In a world where there’s always someone telling people what to do, Garry’s Mod is a breath of fresh air. Launched in 2006, the sandbox game has no goals; just hand over $9.99 to Steam, jump in, and do whatever you like.

With the benefit of hindsight, some fans may have taken that a little too literally. At the time of writing, Garry’s Mod workshop content uploaded by users over many years, is being systematically taken down in response to takedown notices filed by Nintendo.

“This is an ongoing process, as we have 20 years of uploads to go through. If you want to help us by deleting your Nintendo related uploads and never uploading them again, that would help us a lot,” the Facepunch Studios announcement reads.

The team don’t seem especially upset and are taking everything in their stride. Nintendo has a reputation for taking action against content featuring its characters and artwork so removing it now is the right thing to do.

“Honestly, this is fair enough. This is Nintendo’s content and what they allow and don’t allow is up to them. They don’t want you playing with that stuff in Garry’s Mod – that’s their decision, we have to respect that and take down as much as we can,” the announcement adds.

DMCA Notices Aren’t Real, or Even Sent By Nintendo, Some Claim

Normal service will be restored shortly, but some fans may still need convincing regarding recent events. They believe that some type of scammer, probably not even connected to Nintendo, has been using bogus notices to take content down for quite some time.

Mindful that Garry and the team needed to be aware of that, so that nothing gets taken offline unnecessarily, attracting their attention became a priority this week.

As the image from X shows, a few hours after being alerted, investigations ended with the conclusion that the takedowns were legitimate. Yet for some, that still wasn’t good enough. Over the past few months there have been reports of bogus DMCA notices claiming to have been sent by Nintendo, containing allegedly similar fictitious claims. Many were resurrected this week after more than three years, contributing to the chaos.

In some cases, users simply expressed sadness or sympathy for Garry and the team. In many, many others, passions and frustrations proved too much. Instead of the usual blanket bitterness towards Nintendo, Garry’s X account filled up with demands for evidence, rock-solid proof that Nintendo really was to blame. Some even fired off accusations that no work had been done to get to the bottom of the crisis.

In a post to X, Garry addressed the “it’s fake” guys by posing five questions, all of them related to a domain name referenced in one or more of the takedown notices. The skeptics believe that the domain mm-nintendo.com is fake; Nintendo ‘always’ use a different domain, and domain details here are different to those used elsewhere, etc.

We’ve seen more than our fair share of bogus notices in the past but since these notices don’t appear to have been shared in public, determining whether they’re real or fake simply isn’t possible.

Since Garry is on record saying that they’re real, there’s no obvious reason to question that. It shouldn’t come as a big surprise that developers can become quite attached to their projects and the communities that support them; removing content for no reason isn’t something they do lightly. So whether real or fake, voluntarily or under duress, a decision has clearly been made to say goodbye to content that, in real terms, amounts to a liability.

That being said, let’s squeeze the domain mm-nintendo.com and see what comes out.

Genuine or a Big Fat Phoney?

Finding takedown notices featuring the domain mm-nintendo.com wasn’t difficult. The pair shown below seem fairly typical; they both use notice@ in their email addresses and were sent to ISPs asking for content to be taken down.

Similar notices dated 2016, 2017, and 2018, fail to raise any obvious red flags and since the first and last were processed by GitHub, people can be confident they received considerable scrutiny.

A similar notice sent to GitHub in 2020 took content down using the DMCA. In other parts of the notice, takedowns were requested under trademark law.

At this point, it’s worth highlighting something that all of these notices have in common: not a single one targets pirated copies of Nintendo games. Instead, they all target audiovisual works, images, and fictional character depictions, to which Nintendo owns the rights. It’s a trend that runs through all similar notices.

A 2019 takedown notice sent to itch.io, also featuring the email address notice@mm-nintendo.com, displays the same features as another sent to Sankakucomplex in 2019. No games piracy in sight, only alleged infringement in characters, artwork, and audiovisual works.

It doesn’t seem unreasonable to raise a theory at this point; is it possible that Nintendo uses the mm-nintendo.com domain when takedown notices target characters, artwork, and audiovisual works, in cases where specific expertise is necessary?

MarkMonitor (MM for short?)

There’s no direct evidence to show that the MM in mm-nintendo.com stands for MarkMonitor. However, there’s plenty of evidence to show MarkMonitor has connections to Nintendo. The domain was registered through MarkMonitor in September 2016 and then updated somewhat coincidentally this Wednesday when the Garry’s Mod controversy began.

The most obvious change is the prominence of the email address brandprotection@mm-nintendo.com before the update. MarkMonitor doesn’t manage all 6,431 domain names currently listed under Nintendo of America, but it has provided brand protection services for some of the biggest names in business.

When Apple worked with MarkMonitor back in 2013, records show the company operated the domain mm-apple.com. While that domain has long since expired, mm-microsoft.com is very much alive and just like mm-nintendo.com, redirects to its owner’s main domain.

Other domains registered through MarkMonitor and used for brand protection over the years, probably behaved in much the same way; mm-velcro.com, mm-walmart.com, mm-loreal.com, and mm-nissan.com, for example.

So Real or Fake?

There seems no doubt that the domain mm-nintendo.com a) actually exists b) is used for brand protection purposes and c) isn’t used often or even at all for regular DMCA takedown work. That leads to the final item, d) the domain is different because it has a specific purpose.

It’s possible that brand protection matters are handled by a dedicated Nintendo department and/or MarkMonitor itself, which also has an office in the UK. Perhaps the image below, uploaded on Thursday, offers a few more clues. Just don’t venture too close to the edge.

Whether the DMCA or similar takedown notices sent to Garry and the team are legitimate is best judged by those who have seen them. Based on the above, however, his claim – that the notices are official – should really be the last word on the matter.

As for the other ‘fake’ notices previously sent that also mention the mm-nintendo.com domain, only a close review of each could determine whether they’re genuine and/or accurate. When everything is said and done, however, perhaps the most important question is whether they target obviously Nintendo-like characters or imagery.

From what we’ve seen, most seem to do just that.

From: TF, for the latest news on copyright battles, piracy and more.

It’s long been the case that access to certain services, whether on or offline, will only be granted when customers prove their identity.

Often linked to financial products but in many cases basic money/goods transactions carried out online, handing over a name, address, date of birth and similar details, can increase confidence that a deal will more likely than not go according to plan. In some cases, especially when buying restricted products, proving identity can be a condition of sale.

Yet, for many years, companies operating in the online space have been happy to do business with customers without knowing very much about them at all.

In some cases, where companies understand that a lack of friction is valuable to the customer, an email address has long been considered sufficient. If the credit or pre-payment card eventually used to pay for a product has enough credit and isn’t stolen, there seems very little to be concerned about. For many governments, however, any level of anonymity has the capacity to cause concern, and if that means unmasking everyone to identify a few bad actors, so be it.

Improving Detection and Prevention of Foreign Malicious Cyber Activity

Perceived and actual threats from shadowy overseas actors are something few countries can avoid. Whether in the West or the East, reports of relatively low-key meddling through to seriously malicious hacks, even attacks on key infrastructure, are becoming a fact of modern life.

After being under discussion for years, late January the U.S. Department of Commerce published a notice of proposed rulemaking hoping to reduce threats to the United States. If adopted, the proposal will establish a new set of requirements for Infrastructure as a Service providers (IaaS), often known as cloud infrastructure providers, to deny access to foreign adversaries.

The premise is relatively simple. By having a more rigorous sign-up procedure for platforms such as Amazon’s AWS, for example, the risk of malicious actors using U.S. cloud services to attack U.S. critical infrastructure, or undermine national security in other ways, can be reduced. The Bureau of Industry and Security noted the following in its announcement late January.

The proposed rule introduces potential regulations that require U.S. cloud infrastructure providers and their foreign resellers to implement and maintain Customer Identification Programs (CIPs), which would include the collection of “Know Your Customer” (KYC) information. Similar KYC requirements already exist in other industries and seek to assist service providers in identifying and addressing potential risks posed by providing services to certain customers. Such risks include fraud, theft, facilitation of terrorism, and other activities contrary to U.S. national security interests.

While supposedly aimed at external threats, only positive identification of all customers can eliminate the possibility that an ‘innocent’ domestic user isn’t actually a foreign threat actor. Or, according to the proposal, anyone (or all people) from a specified jurisdiction at the government’s discretion. Upon notification by IaaS providers, that could include foreign persons training large artificial intelligence models “with potential capabilities that could be used in malicious cyber-enabled activity.”

Scope of IaaS and Customer Identification Programs

Under the proposed rule, Customer Identification Programs (CIPs) operated by IaaS providers must collect information from both existing and prospective customers, i.e. those at the application stage of opening an account. The bare minimum includes the following data: a customer’s name, address, the means and source of payment for each customer’s account, email addresses and telephone numbers, and IP addresses used for access or administration of the account.

What qualifies as an IaaS is surprisingly broad:

Any product or service offered to a consumer, including complimentary or “trial” offerings, that provides processing, storage, networks, or other fundamental computing resources, and with which the consumer is able to deploy and run software that is not predefined, including operating systems and applications.

The consumer typically does not manage or control most of the underlying hardware but has control over the operating systems, storage, and any deployed applications. The term is inclusive of “managed” products or services, in which the provider is responsible for some aspects of system configuration or maintenance, and “unmanaged” products or services, in which the provider is only responsible for ensuring that the product is available to the consumer.

And it doesn’t stop there. The term IaaS includes all ‘virtualized’ products and services where the computing resources of a physical machine are shared, such as Virtual Private Servers (VPS). It even covers ‘baremetal’ servers allocated to a single person. The definition also extends to any service where the consumer does not manage or control the underlying hardware but contracts with a third party for access.

“This definition would capture services such as content delivery networks, proxy services, and domain name resolution services,” the proposal reads.

The proposed rule, National Emergency with Respect to Significant Malicious Cyber-Enabled Activities, will stop accepting comments from interested parties on April 30, 2024.

Given the implications for regular citizens, many of whom are already hanging on to what remains of their privacy, the prospect of handing over highly sensitive information just to obtain a product trial is a real concern. The potential for leaks grows with each disclosure, as does the possibility of personal information ending up for sale on the dark web.

Which is where the threat actors will obtain other people’s credentials to masquerade as regular users when subjected to a Know Your Customer process. For IaaS services themselves, the largest will have few problems implementing customer identification programs and may even consider them useful. On one hand, they can help to stop threat actors and on the other, take the opportunity to build a database containing the personal details of every single customer.

From: TF, for the latest news on copyright battles, piracy and more.

Twenty-five years ago, peer-to-peer file-sharing took the Internet by storm.

The ability to search for and share content with complete strangers was nothing short of a revolution.

In the years that followed, media consumption swiftly moved online. This usually involved content shared without permission, but pirate pioneers ultimately paved the way for new business models.

The original ‘pirate’ ethos has long since gone. There are still plenty of unauthorized sites and services, but few today concern themselves with decentralization and similar technical advances; centralized streaming is the new king with money as the main motivator.

AI Meets BitTorrent

There are areas where innovation and technological progress still lead today, mostly centered around artificial intelligence. Every month, numerous new tools and services appear online, as developers embrace what many see as unlimited potential.

How these developments will shape the future is unknown, but they have many rightsholders spooked. Interestingly, an ‘old’ research group, that was already active during BitTorrent’s heyday, is now using AI to amplify its technology.

Researchers from the Tribler research group at Delft University of Technology have been working on their Tribler torrent client for nearly two decades. They decentralized search, removing the need for torrent sites, and implemented ‘anonymity‘ by adding an onion routing layer to file transfers.

Many millions of euros have been spent on the Tribler research project over the years. Its main goal is to advance decentralized technology, not to benefit corporations, but to empower the public at large.

“Our entire research portfolio is driven by idealism. We aim to remove power from companies, governments, and AI in order to shift all this power to self-sovereign citizens,” the Tribler team explains.

Decentralized AI-powered Search

While not every technological advancement has been broadly embraced, yet, Tribler has just released a new paper and a proof of concept which they see as a turning point for decentralized AI implementations; one that has a direct BitTorrent link.

The scientific paper proposes a new framework titled “De-DSI”, which stands for Decentralised Differentiable Search Index. Without going into technical details, this essentially combines decentralized large language models (LLMs), which can be stored by peers, with decentralized search.

This means that people can use decentralized AI-powered search to find content in a pool of information that’s stored across peers. For example, one can ask “find a magnet link for the Pirate Bay documentary,” which should return a magnet link for TPB-AFK, without mentioning it by name.

This entire process relies on information shared by users. There are no central servers involved at all, making it impossible for outsiders to control.

Endless Possibilities, Limited Use

While this sounds exciting, the current demo version is not yet built into the Tribler client. Associate Professor Dr. Johan Pouwelse, leader of the university’s Tribler Lab, explains that it’s just a proof of concept with a very limited dataset and AI capabilities.

“For this demo, we trained an end-to-end generative Transformer on a small dataset that comprises YouTube URLs, magnet links, and Bitcoin wallet addresses. Those identifiers are each annotated with a title and represent links to movie trailers, CC-licensed music, and BTC addresses of independent artists,” Pouwelse says.

We tried some basic searches with mixed results. That makes sense since there’s only limited content, but it can find magnet links and videos without directly naming the title. That said, it’s certainly not yet as powerful as other AI tools.

In essence, De-DSI operates by sharing the workload of training large language models on lists of document identifiers. Every peer in the network specializes in a subset of data, which other peers in the network can retrieve to come up with the best search result.

A Global Human Brain to Fight Torrent Spam and Censors

The proof of concept shows that the technology is sound. However, it will take some time before it’s integrated into the Tribler torrent client. The current goal is to have an experimental decentralized-AI version of Tribler ready at the end of the year.

While the researchers see this as a technological breakthrough, it doesn’t mean that things will improve for users right away. AI-powered search will be slower to start with and, if people know what they’re searching for, it offers little benefit.

Through trial and error, the researchers ultimately hope to improve things though, with a “global brain” for humanity as the ultimate goal.

Most torrent users are not looking for that, at the moment, but Pouwelse says that they could also use decentralized machine learning to fight spam, offer personal recommendations, and to optimize torrent metadata. These are concrete and usable use cases.

The main drive of the researchers is to make technology work for the public at large, without the need for large corporations or a central government to control it.

“The battle royale for Internet control is heating up,” Pouwelse says, in a Pirate Bay-esque fashion.

“Driven by our idealism we will iteratively take away their power and give it back to citizens. We started 18 years ago and will take decades more. We should not give up on fixing The Internet, just because it is hard.”

The very limited De-DSI proof of concept and all related code is available on Huggingface. All technological details are available in the associated paper. The latest Tribler version, which is fully decentralized without AI, can be found on the official project page.

From: TF, for the latest news on copyright battles, piracy and more.