search

TeamNewPipe / NewPipe

A libre lightweight streaming front-end for Android.
https://newpipe.net
GNU General Public License v3.0
31.77k stars 3.09k forks source link

Handle Copycats (License fraud) #539

Open theScrabi opened 7 years ago

theScrabi commented 7 years ago

Follow these instructions if you want to report an app on the Google Play Store!

Hey guys, I happen to notice some new copycats which seemingly violate our License.

Once again, it's OK to copy NewPipe as long as you do not violate our GPLv3 License. Please inform yourself about GPLv3 before forking!!!

I already mailed some of the copy kiddies, but they seem to not react on it (like always), so my question is how should we handle these copycats in the future?

List of known and active copies/forks

In the Google Play Store

In the Huawei AppGallery

In the Samsung Galaxy Store

Other copies/forks

Redirion commented 5 years ago

one possibility to filter out at least a good portion of the copycats would be an automatic detection if the app has been installed from playstore alongside with an automatic self reporting of the app to google. https://stackoverflow.com/a/37540163/1257591

Poussinou commented 5 years ago

https://play.google.com/store/apps/details?id=you2mp3.player

This one has no ads, but no source code too

infinitytec commented 5 years ago

https://play.google.com/store/apps/details?id=you2mp3.player

This one has no ads, but no source code too

Still a violation as it does not include source.

gkeegan commented 5 years ago

Here is another: https://play.google.com/store/apps/details?id=full.movie.video.player (MOD edit: removed)

@theScrabi I believe it would be best to add a file to the repository that has:

  1. A breakdown of the GPL(icense), or a link to a site like this one
  2. What is wrong with putting a fork of NewPipe on the Play Store according to the terms and conditions of the Play Store
  3. A list of apps that use some source code from NewPipe in a legitimate manner (and what makes their usage okay)
  4. A few reasons why it is best to refrain from adding ads to an app (such as data about how much bandwidth is wasted on ads, and how it is unethical to remove ads from YouTube, only to add ads to the app that utilizes YouTube)
  5. What will happen if they put an app on the Play Store that violates the T&C (app gets taken down, and developer account removed (does that happen?))
  6. A warning that this is merely a page of information and not a legal document, and if there are any questions about usage of the source code, then they should be directed to (contact info for someone in TeamNewPipe, Play Store terms and condition webpage, their lawyer)

If you wish for something like this to be added, I could make a PR with this information explained in more detail.

niansa commented 5 years ago

Found another: https://play.google.com/store/apps/details?id=com.sct.yourtv

Poussinou commented 5 years ago

https://play.google.com/store/apps/details?id=hd.video.status.downloader

theScrabi commented 5 years ago

https://play.google.com/store/apps/details?id=com.fds.hfdghgfgfh

Poussinou commented 5 years ago
kubo6472 commented 5 years ago

https://play.google.com/store/apps/details?id=com.sct.yourtv Still there. But reported

theScrabi commented 5 years ago

Last one is gone

kubo6472 commented 5 years ago

Great Job. Hopefully most of them will be gone by the end of august if we'll look into it.

chunky8666 commented 5 years ago

https://play.google.com/store/apps/details?id=com.playtube.videotube.tubevideo https://play.google.com/store/apps/details?id=com.tube.download.video.dfdf Newpipe copy

theScrabi commented 5 years ago

Violation of our license: Ucmate #2768

Iamdeadlyz commented 4 years ago

Someone is selling it on Lazada https://www.lazada.com.ph/products/youtube-premium-no-ads-full-warranty-for-android-i474984516-s1239430949.html https://www.lazada.com.ph/products/youtube-premium-i474954329-s1239248291.html https://www.lazada.com.ph/products/youtube-premium-app-no-ads-extreme-video-quality-direct-download-videos-background-play-lifetime-application-usage-i419848280-s1031664819.html

z3ntu commented 4 years ago

The upside of all those clones: a ton of people are using NewPipe even if it's not intentional :wink:

Stypox commented 4 years ago

Reporting things on Lazada is explained here: https://pages.lazada.com.ph/wow/i/ph/LandingPage/IPR But I think @theScrabi has to do this because he is the copyright owner. #2732 would be a solution

B0pol commented 4 years ago

I found an app on playstore : Video Tube from Play Tube, package name: com.playtube.videotube.tubevideo Comments are saying it's full of ads

CTRL+F this github page with "playtube", you'll see it's not their first time

Umeaboy commented 4 years ago

My guess it's people working for some antipiracy companies making this mess. Why would it continue if it isn't fun?

gkeegan commented 4 years ago

@Umeaboy it is definitely just individuals seeking to make a profit by adding advertisements and tracking to NewPipe.

theScrabi commented 4 years ago

Someone is selling it on Lazada https://www.lazada.com.ph/products/youtube-premium-no-ads-full-warranty-for-android-i474984516-s1239430949.html https://www.lazada.com.ph/products/youtube-premium-i474954329-s1239248291.html https://www.lazada.com.ph/products/youtube-premium-app-no-ads-extreme-video-quality-direct-download-videos-background-play-lifetime-application-usage-i419848280-s1031664819.html

@Iamdeadlyz @Stypox I've send them a take down notice.

theScrabi commented 4 years ago

I found an app on playstore : Video Tube from Play Tube, package name: com.playtube.videotube.tubevideo Comments are saying it's full of ads

CTRL+F this github page with "playtube", you'll see it's not their first time

I've send a DMCA.

xibr commented 4 years ago

@theScrabi also this https://play.google.com/store/apps/details?id=play.tube.video.playtube.videotube.musictube

Iamdeadlyz commented 4 years ago

Glad to see that they are taken down @theScrabi

Another one https://s.lazada.com.ph/s.ZQXsz

theScrabi commented 4 years ago

So google as well as lazada claim "they can not detect an issue" which is obviously bogus. They say need further prove. Apparently simple screen shots aren't enough. I am not sure if this is a phase as they are not interested in removing any apps, or if they really do want to see sort of a code "diff".

Could some one help to reverse engineer these apps to "find" the parts that got stolen: https://www.lazada.com.ph/products/youtube-premium-i474954329-s1239248291.html

https://play.google.com/store/apps/details?id=com.playtube.videotube.tubevideo&hl=en

gkeegan commented 4 years ago

@theScrabi How do they intend to stop any infringement if there is no way to show the code of a closed source copy? Stupid.

Would looking at the icons be possible by decompiling the app? Then check file hashes of the icons (like for trending and the like) they have vs the ones in NewPipe.

kubo6472 commented 4 years ago

Wouldn't #2732 speed up this process, as they have to act? Or am I misunderstanding?

Von meinem Samsung Galaxy Smartphone gesendet.

-------- Ursprüngliche Nachricht -------- Von: Keegan notifications@github.com Datum: 07.02.20 17:46 (GMT+01:00) An: TeamNewPipe/NewPipe NewPipe@noreply.github.com Cc: Jakub Doboš kubo6472@gmail.com, Comment comment@noreply.github.com Betreff: Re: [TeamNewPipe/NewPipe] Handle Copycats (License fraud) (#539)

@theScrabihttps://github.com/theScrabi How do they intend to stop any infringement if there is no way to show the code of a closed source copy? Stupid.

Would looking at the icons be possible by decompiling the app? Then check file hashes of the icons (like for trending and the like) they have vs the ones in NewPipe.

— You are receiving this because you commented. Reply to this email directly, view it on GitHubhttps://github.com/TeamNewPipe/NewPipe/issues/539?email_source=notifications&email_token=AGHPNRVELLPBMDYDXVULPWDRBWF4LA5CNFSM4DKPB4UKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOELDWP7I#issuecomment-583493629, or unsubscribehttps://github.com/notifications/unsubscribe-auth/AGHPNRRLRJV3WSRETA5EU6DRBWF4LANCNFSM4DKPB4UA.

B0pol commented 4 years ago

Look on comments with medias on lazada, 1 star two weeks ago, the crash reporter shows package "org.schabi.newpipe", could not decrypt video url signature, and version 0.17.4

The package name is the same, the crash reporter is the same, the ui is the same (look in comments with media) BUT two screenshots from 2 weeks ago or more recent shows the YouTube interface, so the owner have switched to another app (vanced?) due to the decryption bug.

gkeegan commented 4 years ago

@B0pol that would probably be sufficient proof for removal, so long as an apk of that version is obtainable.

rstular commented 4 years ago

I've looked into the Play Tube - Video Tube app. The developers used a large chunk of NewPipeExtractor in their app, with minor modifications, which mostly consist of:

Practically the whole NewPipeExtractor codebase (with the exception of /extractor/comments directory) is being reused in the Play Tube app, without any major modifications. There were some minor ones though, which mostly consist of: When/if possible, I will also try to run MOSS over the code to further demonstrate the degree to which the code was reused.

The decompiled code I've managed to generate (using jadx) is available here:

Hopefully, this will be enough evidence to prove the rightful ownership of the code. If you have any further questions, please let me know.

Best regards

rstular commented 4 years ago

@theScrabi As for the Lazada listing, it could be taken down via the Alibaba IPP portal, if someone is willing to go through their identity verification process. Edit: Just read that "they cannot detect the issue", it's a bit trickier then, since the seller only distributes download links through the store. If someone could obtain the APK, the ownership of the code could be easily proven, but as of now, there's not much that can be done.

rstular commented 4 years ago

Also, another closed source app, which uses the extractor playtube.videotube.playing

theScrabi commented 4 years ago

@B0pol @rstular very nice. Thank you :D

I am currently busy writing my bachelor thesis, but once I find time to answer them I'll keep u up to date.

TobiGr commented 4 years ago

@rstular Using the extractor is completely legal as long as you say that you do so

rstular commented 4 years ago

@TobiGr And as long as you use GPL for your project, if I understand GPL correctly? Regardless, neither developer disclosed the use of NewPipe extractor, nor used the GPL license for the apps in question.

theScrabi commented 4 years ago

Yes when NewPipe extractor is used the app has to be made open. Otherwise the extractor license had to be MIT or apache.

TobiGr commented 4 years ago

Oh yes. You are right

TheAssassin commented 4 years ago

@rstular we cannot provide legal advice. Please contact a lawyer if you are unsure.

Not legal advice: yes, the GNU GPL version 3 requires projects using such a depencency to be licensed under the same license terms.

Max1Truc commented 4 years ago

Hey @theScrabi , I didn't read the full discussion so sorry if I waste your time... but NewPipe isn't available on the Play Store because it violates some Google legal advices on Youtube or something like that, right ? So maybe NewPipe copycats could be deleted on the Google Play Store by explaining that they violate Google's Terms of Use or any other thing...

JensMy commented 4 years ago

Why do you care so much about them, this app is so mind blowing great and those Loosers just copy your work because theywere not able to create such a nice application.. Maybe you should text them and offer them some coding lessons but since your app is free and I hope there were great donations made to you their profit will be small... On the other side is if you report them to gplay store, they may get an eye on your project and it will be punished....

gkeegan commented 4 years ago

People care about it since it is stealing the work of others and trying to profit off it.

I don't think YouTube will do anything specific to NewPipe, especially since projects like youtube-dl have been around for a long time.

kubo6472 commented 4 years ago

We are reporting them all the time. But when someone copies just part of the code or just the extractor code, then Play Store treats them not as a copycat, and they need proof. It's against the license. We care about all of this, so that the "copy devs" learn, they're doing something disallowed, and also people get confused easily and make them money, for literally copying someone else's work. Maybe those people are not doing it in the plan of stealing someone else's work, but just helping them do something with it in the future, poke around in the code. And to them: You are doing something very wrong, and you'll probably and hopefully get it sooner rather than later.

theScrabi commented 4 years ago

Here is another one. Did we have it already? Top video downloader - https://play.google.com/store/apps/details?id=com.miniapps.fbvideodownloader

TheAssassin commented 4 years ago

Should we make a wall of shame?

theScrabi commented 4 years ago

@kubo6472 i agree. Our code is open for two reasons: Use it, change it, earn money with it, what ever you do I don't care. BUT who changes the code needs to give back his changes either by contributing or by opening up his code and he needs to acknowledge our work. This is why I decided on GPL3.

B0pol commented 4 years ago

3804: @pokemetti found "Tubemate Video Downloader For All", developped by "tubemate video downloader", package vddl.video.downloader on Samsung Galaxy Store, email hdvideodl@hotmail.com, icon . @pokemetti said it contains ads.

I've searched a bit, it looks like they made a combo! They even plagiarised "TubeMate" for the icon and name: website http://www.tubemate.net/, developer "Devian Studio", icon , package devian.tubemate.v3. This app — created in 2010 — is a webview (or browser?) with a download icon and some other features, for video websites (I've seen at least youtube and vimeo), it's not a NewPipe copy at all.

B0pol commented 4 years ago

I found an app on playstore : Video Tube from Play Tube, package name: com.playtube.videotube.tubevideo Comments are saying it's full of ads CTRL+F this github page with "playtube", you'll see it's not their first time

I've send a DMCA.

They "created" """another""" app, Play Tube & Video Tube, package play.tube.video.playtube.videotube.musictube.

kubo6472 commented 4 years ago

They "created" """another""" app, Play Tube & Video Tube, package play.tube.video.playtube.videotube.musictube.

I've uninstalled that app (to check) right this moment.

Also here: marking the app with 5 milion downloads "Early Access" just to hide reviews:

Can't share the link

5€ per Week?!

Also the package is probably called "Tube" it plays only popups. Not sure if there's no code being used from the NewPipe projects, but shows up second when searching for such.

B0pol commented 4 years ago

Uh, you downloaded another app. The one I linked has 1 million downloads and definitely looks like NewPipe, ofc without about page for credits / license neither in the app, nor in the playstore description. Some screenshots:

kubo6472 commented 4 years ago

@B0pol

I was talking about two apps there. First sentence was responding to you that I was testing the app you were talking about, the moment I read your reply. The next thing was about the second app. I am unclear, I know.

rstular commented 4 years ago

I've verified that play.tube.video.playtube.videotube.musictube package contains NewPipe extractor (decompiled source is attached - directory sources/org/schabi/newpipe/).

Additionally, the app downloaded by @kubo6472 com.mercandalli.android.apps.youtube (MOD edit: removed) is using NewPipe as well, though it is (from the decompiled source) not as obvious as the first one due to heavy obfuscation they used. The usage of NewPipe can be most easily seen from the original filenames, which managed survived the obfuscation (I presume through metadata that for some reason remained unobfuscated).

Original NewPipe filenames present in the compiled apk image