Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub publishes DMCA deletion notifications sent by Bilibili

github.com

Post reply on HN
Print view View original

111–117 of 117 posts

Re: GitHub publishes DMCA deletion notifications sent by Bilibili

#111

Post by tracker1 »

pavelbr wrote: post #91
dustinmoris wrote: post #36

Not great... MD5 password hashing: https://github.com/swituo/openbilibili-go-common/blob/8866d1... Hardcoded credentials: https://github.com/swituo/openbilibili-go-common/blob/8866d1... More hard coded secrets: https://github.com/swituo/openbilibili-go-common/blob/8866d1... This configuration is my favourite: https://github.com/swituo/openbilibili-go-common/blob/8866d1... And of course, RSA keys which they use for al…

I'm a new developer (an intern, actually). I just started writing a system that requires a couple secret strings. Currently I just have them as constants with my code, with the idea that I'll figure out something to do with them once I make sure everything is working. What should I do with those secrets though? I'm not sure how to store them securely. So far I've been considering putting them in the server configurat…

At the VERY least, extract them to Environment Variables... ensure .env is on your .gitignore, and have your localized/dev configs in your local .env ... production environments should have them set. For more complex environments you can set via a secure key service, or build from there.

Again,. the LEAST you should do is use environment variables and keep the actual keys out of your code. .env files are a developer convenience measure, and easy enough to use side channels. I go a step further and ensure a fallback that might be the dev environment, but that is not the same as any higher environment

Re: GitHub publishes DMCA deletion notifications sent by Bilibili

#112

Post by tracker1 »

tinus_hn wrote: post #83
chrismeller wrote: post #73

Earlier quoted context omitted.

That’s how it starts though. If everything is provided at deploy and nothing is ever embedded in source code there’s no way you can end up in this situation. In some industries it’s also an audit or legal requirement that developers not have access to production credentials, so there’s no other way to reasonably handle that. Edit: also, rebuilding your source because an API key changed... no thanks.

The choices are: 1. api key is publicly readable in a configuration files you ship 2. api key is compiled into the binary you ship. There is only obfuscation. Then again api keys are not security keys.

3. API key is in an environment variable configured IN the environment.

4. You use a secret service that has pk or secure access from the service machine to retrieve secure configs/settings from.

Re: GitHub publishes DMCA deletion notifications sent by Bilibili

#113

Post by tracker1 »

alias_neo wrote: post #56
nemothekid wrote: post #46

Earlier quoted context omitted.

It’s one of those things that you dangerously start when your project is small then when you balloon in size, you find that everyone is hard coding secrets in code and standing up some secrets infrastructure would take weeks to get right. It’s easier now with tools like Vault but let’s say you joined bilibili today - where do you even begin? You have a massive cultural problem before you even begin to tackle the tech…

Oh you're absolutely right, but there are some fairly straightforward steps to take to mitigate the risk with little effort. You can take arguments or env vars or config files (not added to Git) for your secrets. If you begin with a system of not putting the secrets in the code, ever, it's fairly straightforward to not make this mistake. A few minutes of setup on a repository and a mindfulness to be sure not to commi…

For reference, here is my getConfig which uses the environment for configuration options. It's really easy enough to start with something like this, and add it in at the baseline.

https://gist.github.com/tracker1/fcc39f40a0d14648501d329c7bd...

Re: GitHub publishes DMCA deletion notifications sent by Bilibili

#114

Post by dis-sys »

ksec wrote: post #97
dis-sys wrote: post #54

Sure, Bilibili's copyright must be respected, no question on that whatsoever. That being said, let's have a look on how this multi-billion company treats its programmers - flv.js is opened sourced by bilibili, it has 14,668 starts on github [1]. Bilibili paid the smart & hardworking programmer who single handedly started this project and made it popular $700 USD per month [2], there is a very long zhihu.com thread [2…

> $700 is about 10% of the fair market rate in China for skills like that. So you are suggesting $7000 for skills like that? There are still countless PHP / Golang / Rails jobs going for under $2K. While I agree $700 is insanely low even if you are in some Tier 3 cities, I don't think 10% paint an accurate picture of the current state of Programming Paid in China.

As clearly mentioned in the reply, $7,000/month is the fair market rate for someone who can propose/promote/complete such a project with visible impact on the community.

Re: GitHub publishes DMCA deletion notifications sent by Bilibili

#115

Post by dis-sys »

ddtaylor wrote: post #105
dis-sys wrote: post #54

Sure, Bilibili's copyright must be respected, no question on that whatsoever. That being said, let's have a look on how this multi-billion company treats its programmers - flv.js is opened sourced by bilibili, it has 14,668 starts on github [1]. Bilibili paid the smart & hardworking programmer who single handedly started this project and made it popular $700 USD per month [2], there is a very long zhihu.com thread [2…

Even in China, don't you chose to work for someone?

oh, you can ask the same question to those millions of Chinese developers forced to work 996. surely that is the solution to the problem.

Re: GitHub publishes DMCA deletion notifications sent by Bilibili

#116

Post by chrismeller »

dpark wrote: post #96
chrismeller wrote: post #93

Earlier quoted context omitted.

Case in point: valid user credentials and it doesn’t matter what app is trying to authenticate. Issue a different key for every user (or every user per login or device) and your problem is solved. Even if your app doesn’t require any login there’s no reason you shouldn’t go through the same process. Every device gets its own key and then you apply limits to it...

OK, this depends on what you mean by an API key. If you are referring to a security token that identifies the user, then yes, you should always be creating a new key per user, and often per session. However the term API key may also refer to an App key, intended to identify all users of a given app. The intention there is to be able to engage and widespread revocation or throttling in case an app is misbehaving or co…

I was actually referring to both, and I think the same process applies. Even if the API key is not for your service (like, say, a Google Maps key) there isn't any reason you can't fetch that dynamically from your server. There are also various solutions for secret storage on every platform (iOS and Android at least) that you could use to store it, rather than it being "public" in the app package.

Re: GitHub publishes DMCA deletion notifications sent by Bilibili

#117

Post by ddtaylor »

dis-sys wrote: post #115
ddtaylor wrote: post #105

Earlier quoted context omitted.

Even in China, don't you chose to work for someone?

oh, you can ask the same question to those millions of Chinese developers forced to work 996. surely that is the solution to the problem.

I don't know much about it, how are they forced? If they don't want to work, what happens?
Post reply on HN