Fake libretube website

[terminal-cs]

Steps to reproduce

N/a

Expected behavior

N/a

Actual behavior

N/a

LibreTube version

N/a

Android version

N/a

Other details

This site is the first result on duckduckgo, and is clearly not an official site.

The actual download links appear to link to this repo's releases, but the whole site feels extremely unofficial and sketchy, and I haven't seen anything written about it here.

Acknowledgements

• I have searched the existing issues and this is a new ticket, NOT a duplicate or related to another open issue.
• I have written a short but informative title.
• I will fill out all of the requested information in this form.

[terminal-cs]

I also think it has ads. I haven't seen them because I use AdBlock but they mentioned ads in the privacy policy

[Bnyro]

There's also libretube.net, which is not affiliated with us either.
The only official website is https://libre-tube.github.io, and any official social media accounts are referenced in the GitHub Readme!

[Bnyro]

Not sure if we can do anything to take the fake websites down, help is appreciated on that!

[terminal-cs]

Not sure if we can do anything to take the fake websites down, help is appreciated on that!

I'm sure there's something, although personally I have no experience with that unfortunately.

[IndusAryan]

unfortunately we cant do anything except requesting them to stop impersonating,very popular projects like revanced and vanced have their websites impersonated,no one can do anything,only corporates can do that.
we can only wish if they distrbute apk without injecting malware.

[M00NJ]

I also don't think there is much we can do here. Except maybe adding a section to the readme with a warning. Something like this: "LibreTube doesn't have a website. Downloading the app from anywhere else than GitHub, F-Droid or IzzyOnDroid is highly discouraged due to the possibility of malware contamination."

[Silther]

unfortunately we cant do anything except requesting them to stop impersonating,very popular projects like revanced and vanced have their websites impersonated,no one can do anything,only corporates can do that. we can only wish if they distrbute apk without injecting malware.

you can report them and then it's up to google etc. what happens next.
Google
Microsoft
wikiHow

[akano12]

I don't think there's a problem as long as the downloads are being pulled directly from github releases (unlike the modified android copies distributed on google play) .

At least we know nothing malicious is being installed on the devices of the users.

And after all, it's the end users' responsibility to do their researches before installing anything on their devices, we can't spoon-feed everyone and tell them what's good and what's bad

[IndusAryan]

Just ask these site operators to shut their site down,if answer comes negative or no response then ask them to use LT github asset files for downloading ,while doing this stick a eye catchy note on top of readme to to notify users about the list of these fake sites.

[salad612]

maybe you could also show a prompt of the only official download locations (e.g. f-droid, github) when the user first opens the app but I don't know if that is too invasive.

[akano12]

maybe you could also show a prompt of the only official download locations (e.g. f-droid, github) when the user first opens the app but I don't know if that is too invasive.

The code is open sourced mate, they can simply remove the prompt and publish the app 🤣🤣🤣🤣🤣.

[Bnyro]

But it would inform users of LibreTube that there are clones of the app internet and that they have to make sure to only use official sources. I think that's actually not a bad idea.

[Bnyro]

And sometimes, I'm not sure if the people that just steal the app without respecting the license, even have any idea how to code - otherwise they wouldn't need to use our code.

[terminal-cs]

And sometimes, I'm not sure if the people that just steal the app without respecting the license, even have any idea how to code - otherwise they wouldn't need to use our code.

make it hard to remove some how, like burried deep so that you'd only know how to remove it if you actually knew how to program. Many wouldn't even bother after than - maybe like a base-64 encoded string and a call to open a popup hidden somewhere - or even multiple calls so that if one doesn't trigger, another will. That will give them a headache for sure.

[olsonperrensen]

How about having a sticky notification on first run? It could contain a disclaimer stating the only trustworthy sources where the APK may be downloaded.

[FireMasterK]

make it hard to remove some how, like burried deep so that you'd only know how to remove it if you actually knew how to program. Many wouldn't even bother after than - maybe like a base-64 encoded string and a call to open a popup hidden somewhere - or even multiple calls so that if one doesn't trigger, another will. That will give them a headache for sure.

That may not be GPL friendly since that's a bit like obfuscated code.

[Bluscream]

I would suggest a warning modal when the user first starts the app

[MasterKia]

uBlockOrigin/uAssets@ebec94a

[Doktor515]

https://libretube.app/

[Doktor515]

https://libretube.app/contact-us/

[Bnyro]

@MasterKia We now have our own domain: https://libretube.dev (alias to https://www.libretube.dev).

Could you please unblock that specific domain and redirect all the requests to https://libretube.dev instead of https://libre-tube.github.io?

Thank you!

[MasterKia]

Fixed: uBlockOrigin/uAssets@7e6d812

[IndusAryan]

very fast but how do you get a free domain?

[Bnyro]

Fixed: uBlockOrigin/uAssets@7e6d812

Thank you!

[Bnyro]

very fast but how do you get a free domain?

It's not a free domain, it's paid with donations.

[Darin755]

I couldn't help notice that this website seems to be hosted by openprovider. You can see how to report abuse here. https://support.openprovider.eu/hc/en-us/articles/360001725008-Reporting-abuse

I would strongly urge the owner of this repo to report the domain as it seems to be used for malware

[opk12]

Not a lawyer, here's random ideas from the Internet.

• GPL 3 "Additional terms" allows to add specific attribution terms. (GPL is triggered by redistribution though, not a mere link to the GitHub apk.) Details at opensource.SE.
• If there is no Libretube entity and they write "Copyright Libretube", they seem to want to stay safe. The FSF advice from the guide to the GPL may discourage this kind of people: per-author copyright notices (also under a pseudonym) would force them to name you on the website (potentially triggering personality rights); if each file has its own notices (as opposed to one project-wide list), it's more work for them to scan the source and keep an eye on the commits.
• Sometimes a cease-and-desist letter by an attorney is enough, even if you do not intend to go to court.
• Well-known names and logos are protected as unregistered trademarks in some jurisdisctions, independent of copyright.
• See moral rights, for example if they spread malware to harm your reputation.