From what I can tell, some person made a fan page for an existing Funko Pop video game (Funko Fusion), with links to the official site and screenshots of the game. The BrandShield software is probably instructed to eradicate all "unauthorized" use of their trademark, so they sent reports independently to our host and registrar claiming there was "fraud and phishing" going on, likely to cause escalation instead of doing the expected DMCA/cease-and-desist. Because of this, I honestly think they're the malicious actor in all of this. Their website, if you care: https://www.brandshield.com/
About 5 or 6 days ago, I received these reports on our host (Linode) and from our registrar (iwantmyname). I expressed my disappointment in my responses to both of them but told them I had removed the page and disabled the account. Linode confirmed and closed the case. iwantmyname never responded. This evening, I got a downtime alert, and while debugging, I noticed that the domain status had been set to "serverHold" on iwantmyname's domain panel. We have no other abuse reports from iwantmyname other than this one. I'm assuming no one on their end "closed" the ticket, so it went into an automatic system to disable the domain after some number of days.
I've been trying to get in touch with them via their abuse and support emails, but no response likely due to the time of day, so I decided to "escalate" the issue myself on social media.
https://en.wikipedia.org/wiki/Spite_house
https://en.wikipedia.org/wiki/List_of_Curb_Your_Enthusiasm_e...
Edit: And i'm happy to see that it's working again as of 2024-12-09 12:27 UTC+1
The last time someone I knew had an issue, they had to get a senator to make waves to get anything resolved.
Prices went up, service went down. I’d recommend moving your domains when you can (Porkbun have been good, though I haven’t had any incidents like this).
Best of luck!
I've used their services for ages and even got to briefly meet the founders once in Wellington who gave a talk on Erlang.
Ah well, while it sucks that the good times may be over, I'm glad the founders got their exit :)
Though it was the indie/personal feel they had as a registrar, I might look for alternatives.
Then things like this happen, and people think "ooh AI is bad, the bubble must burst" when this has nothing to do with that in the first place, and the real issue was that they sent a "fraud/phishing report" rather than a "trademark infringement" report.
Then I also wish that people who knew better, that this really has nothing to do with AI (like, this is obviously not autonomously making decisions any more than a regular program is), to stop blindly parroting and blaming it as a way to get more clicks, support and rage.
AI does need to die. Not so much because LLMs are bad, but rather because, like "big data" and "blockchain" and many other buzzwordy tools before it, it is a solution looking for a problem.
That haphazard branding and parroting is exactly why the bubble needs to burst. Bubbles bursting take out the gritters and rarely actually kills off all the innovation in the scene (it kills a lot, though. I'm not trying to dismiss that).
I also wonder if their "automatically disable" policy takes size/importance of site into account. Is this how they would treat all their domain owners, regardless of significance?
While I agree, the people who hired them are equally culpable. You don't get to wash your hands of the mess just because someone else is doing your dirty work.
It does, but they never mess with anyone with big enough pockets to get sued for it.
My hosting party (Hetzner) forwarded the emails and / or put it in their own system, I removed the offending images / page, replied to the email, and done, right? Wrong, the email said I had to fill in a statement through some online form somewhere; I did that too late and got more and more threatening emails like "pack your shit we're evicting you in 24 hours". Nobody seemed to actually read my replies / explanation, probably because this is so routine for them.
And I get it, nobody can be arsed to read longwinded explanations and the like for routine operations. I hope AI assisted tooling will help the overworked support employees with making decisions in favor of giving people the benefit of the doubt and the help they need; for them it's routine, but for me it was the first time I got anything like that.
I've worked on a team in a household-name big tech company where our mission was almost exactly "make sure we're not blowing up our most important customers for no reason". It's not nearly as easy as it sounds: defining who's important is hard, and defining what should and shouldn't be allowed is hard, and then implementing that all correctly and avoiding drift over time is tricky too.
• itch.io users could launch the Godot Web Editor to quickly make prototypes or simple games right on itch
• Publish from the native Godot editor directly to itch.io
• Godot adopts itch.io as the official asset store for art packs etc.
• Introduce social features for devs and artists to collaborate with each other:
• A publisher could choose to add a “Fork” or similar button on their itch.io game page that downloads and opens the project source in Godot. • All "forks" published that way would include a link to the original game's page, and so on.
I think Godot+itch could/should become the Github of Games :)
Did this account violate your ToS or the actual law? While I totally understand where are you coming from and I would probably be forced to do the same, I still tend to believe that closing a fan account is exactly the same thing that your registrar did to you.
Besides that, there are so many websites with copyright content that never changes the domains, is just the domain registration bad or why they just disabled the domain?
Godspeed!
I would write up a complaint and send it to the incoming FTC Commissioner. Yes, I'm serious. From the signals Trump is sending if there is ever a time when Republicans may support some form of DMCA reform, it's now. He's on record talking about punishing Big Tech and supporting "Little Tech." You're Little Tech. Send copies of your letter to Funko and BrandShield. Also reach out or at least send a copy to Matt Stoller, the guy who publishes a very popular newsletter about monopoly, anti-trust and corporate abuse in America, he will be interested. Go for the throat.
I feel like there's also some missing layer of infrastructure here.
itch.io, like a lot of sites (HN being another), is meant to act as a host of user-generated content, over which the site takes a curatorial but not editorial stance. (I.e. the site has a Terms of Use; and has moderators that take things down / prevent things from being posted according to the Terms of Use; but otherwise is not favoring content according to the platform's own beliefs in the way that e.g. a newspaper would. None of the UGC posted "represents the views" of the platform, and there's no UGC that the platform would be particularly sad to see taken down.)
I feel like, for such arms-length-hosted UGC platforms, there should be a mechanism to indicate to these "brand protection" services (and phishing/fraud-detection services, etc) that takedown reports should be directed first-and-foremost at the platform itself. A mechanism to assert "this site doesn't have a vested interest in the content it hosts, and so is perfectly willing to comply with takedown requests pointed at specific content; so please don't try to take down the site itself."
There are UGC-hosting websites that brand-protection services already treat this way (e.g. YouTube, Facebook, etc) — but that's just institutional "human common sense" knowledge held about a few specific sites. I feel like this could be generalized, with a rule these takedown systems can follow, where if there's some indication (in a /.well-known/ entry, for example) that the site is a UGC-host and accepts its own platform-level abuse/takedown reports, then that should be attempted first, before trying to get the site itself taken down.
(Of course, such a rule necessarily cannot be a full short-circuit for the regular host-level takedown logic such systems follow; otherwise pirates, fraudsters, etc would just pretend their one-off phishing domains are UGC platforms. But you could have e.g. a default heuristic that if the takedown system discovers a platform-automated-takedown-request channel, then it'll try that channel and give it an hour to take effect before moving onto the host-level strategy; and if it can be detected from e.g. certificate transparency logs that the current ownership of the host is sufficiently long-lived, then additional leeway could be given, upgrading to a 24-72hr wait before host-takedown triggers.)
Will you be moving away from this registrar? It seems like it could very easily be abused again.
I didn't really expect Funko or 10:10 Games to be like that, but then again I didn't expect anyone would like Funko enough to make a fan page about their dolls.
Other companies allow fans to do pretty much whatever you want with their IP as long as you don't turn it into (too much of) a business. Sega has even hired a fan for their remasters rather than DMCA his project into oblivion.
When companies do this, I interpret this as the company giving a clear message: "don't be a fan of our work or we may apply legal pressure".
One registrar off the list of registrars you wanna use.
I'm surprised about their slowness. Again, 2 days ago I sent a request via their web-form and less than 24h later it was resolved.
Disclosure: I know the founder (Lenz).
When I registered a domain with my surname in it, the registrar had an automatic process in place that checked for this trademark and took away access of the domain. So far so good. The problem was that the registrar and its support then ghosted me and also never refunded me for the money already paid to lease the domain for a year. Overall it was a bad experienced with bad communication that made me switch registrar (note: this was a different registrar than mentioned here).
I think one of the problems is that as more and more individual consumers buy domains, certain legal processes and automation are not ready for that. A good registrar should anticipate that an individual private consumer may not have the legal experience or knowledge to deal with just being hit with something they were never explicitly warned of.
I don't think this is good.
Trademarks are country-specific, not global like domains. Further, within a country trademarks are only valid within the scope of certain classes, which means:
* There will often be more than one trademark holder of even non-surname trademarks.
* You can't trademark a surname to prevent its use generally, you can only restrict its use in a narrow sphere.
I understand why domain registrars automatically overenforce their country's trademark laws (they can't deal with the legal complications that will result from them not doing so), but it's very much not good that someone like you can get to a domain for your surname first and be told you can't have it in case the trademark holder (for which class???) might want it.
Domains are also subject to local law! For ccTLDs, it's usually that of the country in question; for gTLD, to my knowledge the US has effective jurisdiction (through ICANN) over at least some of the popular gTLDs such as .com and .net.
"Local law" in this case doesn't just include actual laws on the books, but also the risk and cost of getting sued by either a trademark holder or a non-trademark-infringing domain owner.
This is exactly the type of issue that people usually don't consider when picking a TLD, vanity or otherwise.
Huh, I was always under the assumption that the percentage of domains bought by individual consumers is shrinking. As in, in the early days of the internet until ~2010 where commercialization was only slowly picking up (or only concentrated to a few domains), the majority of domains were personal websites and blogs.
Yes, but a segment of the domain market still buys their name domains and defends them on the Internet.
I bought my fname+lname domain a few years ago, but I'm not planning to surrender it to a random conglomerate.
> As in, in the early days of the internet until ~2010 where commercialization was only slowly picking up (or only concentrated to a few domains), the majority of domains were personal websites and blogs.
A deep part of me hopes this part of the market never dies, for the good health of the Internet's sovereignity.
Funko Pop is an American Company.
BrandShield, the "Brand Protection Software" they used, is based out of Israel.
iwantmyname, the registrar, is from New Zealand.
They got bought out by Team Internet, which is British.
And who knows where all of them are actually registered.
They are all going to point the finger at each other for the problem. Who do you sue, and where?
Funko Pop hired BrandShield, but from what I understand they did so exactly because the latter does all the work without you having to intervene. Kind of like you hiring a lawyer and them using ChatGPT to present the case, full of errors and non-existent sources. The lawyer might have been acting on your behalf, but they didn’t really do so according to your intentions and their fuck up isn’t your fault. On first view I’d say BrandShield is a culprit here, but can’t be so sure about Funko Pop yet.
On the other hand, iwantmyname is absolutely at fault. They took down a client’s website without asking or recourse, then sat on their asses. That’s who you sue, because they’re the ones who ultimately had the power and made the decision that affected itch.io. If iwantmyname wants to sue BrandShield and/or Funk Pop or whatever else in turn, none of your concern. The one’s who hurt the business were iwantmyname by not doing due diligence or contacting the client but just automatically bending over.
Now if they should be sued in Britain or New Zealand, that’s for the lawyers to know.
In fact, all of this is for the lawyers to figure out. I’m not one. I’m merely expressing what makes logical sense to me, which could be incredibly wrong.
BrandShield, Funko, and iwantmyname all caused serious financial harm through, at a minimum, tortious negligence.
I'm not a lawyer, but even a yokel like me knows there's more to this legally than a shrug and "the software did it".
That the magic robot perhaps did it for them matters not at all, in terms of whose fault it is, though a proliferation of magic robots does make junk services like this more of a problem, in that they can flood the internet with nonsense more effectively.
Doesn’t need to be huge – just enough to cover their cost and thereby make it uneconomical to outsource the work these companies are charging their customers for to their targets.
That you have grifters like brandshield is a symptom. Although you should never employ their lawyers for anything either of course. Make the taint stick to them.
- Namecheap
- Cloudflare
- Route 53 (if on AWS)
Any others?
I am fine with the identity verification, but their ticketing system seems to have sent all of my e-mail to their spam box, because they would never respond. I attempted opening tickets explaining the e-mail situation, but they wouldn't listen. In the end, I gave up and let them deactivate the account.
Moved to Porkbun, purchased the exact same domain (no KYC required!), and have been a happy user of their API for about two years now. They also have much more lax requirements for API usage compared to Namecheap. Porkbun also supports WebAuthn and logging in with a security key. It's overall a much nicer service than Namecheap.
As an example; I had a dedicated server that I was leasing that I wanted to upgrade, the sales tech noticed that the plan I was currently on had been retired/replaced and credited my account with difference of what I had payed vs the new payment tier which amounted to six months of billing on the upgraded server. You can't really put a price on that kind of honesty!
Without a doubt, Porkbun is one of the best. Their staff is knowledgeable, helpful and efficient. Highly recommend them.
The full thread is worth reading for more feedback on a range of registrars, particularly Namecheap: https://news.ycombinator.com/item?id=18086522
I strongly encourage people to only recommend domain registrars if they have verified that customer support won’t completely fuck you over when something goes wrong. Recommending registrars when you’ve only experienced the happy path is doing a disservice to the people you are trying to help out.
As well as Gandi, DNSimple was another higher service one I really liked that went crazy on pricing. Agreed the registrar scene nowadays seems like a quite small "do use" list vs a couple of "don't use" :(.
I have one on dynadot because Hover doesn't support the TLD, and the website sure is a lot more awkward.
I currently have some domains there (moved a few years ago from Godaddy), so is there something I need to worry about?
Porkbun is great.
The only issue I experience with Namecheap are included redirects which have something like 90% uptime.
Route53 domains is seriously not needed for anything - just add zone in AWS and point your registrar to new NS.
If you are in Germany donaindiscount24.com is good option too.
- automated notice of trademark infringement from some posted user content, accusing us of "fraud and phishing" (filed by a third party on behalf of Meta)
- that user content was immediately deleted upon receiving the notice
- exactly a week later, our host (Heroku) banned our account with a generic no-reason "Your account has been banned."
Total downtime of about 24 hours until it was resolved; luckily, Heroku's support simply unbanned the account whenever I reached out to ask why we were banned. Migrating to another host wouldn't have taken much longer, but would have been a pain.
Goes to show layering a couple automated processes together can have pretty devastating false-positives. I'm glad there was a human in the loop at Heroku I could reach to get things sorted out relatively quickly; also glad to see Itch.io is back up and got it sorted out relatively quickly as well.
Might be useful to send letters to Disney's and Mattel's legal departments. Mattel paid a lot of money for that Disney license. Disney is very protective of those licenses. Mattel lost the Disney license to Hasbro for a few years due to overproduction of low quality dolls. I'm surprised to see Funko selling low-quality Disney dolls. They degrade a Disney brand.
[1] https://funko.com/pop-tyrannosaurus-rex-fossil/80225.html
[2] https://licensinginternational.org/news/mattel-and-universal...
[3] https://funko.com/fandoms/animation-cartoons/disney-princess...
[4] https://corporate.mattel.com/news/mattel-and-disney-announce...
Besides, Disney is perfectly capable of degrading their own brand.
But I agree this is most probably futile :)
Disney chases down little daycare centers: https://www.snopes.com/fact-check/daycare-center-murals/
They would not miss Funko.
--------
Your request has been updated. To add additional comments, reply to this email.
9 Dec 2024, 10:57 UTC
Hello and thank you for your message.
The domain name was already reinstated earlier today after the registrant finally responded to our notice and took appropriate action to resolve the issueI believe we've reached a point where any activity on the web can vanish overnight due to an AI or an algorithm making decisions based on obscure criteria.
I've had these domains for ten years, now all of a sudden this is super urgent and if I'm on holiday that'd be a real shame I guess
So I contact the registrar and a link to the relevant legislation was sufficient to send them a perfectly agreeably censored version of my identity document (removing just irrelevant information they can't use or verify anyway), but apparently all they do is forward it to support@afnic.fr and not actually mark the domain holder as verified. So AFNIC, predictably, rejects it because GDPR doesn't exist in France
I saw no other choice but to send everything into AFNIC's email inbox / support system, which famously never get leaked and they assured me was "highly" secured when I asked to at least remove it after verification
With just 7 days' notice and half of that going to the distraction of a registrar, there's also no way to figure out what's even going on or have any sort of conversation. They hold all the cards and you jump when they say hop
I'm considering my options for any TLDs owned by AFNIC... evidently .io isn't better, but how to know who is
Also, why is the domain registrar even being contacted here? I thought the general idea was that you'd first contact the site owner and wait for a response, and if there's no response in a certain amount of time, then you might contact the registrar or something. No one should be going over the heads of website owners and creators for matters like this, especially not as their first resort.
In a logical world, they'd contact Itch.io and Itch.io would take down the page (which they did), and that would be it. No need to involve the registrar at all in a case like this one.
Besides, with 26K followers on BlueSky vs 173K on Twitter, I'd say the engagement on the former is significantly higher any way.
This one uses the "DID", not the handle, and will not 404: https://bsky.app/profile/did:plc:oy37ivqnriw6nx3lrbcht2u3/po... (cc dang)
Open issue regarding making bsky URLs less fragile while also not looking ugly: https://github.com/bluesky-social/social-app/issues/1221
This certainly changed my morning routine! I am glad to hear that the reason wasn't me deleting my Twitter from my page. My first panic reaction was thinking it was me who's caused it, due to some kind of ad revenue conflict.
Ever seen the movie Summer Wars? I felt like the protagonist for a moment there, but glad it turns out it was just some 2020s AI nonsense.
Either way, there's surely an engineer somewhere who's very busy right now.
The fact that lawyers and the "lawyer system", in conjunction with prosecutorial offices and the police, has made this expensive and pretty impossible for 99% of people and companies is a huge problem. It basically nullifies the whole point of government as protector of people's rights and enforcer of laws.
Don’t look to large, well-known registrars. I would suggest that you look for local registrars in your area. The TLD registry for your country/area usually has a list of the authorized registrars, so you can simply search that for entities with a local address.
Disclaimer: I work at such a small registrar, but you are not in our target market.
The simple answer is: Choose a registrar without significant external investors.
I never was able to get it cleared. It's crazy the power that those spam list can have and they care very little about false positives
Itch.io: "This is not a joke, Funko just called my mom"
If you want to get with a registrar who is actually clueful about takedowns, we can help you out.
1. internet.bs No Bullshit Domains. I am using them since 10 years, and I am very happy. Email is comparatively expensive, but you can buy this separately from infomaniak.com for 18 EURO a year.
2. If you need country TLDs, this may be a good option: inwx.com
