youtube-dl, the DMCA and open source maintainers

I’ve used youtube-dl for years, mostly to pull conference talks onto a laptop before a flight, back when there were flights. On Friday the RIAA sent GitHub a DMCA notice, and GitHub took down the youtube-dl repository and the 17 forks the notice listed.

The notice is an odd one. Nobody claims youtube-dl contains anybody’s music. The claim is under section 1201, the anti-circumvention part of the DMCA: that the code’s “clear purpose” is to get around YouTube’s technological protection measures, its “rolling cipher”, so distributing the code is illegal in itself. The evidence includes the project’s test suite, which used a few music videos (Taylor Swift’s “Shake It Off” among them) as sample URLs, and a German court decision about the same cipher.

I’m not a lawyer. As far as I understand it, the “cipher” is a scrambled signature in the video URL that YouTube’s own JavaScript unscrambles in every browser, for anyone, every time a video plays. Calling that a protection measure seems like a stretch to me, but stretches have worked before.

The part I’d actually worry about is how little it took. One letter, an argument nobody had to test, and a project that’s been around since 2006 lost its issues, pull requests, releases and wiki overnight. GitHub didn’t rule on anything, and under the DMCA it has every reason to take down first and ask later. When Microsoft bought GitHub I said I wasn’t worried about Microsoft, and I’m still not, any owner would have had to do the same. The trouble is that so much of open source lives on one site, and that site has to answer letters.

The internet, of course, did what it does. Git is distributed, so the code was back up in a hundred places within hours. People are posting it as images. Someone apparently got the source into GitHub’s own public repository of DMCA notices through pull requests, which made me laugh out loud. pip install youtube-dl still works as I write this. Around 2000 people printed the DeCSS source on T-shirts to make the same point about code and speech, and here we are again with better tools.

That’s fine for users. For the maintainers, a small group who’ve spent years keeping up with a thousand websites changing their players, for free, it means their bug tracker is gone and they have to decide whether to fight a record industry association, move everything and rebuild, or quit. It’s left-pad and event-stream again from a different angle: a lot of the world runs on a few unpaid people, and we only notice them when something lands on them.

If you maintain anything on GitHub you’d hate to lose, keep a full mirror somewhere else (we’ve had one since 2018), and export the issues while you’re at it. The code is the easy part to get back.