Why Did Brand Protection Take Itch.io Offline?

TL;DR

Itch.io went offline because BrandShield reported an alleged infringement to its DNS provider, iwantmyname, instead of first contacting the developer or platform responsible for the disputed content. The incident shows how one user’s actions can threaten every layer beneath them, while poor escalation procedures can turn a narrow complaint into a platform-wide outage.

Transcript

if you're a prolific enough gamer you might have noticed that hiio was down a few days ago the reason is utter chaos throughout my years I've seen a lot of different ways that a website can go down I've never seen one quite as weird dumb and just worth talking about as this one quickly from their words hiio has been taken down by original Funko bec... Read More

Key Insights

• The itch.io outage resulted from an alleged infringement report reaching DNS provider iwantmyname, which disabled the domain even though the disputed material concerned content associated with a user or developer rather than the entire platform.
• The central failure was an escalation that bypassed the alleged infringing developer and itch.io itself. BrandShield approached infrastructure lower in the dependency chain, where action against one complaint could remove access to every creator and customer using the service.
• Layered internet services create shared liability because harmful activity at the user level can trigger consequences for application developers, platform owners, hosting providers, DNS companies, registrars, and internet service providers that did not create the offending material.
• BrandShield stated that it requested removal of the disputed URL rather than the entire itch.io domain. The presenter argues that reporting the issue to a DNS provider made a broad shutdown foreseeable because the complaint was directed to the wrong operational layer.
• Iwantmyname disabled a highly used domain after BrandShield allegedly threatened escalation involving registrars or internet service providers. The presenter characterizes this response as panic and incompetence because itch.io reportedly answered the complaint before the domain was disabled.
• UploadThing experienced a comparable escalation when an end user uploaded spyware through a customer’s application. Since Cloudflare served the file from its infrastructure, internet service providers could potentially block Cloudflare addresses, creating pressure throughout the entire service chain.
• UploadThing responded to abuse risks by planning to prevent free-tier users from hosting runnable or executable formats, including Bash scripts, CMD files, and EXE files. It also planned additional scanning and filtering to detect harmful uploads earlier.
• Effective abuse handling depends on contacting the highest responsible layer that can remove the specific content. Narrow notification gives developers and platforms an opportunity to delete a file, suspend a malicious user, or improve filtering without disrupting unrelated services and customers.

Questions & Answers

Q: Why did itch.io go offline?

Itch.io went offline after BrandShield, working to protect Funko’s brand, identified alleged infringement connected to an itch.io subdomain and reported it to DNS provider iwantmyname. According to the transcript, iwantmyname ignored itch.io’s responses and disabled the domain. This converted a complaint about specific user-distributed content into an outage affecting the entire game marketplace and its users.

Q: Who should have received the infringement complaint first?

The complaint should first have gone to the game developer allegedly distributing unauthorized Funko-related material. If direct contact was impractical or unsuccessful, itch.io was the next appropriate recipient because it operated the platform and could remove the content or discipline the responsible account. Instead, the report bypassed both layers and reached the DNS provider, where enforcement affected the whole domain.

Q: What role did BrandShield play in the itch.io takedown?

BrandShield acted as Funko’s contracted brand-protection intermediary. Its AI-driven platform identified what it considered an infringement and submitted an abuse report concerning an itch.io subdomain. BrandShield later said it requested removal of the disputed URL, not the whole domain. The criticism is that it contacted the DNS provider rather than itch.io, creating conditions for an unnecessarily broad response.

Q: Why was disabling the entire itch.io domain disproportionate?

The alleged problem concerned software or content distributed by an individual developer through itch.io, not conduct attributed to every developer, customer, or the platform itself. Disabling the entire domain prevented access to unrelated games and creators. A proportionate response would have targeted the disputed URL, file, project, or account after notifying the developer or itch.io and allowing specific corrective action.

Q: How can one user create problems across an internet service chain?

A user can upload or distribute harmful material through an application that depends on several underlying providers. The application developer, service platform, host, DNS provider, and other infrastructure companies can then receive abuse complaints or face blocking. Because each lower layer supports many unrelated customers, enforcement at that level can spread the consequences of one user’s misconduct across numerous services and users.

Q: What happened when spyware was uploaded through UploadThing?

An end user uploaded spyware through an application built by an UploadThing customer. The file was served using Cloudflare infrastructure, so an internet service provider could respond by blocking Cloudflare addresses. Cloudflare notified UploadThing, which then had to remove the file and address the customer account. The customer might also need to identify and ban the individual user responsible for the upload.

Q: How did UploadThing change its policies after the malware incident?

UploadThing decided to restrict the hosting of runnable and executable files on free tiers. The presenter specifically names Bash scripts, CMD files, and EXE files as formats that free-tier users would no longer be allowed to host. The service also planned stronger scanning and filtering so dangerous files could be detected earlier, before complaints threatened providers lower in the infrastructure chain.

Q: How should platforms handle abuse reports without causing broad outages?

Abuse reports should begin with the party closest to and most capable of correcting the specific violation. That may be the uploader, application developer, or platform operator. Providers should give responsible parties notice and an opportunity to remove content, suspend users, or improve safeguards. Escalation to DNS, hosting, registrar, or internet service layers should follow only when targeted remedies fail.

Summary & Key Takeaways

• Itch.io temporarily disappeared after BrandShield, acting for Funko, reported alleged infringing content associated with an itch.io subdomain. The complaint reached DNS provider iwantmyname, which disabled the entire domain despite itch.io’s responses. The platform later returned online, but the outage affected a service described as essential to indie game distribution.

• The presenter maps the incident as a layered dependency chain involving users, game developers, itch.io, its DNS provider, registrars, and governing standards. Although the alleged violation originated with content distributed by a developer, enforcement skipped the developer and platform, reaching infrastructure capable of disabling access to the entire service instead.

• A similar hierarchy affected UploadThing when an end user uploaded spyware through a customer’s application. Because Cloudflare infrastructure served the file, internet service providers could block Cloudflare addresses. The resulting escalation prompted UploadThing to restrict executable files on free tiers and pursue stronger scanning, filtering, notification, and enforcement measures.