Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub publishes DMCA deletion notifications sent by Bilibili

github.com

Post reply on HN
Print view View original

41–50 of 117 posts

Re: GitHub publishes DMCA deletion notifications sent by Bilibili

#41

Post by yorwba »

counter2015 wrote: post #38
4684499 wrote: post #33

Earlier quoted context omitted.

> illegally laid off Source please?

> illegally laid off for this part, I can't give credible sources, I know it from hearsay

You could link to the hearsay, assuming it was online.

FWIW, the report you link in your other comment has a screenshot of a conversation where someone claims that the code was leaked by an intern from Nankai University who didn't know how to use git. [1] That they're identified by their university makes me suspect that it's a rumor (edit: making fun of the university), though.

[1] https://www.heibai.org/zb_users/upload/2019/04/2019042306214...

Re: GitHub publishes DMCA deletion notifications sent by Bilibili

#42

Post by alias_neo »

dustinmoris wrote: post #36

Not great... MD5 password hashing: https://github.com/swituo/openbilibili-go-common/blob/8866d1... Hardcoded credentials: https://github.com/swituo/openbilibili-go-common/blob/8866d1... More hard coded secrets: https://github.com/swituo/openbilibili-go-common/blob/8866d1... This configuration is my favourite: https://github.com/swituo/openbilibili-go-common/blob/8866d1... And of course, RSA keys which they use for al…

I've always wondered, how it could be that someone can be smart enough to write what on the surface is some fairly clean Golang, and yet at the same time, dumb enough to put secrets in the code.

I can forgive the use of MD5, because they probably just don't know their hashing/crypto but secrets? It's literally in the name.

There is so much material in your 5 links alone, that anyone who desires could utterly own their infrastructure, and then some.

Re: GitHub publishes DMCA deletion notifications sent by Bilibili

#44

Post by usernam33 »

avip wrote: post #14

Too late. GitHub is scraped very frequently (as in seconds) for sensitive stuff. It’s out and github cannot do anything about it

"...the median time to discovery for a key leaked to GitHub is 20 seconds..." https://news.ycombinator.com/item?id=19602279

Re: GitHub publishes DMCA deletion notifications sent by Bilibili

#46

Post by nemothekid »

alias_neo wrote: post #42
dustinmoris wrote: post #36

Not great... MD5 password hashing: https://github.com/swituo/openbilibili-go-common/blob/8866d1... Hardcoded credentials: https://github.com/swituo/openbilibili-go-common/blob/8866d1... More hard coded secrets: https://github.com/swituo/openbilibili-go-common/blob/8866d1... This configuration is my favourite: https://github.com/swituo/openbilibili-go-common/blob/8866d1... And of course, RSA keys which they use for al…

I've always wondered, how it could be that someone can be smart enough to write what on the surface is some fairly clean Golang, and yet at the same time, dumb enough to put secrets in the code. I can forgive the use of MD5, because they probably just don't know their hashing/crypto but secrets? It's literally in the name. There is so much material in your 5 links alone, that anyone who desires could utterly own thei…

It’s one of those things that you dangerously start when your project is small then when you balloon in size, you find that everyone is hard coding secrets in code and standing up some secrets infrastructure would take weeks to get right. It’s easier now with tools like Vault but let’s say you joined bilibili today - where do you even begin? You have a massive cultural problem before you even begin to tackle the technical one. Even a smart engineer may just resign to doing things the wrong way than trying to fight a huge political battle.

Re: GitHub publishes DMCA deletion notifications sent by Bilibili

#47

Post by sandworm101 »

neiman wrote: post #40
praptak wrote: post #18

Code base is fair game DMCA-wise. I wonder about the private keys though. I don't think they are copyrightable (although it would cool to have a poem as the private key). So, does DMCA cover that too?

Good question. My guess is that the only thing needed to be copyrightable is the one thing which is not.

They are copyrightable as works, and even if they arent then they are as devices protecting works.

The level of creativity needed for copyright is minimal. A key pair is generated by machine, but at the request of a human according to parameters selected by the human. That is likely enough.

Re: GitHub publishes DMCA deletion notifications sent by Bilibili

#48

Post by pferde »

ghomrassen wrote: post #2

Heard about this a couple days ago, crazy stuff. For those who don't know, bilibili is a massive video hosting platform in China aimed toward the younger generation. So the question is who leaked it and why? Just a disgruntled employee or the effect of 996?

Probably a little of each. The repository "title" of swituo/openbilibili-go-common, when pushed through google translate, says:

"I don't know if these are embarrassing... The troubles of morality are going out and turning right to pay attention to 996.icu"

Re: GitHub publishes DMCA deletion notifications sent by Bilibili

#49

Post by raxxorrax »

alias_neo wrote: post #42
dustinmoris wrote: post #36

Not great... MD5 password hashing: https://github.com/swituo/openbilibili-go-common/blob/8866d1... Hardcoded credentials: https://github.com/swituo/openbilibili-go-common/blob/8866d1... More hard coded secrets: https://github.com/swituo/openbilibili-go-common/blob/8866d1... This configuration is my favourite: https://github.com/swituo/openbilibili-go-common/blob/8866d1... And of course, RSA keys which they use for al…

I've always wondered, how it could be that someone can be smart enough to write what on the surface is some fairly clean Golang, and yet at the same time, dumb enough to put secrets in the code. I can forgive the use of MD5, because they probably just don't know their hashing/crypto but secrets? It's literally in the name. There is so much material in your 5 links alone, that anyone who desires could utterly own thei…

> dumb enough to put secrets in the code.

Man, I have tons of auth data in services like AWS just in environment variables. But pushing your rsa key to github must have happened on a bad monday.

I do often have auth info in code, plainly because of time constraints. You just have to remember it before pushing anything on github.

But aside from that, is it possible to file a DMCA for anything that has been forked if it was published under a license that permitted that action?

Re: GitHub publishes DMCA deletion notifications sent by Bilibili

#50

Post by pluma »

rococode wrote: post #31
ghomrassen wrote: post #2

Heard about this a couple days ago, crazy stuff. For those who don't know, bilibili is a massive video hosting platform in China aimed toward the younger generation. So the question is who leaked it and why? Just a disgruntled employee or the effect of 996?

Elaborating a bit more on the size of bilibili: it has around 100m monthly users and trades as NASDAQ:BILI with a market cap of ~$5.7B. This is not some small-time shop, as far as social media companies go bilibili is one of the more established companies out there.

I'll never understand what market cap has to do with company size. Stock prices are basically an arbitrary value mostly determined by how much people buying stock think the stock is worth, are they not?

Correct me if I'm wrong but theoretically an overhyped two man operation running at a financial loss could generate the same market cap as a much larger company with massive profits? As I understand it, the only somewhat tangible factor is the actual money in the company which again can be bloated by overeager investors.

I'm not being facetious, I'm genuinely curious about the rationale.

Post reply on HN