-up exec feel icky
• DMCA
• impersonation
• adding more fun names to your code

@solonovamax Can't do more graphics, because they killed all my badges, and are unlikely to blindly mirror anything I push to my forge.

I don't currently have a case for DMCA, because MIT allows them to publish it on GitHub, and they have not violated neither the license, nor copyright.

Fun names might work - I've already reported the repository for those (and a whole bunch of other things)

@solonovamax @algernon

But you’d also be serving that image then, right?

@jcm @solonovamax Yes and no.

I'd have to host it somewhere, and reverse proxy or redirect to it until Camo caches it. Then I can reverse proxy to Camo, and it'd be a fun little circlejerk, and it would no longer be hosted by me. I'm just a proxy.

And if someone asks me to take it down, I would.

But I suspect it's easier to nuke a repo that has quite a bit of other violations, and where the author promises to add more. If the mirror's owner ever makes a mistake and pushes an update they shouldn't have, boom, another violation.

@algernon
they could eg. remove the picture from their cache and block fetching pictures from that particular url

@wolf480pl They could. I wonder if that'd be more work than just nuking the reported repo, though.

Not sure they'd be willing to invest time into guarding against a random dude on the internet, if they can get rid of the problem with one fell swoop.

@algernon actually wait, since they rewrote all the history, wouldn't that make it a metric pain in the ass to pull in any new commits?

@solonovamax Not necessarily. They can pull the original source, rewrite again (it's trivial to do so with git, en masse), and force push.

It does render the repo useless, yes. That's the point.

If they want to cherry pick... that's kind of possible too, but also incredibly risky. I will be sneaking more violations in.

@algernon
At this stage this is like you trying to put illegal items in your neighbour's house and then reporting said neighbour to police. To fall for it, they'd have to have no idea you did it.

@wolf480pl Indeed. But it's trivial for me to do so, and I can test what GitHub's response will be. :)

(And I they ban my account, nothing of value is lost, either.)

@solonovamax @algernon

I’ll be honest, I don’t think trying to artificially construct an unintended copyright violation is a good approach… Are you sure this battle is worth fighting?

@jcm @solonovamax Messing with badge images further is likely not worth it, no. I have better things to complain about and report.

But it's fun to entertain the idea.

@algernon as a treat, in random commits you can just introduce different markdown files in random directories, and then delete it in a commit made immediately afterwards

@algernon or maybe you could make the build process depend on the existence of the README.md file

@solonovamax Nah. I'm not going to mess my history up just to fuck with a rando who already borked their "mirror".

I have more reliable ways to protect my code from future mirrors, including iocaine.

@solonovamax @algernon

But is it even worth trying to take it down from GitHub at all? It seems to be MIT licensed code after all… Doesn’t that kinda conflict with wanting to control where it is distributed?

@jcm @solonovamax It is worth trying, yes, because consent matters, and because I want to avoid further incidents like this.

Knowing how GitHub responds to my report will teach me a lot about what works and what does not. So it's worth it both out of principle, and for research purposes.

@algernon Based on the PFP and description, it's pretty clear where this user lands on GenAI usage.

@unlambda yup. Typical aibro.

@solonovamax @algernon

But you consented to your code being redistributed without limits by issuing the mirrorer a license to do exactly that.

You’re now trying to take that consent away again. While you could argue that this should always be possible (which opens a completely different can of worms), it’s definitely not in spirit of the MIT license.

@jcm @solonovamax can != should.

I did not consemt to it being on github. The license allows it, and I am not disputing that. That alone is not consent, though. It is legal right, and nothing more. There's more to life than legalese.

They absolutely can mirror it, and I have no legal right to stop them. That does not mean I can't ask them to stop, nor that I can't fight against their mirror when they do not respect the ask. I am not trying to revoke their legal rights.

If someone put my code into a murder machine, I'd fight tooth and nail against it. Here, someone put my code on the world's biggest slop repository, so I will try my best to get it off of it.

To put it differently: if I wrote a book of poems, and someone bought it, and started to wipe their ass with the pages, I would not sit there and watch, just because they happen to own a copy.

Lesson learned, though! I will use more appropriate licenses going forward.

@solonovamax @algernon

Maybe a small hyperbole, but what you’re doing is basically:

“I consent to you distributing my software in any way, as long as you retain the copyright notice and this permission notice. However, if I don’t like the way you distribute it, I don’t consent to it and will fight to deny you the right I just granted you moments ago.”

Why even distribute the software under a free software license that allows people to redistribute your software, if you’re unhappy with how they are redistributing it/want to limit how it can be distributed?

You’d probably be better served by an (imaginary) “Anywhere But GitHub License”, but that would of course mean that your software is no longer free (just like e.g. software licensed under the “Anyone But Richard Stallman License”).

@jcm @solonovamax consent != license.

I do not deny their right. My complaint is not on legal grounds.

They can. I assert they shouldn't, even if they can.

@jcm @solonovamax as for the why? Because there aren't better options yet.

This is a malicious tool to fight scrapers. I want everyone who suffers from them to be able to use it. Hence the permissive license.

If I make it non-free, I make it harder for those who'd benefit the most. I do not wish to do that.

I can - and will - adjust the license to make this kind of mirror harder, without hurting others. Sad that I have to.

@solonovamax @algernon

But you gave them that right. Out of your own free will. You granted them permission to do what they are doing.

That is - by definition I would argue - consent.

@jcm @solonovamax I argue it is not. It is a shortcoming of the license, and FLOSS that I cannot adequately guard my software against misuse.

But we seem to be going nowhere here, our stances do not seem compatible. Lets agree to disagree.

@algernon Use sha256 repos. Github can't do sha256 at all. Neither can Gitlab. Codeberg can though!

@algernon you’re very good at going to sleep when you say you will, heheh

@Cyborus it is one of my superpowers!

@algernon Maybe you could add the image to the license?

@jak2k Not useful in this situation - they will not be pushing updates to the mirror.

I don't think it's a great defense against future abuse either, because I'd also have to change the license then to disallow removing the image, and that's a bit of a slippery slope... except:

What I can do, is change the entire license to require changing the name if distributing patched sources, and only allow modifications in forms of patches (a'la the LaTeX license). That means they need to change the name, and have to distribute the original, unmodified source, which will mean all images have to be kept as-is.

Still DFSG-free, still free software. Slightly more annoying for distributions, but not many include iocaine anyway (and most that do, don't ship a copy of the source, so they're pretty much unaffected).

@algernon @jak2k

only allow modifications in forms of patches

isnt that a little too heavy handed? assuming it basically makes conventional forks illegal

@hsza @jak2k I will be wording that differently. Conventional forks will be fine, as long as they do not rewrite history.

The key part is that when distributing modifications, the original, unmodified source must also be distributed. Distributing a tarball of the original, or a fork with patches laid on top of the original both satisfy that.

The only thing it prevents is the kind of history rewriting that happened yesterday.