Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Handle Copycats (License fraud) #539

Open
theScrabi opened this issue May 8, 2017 · 225 comments
Open

Handle Copycats (License fraud) #539

theScrabi opened this issue May 8, 2017 · 225 comments
Labels
discussion This needs to be discussed before anything is done meta Related to the project but not strictly to code

Comments

@theScrabi
Copy link
Member

theScrabi commented May 8, 2017

Follow these instructions if you want to report an app on the Google Play Store!


Hey guys, I happen to notice some new copycats which seemingly violate our License.

Once again, it's OK to copy NewPipe as long as you do not violate our GPLv3 License. Please inform yourself about GPLv3 before forking!!!

I already mailed some of the copy kiddies, but they seem to not react on it (like always), so my question is how should we handle these copycats in the future?

List of known and active copies/forks

In the Google Play Store

In the Huawei AppGallery

  • (to be added)

In the Samsung Galaxy Store

  • (to be added)

Other copies/forks

@ksh-b
Copy link

ksh-b commented May 8, 2017

Thats embarasing. How come they even stay on playstore.

https://support.google.com/googleplay/android-developer/contact/takedown

@theScrabi
Copy link
Member Author

I've tried that, but google does not seem to respond? Maybe I'm doing something wrong here. Howerver, I know that it works sice there was already a fork that got kicket out.

@yasinalm
Copy link

yasinalm commented May 23, 2017

don't worry, you don't need to to do anything. it is impossible(99.99%) a single app stays alive until 500 downloads. Play store takes care of it extremely very well as YT is his own too. they can earn 1-2$ but loose 25$ (account registration fee). So, it is not worth that much effort to do something. they punish themselves.

A few examples can be found but they won't live longer and the ads will be eventually ceased.

@theScrabi
Copy link
Member Author

Sure? audiorocket sem tho have more than 400k downloads.

@ericswpark
Copy link

ericswpark commented Jul 21, 2017

Unfortunately while copycats will always be there (I have some on my hands too) it's just easier for you to send a take-down notice to Google and let them deal with it.

That being said, Google hates your app so they might just not be taking it down in spite. Who cares, the average 99% of people in the world likes it anyway ;)

@theScrabi theScrabi changed the title Handle Copycats ?!? Handle Copycats (Licence fraud) ?!? Aug 1, 2017
@theScrabi theScrabi changed the title Handle Copycats (Licence fraud) ?!? Handle Copycats (License fraud) ?!? Aug 1, 2017
@TheAssassin
Copy link
Member

TheAssassin commented Aug 1, 2017

This list has been mined out of 600 MiB of parsed email data. If you can spot some of them, please get in touch with us.

Edit: These are package names I parsed from the ones in the field that was added a few weeks after the introduction of the bug reporting. For this and other reasons, this list is not complete, there might be more.

co.at.newpipe
com
com.akkayaxm.mscPlayer
com.cubic3.MyDownloader
com.dl.video
com.facecampt.free.music.player
com.FloTemp
com.gawo.rohgf
com.green.music
com.halara.trap
com.hvlapps.freemusicplayer
com.mp3musicdownloader.mp3.music.downloader
com.mp3musicdownload.music
com.mp3musicdownload.musicmp3
com.mp3music.newlife
com.mpool.mytube
com.musicmp3downloader.ilovemp3
com.musicmp3.newmusic
com.musicmp3.new\nmusic
com.music.paradise
com.mwiz.pingmusic
com.tenlishir
com.youtube.audiorocket
com.youtubed.ydownloader
com.youtubelistening.youtubebackground
com.youtubelite.floattube
com.zbm.probasse
idev4mobile.karaoke
idev4mobile.videotube
inc.players.youlayer
musicstream.videostream.newpipe
org.bardo.newpipe
org.le.keep_video
org.schabi.newpipe
org.schabi.vbl2013
org.schabi.videodownloader
org.schabi.youdownload
org.schabi.youdownloader
org.testng01.tubeb44

@coffeemakr
Copy link
Contributor

coffeemakr commented Aug 2, 2017

I've created a small script to check if they are on google play: https://gist.github.com/coffeemakr/8862e7903c4bea21b99c6a457268af71

The following packages are on google play:

A copyright violation can be submitted with this form:
https://support.google.com/legal/contact/lr_dmca?&product=googleplay
The description on how to fill out the form can be found here: https://support.google.com/legal/troubleshooter/1114905#ts=1115643%2C1115789%2C1117010%2C1697925

@theScrabi theScrabi changed the title Handle Copycats (License fraud) ?!? Handle Copycats (License fraud) Aug 2, 2017
@theScrabi

This comment was marked as outdated.

@TheAssassin
Copy link
Member

Beware that this is not even the whole list, only the ones we captured on a side-channel. But yes, it's quite an amount. Time to take half a day and send some DMCA takedown notices, @theScrabi.

@Zero3K
Copy link

Zero3K commented Aug 22, 2017

How about adding some code that checks the display/package name of NewPipe and if it has been changed, let the user know (and possibly refuse to work)?

@TheAssassin
Copy link
Member

Then you'd also notify the copycat and tell them "oh, I need to remove that piece of code". They're not that stupid, because they must obviously know how how to develop for Android to create realistic apps. This measure is rather pointless IMO.

@theScrabi
Copy link
Member Author

theScrabi commented Aug 22, 2017

The only thing we could do is making it harder for copycats to change the email address where the but reports are send to.

@Poussinou
Copy link
Contributor

Poussinou commented Aug 30, 2017

@theScrabi Did you feel the DCMA takedown notice, out of curiosity? It only takes a few minuts and Google reacts in a few days (I already tried with an other app) I can see that the apps haven't all been taken down.

I would like to add this one (MOD edit: removed) to the list made by coffemakr !

@TobiGr

This comment was marked as resolved.

@Poussinou

This comment was marked as resolved.

@theScrabi

This comment was marked as resolved.

@comradekingu

This comment was marked as resolved.

@theScrabi

This comment was marked as resolved.

@Poussinou

This comment was marked as resolved.

@theScrabi

This comment was marked as off-topic.

@Ostefanini
Copy link

Does play store will really help you in this war?
Play yt in background is something quite illegal for them...

@theScrabi
Copy link
Member Author

Well I wouldn't raise, there attention to much.

@ghost

This comment was marked as resolved.

@theScrabi
Copy link
Member Author

Report them. Thats the most we can do.

@Stypox
Copy link
Member

Stypox commented Feb 6, 2023

I wrote a small python script that analyzes the html of this page (copied after having expanded all comments) and extracts all urls. It then keeps only the urls that return an OK http status.
import re
import sys
import requests
URL_REGEX = r'https?://[a-zA-Z\.\-]*(?:github|gnu|gplv3|twitter|support\.google|stackoverflow|tldrlegal|soundcloud|schema|w3\.org|bountysource|bandcamp|f\-droid|peertube|media\.ccc|newpipe\.net|reddit|youtube)'

html = open("539.html").read()
urls = re.findall(r'(https?://[^\"\)\<\>\s]+)', html)

urls = [url for url in urls if re.match(URL_REGEX, url) is None]
urls = sorted(set(urls))

for i, url in enumerate(urls):
    print("\r", i, "  ", url[:min(len(url), 74)], sep="", end=" ")
    sys.stdout.flush()

    try:
        if requests.head(url).ok:
            print("\r", " "*80, "\r", url, sep="")
            sys.stdout.flush()
    except KeyboardInterrupt:
        exit(0)
    except:
        pass

Thanks to that, and after some manual filtering, I found out these apps are still alive:

And here are the play store listings:

@Stypox
Copy link
Member

Stypox commented Feb 6, 2023

I just reported all of the Play Store listings above except for tm.belet.films (since we don't know whether that should be reported) to the "Google play takedown form".

I created this python script that you can use to obtain a description and download screenshots to submit to the form.
import sys
import os
import requests
from bs4 import BeautifulSoup

print(open("desc.md").read().replace("com.newpipe.protube", sys.argv[1]))
print("\nhttps://play.google.com/store/apps/details?id=" + sys.argv[1])

html = requests.get("https://play.google.com/store/apps/details?id=" + sys.argv[1] + "&hl=en").text
soup = BeautifulSoup(html, features="lxml")

for png in os.listdir("."):
    if png.endswith("png"):
        os.remove(png)

alreadyFoundUrls = set()
for img in soup.findAll("img"):
    if 'alt' not in img.attrs or 'src' not in img.attrs:
        continue
    alt, src = img.attrs['alt'], img.attrs['src']
    if alt in ["Icon image", "Screenshot image"] and not src.endswith("=s20") and src not in alreadyFoundUrls:
        alreadyFoundUrls.add(src)
        filename = "icon.png" if alt == "Icon image" else f"screenshot{len(alreadyFoundUrls)-1}.png"
        open(filename, "wb").write(requests.get(src).content)

Assumes that the "desc.md" file contains the following content:

The OFFICIAL NewPipe app is a free and open source application licensed under the GPLv3 license, whose source code is available on GitHub at https://github.com/TeamNewPipe/NewPipe . The app on Play Store, com.newpipe.protube, is an UNAUTHORIZED COPY of the official NewPipe app. That's because the GPLv3 license requires source code to be available to users who download the binaries/APKs (see lines 34 to 38 of the license, available here: https://github.com/TeamNewPipe/NewPipe/blob/dev/LICENSE#L34-L38 ), but the source code of the app I am flagging is not available anywhere. Moreover, GPLv3 requires that changes to the original source code are documented (see lines 210 to 215 of the license), but their source code changes are not published.
The features provided by the app I am flagging also violate the Google Terms of Service for publishing on Play Store, since it allows watching YouTube videos, also in background, without using the official YouTube APIs.

@AudricV
Copy link
Member

AudricV commented Mar 10, 2023

I found three unreported apps here on the Google Play Store:

@AudricV
Copy link
Member

AudricV commented Mar 11, 2023

More apps:

@Poussinou
Copy link
Contributor

This developer also have the two apps below that are Newpipe clones. The second one is opening an ad really aggressively just after the install:

He also uploaded copycats of LibreTube, they are reported here.

@heartlog

This comment was marked as duplicate.

@comradekingu
Copy link
Contributor

comradekingu commented Apr 29, 2023

What is going on with https://youdown.net/
Is anything actually different offered there?

https://hosted.weblate.org/projects/youdown/#information says "proprietary", which isn't compatible with the license.

@eclairevoyant
Copy link

What is going on with https://youdown.net/ Is anything actually different offered there?

Doesn't matter unless there's a copyright or license violation.

https://hosted.weblate.org/projects/youdown/#information says "proprietary", which isn't compatible with the license.

Probably mislabeled on weblate, it appears to be open source.

@nospace-here
Copy link

https://play.google.com/store/apps/details?id=com.tubepipe.newpipe

Similar logo and screenshots appear to be AI-generated

@nospace-here

This comment was marked as resolved.

@wb9688

This comment was marked as duplicate.

@theScrabi
Copy link
Member Author

theScrabi commented Jul 12, 2023

https://play.google.com/store/apps/details?id=com.tubepipe.newpipe

Similar logo and screenshots appear to be AI-generated

I notified google.

@librick
Copy link

librick commented Jul 31, 2023

Should the project README have a clear warning toward the top about NewPipe not being on Google Play? The existing text warns bad actors: PUTTING NEWPIPE, OR ANY FORK OF IT, INTO THE GOOGLE PLAY STORE VIOLATES THEIR TERMS AND CONDITIONS, but I think we could reword/prepend it to warn users specifically. Something like NewPipe is NOT on the Google Play Store! Do NOT download NewPipe from Google Play! Apps using NewPipe branding on Google Play are fake!

I looked up NewPipe on Google Play Store this afternoon and found the following:

All of which are using some variant of the NewPipe logo.
I flagged these apps from within the app store. Then I reported each one via the Google takedown form (https://support.google.com/googleplay/android-developer/contact/takedown). Under "Reason for flagging" I selected "Other objection" and in the text field I wrote:

This app commits license fraud against the NewPipe open source project and is likely malicious. See: #539

(I wrote out the full/unformatted issue link in the form, ignore the GitHub-specific issue linking). Thanks to the devs and community for being vigilant. I didn't know this was a problem until today

@opusforlife2
Copy link
Collaborator

to warn users specifically

Unfortunately, they are completely separate audiences. Potential users who manage to reach our ReadMe won't download clones. And users who download clones from the Play Store won't know to come to this repo.

@pokegamer5547
Copy link

Another copycat found called playtuber
https://play.google.com/store/apps/details?id=com.streamingnewpipe.videomusicnewpipe

@TobiGr
Copy link
Member

TobiGr commented Sep 17, 2023

https://m.onestore.co.kr/mobilepoc/apps/appsDetail.omp?prodId=0000727868&scYn=Y
Is there anybody who has access to "onestore" and is able to download the APK?
Please do not install the app if possible.

@Poussinou
Copy link
Contributor

@theo546
Copy link

theo546 commented Dec 19, 2023

This app may not be using NewPipe code directly, but they are using NewPipe name and logo
https://apps.apple.com/fr/app/newpipe-music-videos/id6450053445

@clavinet
Copy link

clavinet commented Mar 1, 2024

This app may not be using NewPipe code directly, but they are using NewPipe name and logo https://apps.apple.com/fr/app/newpipe-music-videos/id6450053445

I found this one as well today and even contacted Apple support about it, but there is only so much a user can do.

They asked me if I'm the developer so I suppose it would carry more weight if someone "official" from the NewPipe team would file a copyright infringement claim.

@e075e

This comment was marked as duplicate.

@e075e

This comment was marked as resolved.

@e075e

This comment was marked as off-topic.

@appreviewandblocker

This comment was marked as duplicate.

@e075e

This comment was marked as resolved.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
discussion This needs to be discussed before anything is done meta Related to the project but not strictly to code
Projects
None yet
Development

No branches or pull requests