full-disclosure - DMCA letters (testing method)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Wed Nov 23 20:32:04 2005
From: michael.holstein at csuohio.edu (Michael Holstein)
Subject: DMCA letters (testing method)

I'm not sure who is doing the data collection for the RIAA these days, 
but after getting several DMCA notices in the last few days, I've 
noticed that there is never any connection attempts to the IP mentioned, 
during the time mentioned (and yes, I know how to do the math on timezones).

So I conclude the data collection process goes like this :

1) download something and listen to it.
2) retrieve the hash value for the file
3) search directory nodes for who offeres that hash
4) collect the IP addresses
5) provide list to monkeys in room with typewriters.

So they never really *check* to see if the person accused is really 
hosting file, they just trust what the directory server told them.

This of course begs the question :

How can they ask me to take down something they aren't sure is there?

(nevermind that we're a 'provider' under the DMCA and ignore the 
requests unless it's on something we own rather than provide transit to 
-- since it's always residence hall IPs).

When they actually go the distance and sue somebody, do they at least 
check then?

Cheers,

Michael Holstein CISSP GCIA
Cleveland State University