Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub publishes DMCA deletion notifications sent by Bilibili

github.com

Post reply on HN
Print view View original

101–110 of 117 posts

Re: GitHub publishes DMCA deletion notifications sent by Bilibili

#101

Post by tinus_hn »

chrismeller wrote: post #86
tinus_hn wrote: post #83

Earlier quoted context omitted.

The choices are: 1. api key is publicly readable in a configuration files you ship 2. api key is compiled into the binary you ship. There is only obfuscation. Then again api keys are not security keys.

But literally in this case it was security keys. Even including an API key into the binary build is avoidable. Add an OAuth-style negotiation for the key as the first startup process. Start digging deeper and there are fewer and fewer reasons.

You need an api key if you show Google Maps in your app. The api key allows your app, running on the users device, to get the map tiles. Is it possible to do that without the users device having access to the key? No. Does that require user login? No. Does ‘OAuth style negotiation’ have anything to do with that? No. Is it security? No. Can you change how Google Maps works? No.

Re: GitHub publishes DMCA deletion notifications sent by Bilibili

#102

Post by pluma »

andrew_n wrote: post #87
pluma wrote: post #50

Earlier quoted context omitted.

I'll never understand what market cap has to do with company size. Stock prices are basically an arbitrary value mostly determined by how much people buying stock think the stock is worth, are they not? Correct me if I'm wrong but theoretically an overhyped two man operation running at a financial loss could generate the same market cap as a much larger company with massive profits? As I understand it, the only somew…

Market capitalization = share price * number of shares As a first approximation, this is how much money it would cost to buy all the shares. You’d pay $SHARE_PRICE for each share and then own the entire company. Therefore the concept is a decent measure for what the market has decided the company as a whole is worth. A company with 10x the market cap of a competitor is considered 10x bigger, because it would take abo…

I understand how valuations work but I guess where I'm confused is that people on HN seem to conflate market value with size or even revenue.

After some googling it seems that my intuition about the relevance of stock prices is mostly right:

https://eu.usatoday.com/story/money/columnist/krantz/2012/10...

> If the stock price falls, these investors lose money, not the company.

The stock price is entirely speculative and detached from the company's actual performance. At best it's informed by a perception of the company's performance and an expectation of how the stock price might change in the future in reaction to the company's future performance.

While shares will be worthless if the company goes bankrupt, the company won't be directly affected if the stock market plummets -- except in situations where (additional) stock can be used as a currency in lieu of actual cash, like buying out competitors.

So to answer my own question: market cap (but mostly share price really) is only a measure of company size in so far as it indicates how much money the company could generate by selling additional shares. It doesn't provide any indication of how well the company is doing financially, how many employees it has, how much market share it serves or any other measure of size BUT generally people are willing to pay more for shares of companies that are likely to grow or at least outperform their competitors in the short term.

EDIT: In other words, yes, an overhyped two man operation running at a financial loss could end up with a massive market cap but in practice it's unlikely to happen because hype rarely works that well.

Re: GitHub publishes DMCA deletion notifications sent by Bilibili

#103

Post by danenania »

pavelbr wrote: post #91
dustinmoris wrote: post #36

Not great... MD5 password hashing: https://github.com/swituo/openbilibili-go-common/blob/8866d1... Hardcoded credentials: https://github.com/swituo/openbilibili-go-common/blob/8866d1... More hard coded secrets: https://github.com/swituo/openbilibili-go-common/blob/8866d1... This configuration is my favourite: https://github.com/swituo/openbilibili-go-common/blob/8866d1... And of course, RSA keys which they use for al…

I'm a new developer (an intern, actually). I just started writing a system that requires a couple secret strings. Currently I just have them as constants with my code, with the idea that I'll figure out something to do with them once I make sure everything is working. What should I do with those secrets though? I'm not sure how to store them securely. So far I've been considering putting them in the server configurat…

We built https://www.envkey.com to solve this problem in a secure and developer-friendly way—perhaps it can help!

Re: GitHub publishes DMCA deletion notifications sent by Bilibili

#104

Post by ddtaylor »

gergles wrote: post #81
praptak wrote: post #18

Code base is fair game DMCA-wise. I wonder about the private keys though. I don't think they are copyrightable (although it would cool to have a poem as the private key). So, does DMCA cover that too?

> (although it would cool to have a poem as the private key) Apple does this with Mac OS X. The System Management Controller contains a key, and the "Dont Steal Mac OS X" kernel extension (which checks for that key) contains a poem that must be present for Mac OS X to run. http://osxdaily.com/2010/03/19/anti-piracy-message-in-mac-os...

That's the saddest poem I've ever read.

Re: GitHub publishes DMCA deletion notifications sent by Bilibili

#105

Post by ddtaylor »

dis-sys wrote: post #54

Sure, Bilibili's copyright must be respected, no question on that whatsoever. That being said, let's have a look on how this multi-billion company treats its programmers - flv.js is opened sourced by bilibili, it has 14,668 starts on github [1]. Bilibili paid the smart & hardworking programmer who single handedly started this project and made it popular $700 USD per month [2], there is a very long zhihu.com thread [2…

Even in China, don't you chose to work for someone?

Re: GitHub publishes DMCA deletion notifications sent by Bilibili

#106

Post by princekolt »

pavelbr wrote: post #91
dustinmoris wrote: post #36

Not great... MD5 password hashing: https://github.com/swituo/openbilibili-go-common/blob/8866d1... Hardcoded credentials: https://github.com/swituo/openbilibili-go-common/blob/8866d1... More hard coded secrets: https://github.com/swituo/openbilibili-go-common/blob/8866d1... This configuration is my favourite: https://github.com/swituo/openbilibili-go-common/blob/8866d1... And of course, RSA keys which they use for al…

I'm a new developer (an intern, actually). I just started writing a system that requires a couple secret strings. Currently I just have them as constants with my code, with the idea that I'll figure out something to do with them once I make sure everything is working. What should I do with those secrets though? I'm not sure how to store them securely. So far I've been considering putting them in the server configurat…

The long standard for lots of software is to have a blank "file.conf.example" file (with only the variable names but blank values) which you commit to git, and have the code look for a file named "file.conf" which you explicitly exclude from git using gitignore. This allows you to have a template config file while still preventing the secrets from being written to git. Then you can have the software provide some sort of alert when it is launched for the first time saying "config file not found, please duplicate file.conf.example, fill in your details, and name it file.conf."

Re: GitHub publishes DMCA deletion notifications sent by Bilibili

#107

Post by alias_neo »

colejohnson66 wrote: post #88
heavenlyblue wrote: post #85

Earlier quoted context omitted.

>> you find that everyone is hard coding secrets in code and standing up some secrets infrastructure would take weeks to get right. You open up the code, find all of the secrets (e.g. using high-entropy substring search), replace them with access to a global variable, and set it from a file set by a configuration from a command line. Done.

And when your manager says don’t do that because it’s a waste of time?

My honest answer to that is; get it in writing, because WHEN the shit hits the fan, you've got evidence in your favour.

Managers always want compromises for cost or speed, is up to us to make them understand which compromises they really don't want to make. If they want to make it anyway, get proof that it was done on their orders.

Re: GitHub publishes DMCA deletion notifications sent by Bilibili

#108

Post by CameronNemo »

duncan-donuts wrote: post #80
gerbilly wrote: post #78

I use something like this to set a few global variables at build time. This keeps my secrets out of the source code. go build \ -ldflags="\ -X main.programVersion=`git describe` \ -X main.username=$USERNAME \ -X main.password=$PASSWORD" This isn't perfect, of course, because you can just use strings(1) to find the secrets embedded in the binary, but it is a step up from what they did. It's fine for our internal go ap…

I would read connection string information from the env. This[0] might be useful if you’re not familiar with 12 factor apps. 0: https://12factor.net/config

An example configuration file is also acceptable. It is also less prone to leakage if your application runs other untrusted (or simply less trusted) code and does not sanitize the environment first.

Re: GitHub publishes DMCA deletion notifications sent by Bilibili

#109

Post by nemothekid »

heavenlyblue wrote: post #85
nemothekid wrote: post #46

Earlier quoted context omitted.

It’s one of those things that you dangerously start when your project is small then when you balloon in size, you find that everyone is hard coding secrets in code and standing up some secrets infrastructure would take weeks to get right. It’s easier now with tools like Vault but let’s say you joined bilibili today - where do you even begin? You have a massive cultural problem before you even begin to tackle the tech…

>> you find that everyone is hard coding secrets in code and standing up some secrets infrastructure would take weeks to get right. You open up the code, find all of the secrets (e.g. using high-entropy substring search), replace them with access to a global variable, and set it from a file set by a configuration from a command line. Done.

>You open up the code, find all of the secrets (e.g. using high-entropy substring search), replace them with access to a global variable, and set it from a file set by a configuration from a command line.

Huh? Amazingly you make it sound so easy when it's anything but. Where is this file? How is it deployed? How is it rotated? If I have 10,000 VMs, how do I deliver that file to those machines? If my VMs aren't persistent, how do I ensure new VMs are deployed with this file?

Or were you thinking that they would just ssh into production and scp the file into there? To me you glossed over so many details that you hardly solved the problem at all. Replacing the secrets in source code is the _easy_ part. Deploying secrets is the hard part.

There are tools out there to make this easy, but (1) they almost always make things harder for developers and (2) they almost always require a large infrastructure change. Sure, if your deployment is small enough where you could just SSH into a single prod server and scp a file - then you are likely miles ahead - in terms of both security and culture, but changing the culture is harder than it looks.

I don't want to sound like I am making excuses for them - but I only want to show how shortcuts when you are small can snowball into a culture where you have a gaping wound that may be difficult to fix.

Re: GitHub publishes DMCA deletion notifications sent by Bilibili

#110

Post by devrod »

phyzome wrote: post #74
rubatuga wrote: post #45

Earlier quoted context omitted.

This might be off topic, but why create an account just to say this?

Everyone creates their account at some point, probably in order to respond to something...

I lurked for years both here and on reddit before creating an account. I finally created one when I wanted to say something.
Post reply on HN