Apart from the storing secret in repository, I'm quite impressed by their repository structure. It looks a lot better than the mess I often see in our internal projects.
GitHub publishes DMCA deletion notifications sent by Bilibili
51–60 of 117 posts
Re: GitHub publishes DMCA deletion notifications sent by Bilibili
#52Earlier quoted context omitted.
Elaborating a bit more on the size of bilibili: it has around 100m monthly users and trades as NASDAQ:BILI with a market cap of ~$5.7B. This is not some small-time shop, as far as social media companies go bilibili is one of the more established companies out there.
I'll never understand what market cap has to do with company size. Stock prices are basically an arbitrary value mostly determined by how much people buying stock think the stock is worth, are they not? Correct me if I'm wrong but theoretically an overhyped two man operation running at a financial loss could generate the same market cap as a much larger company with massive profits? As I understand it, the only somew…
Among other things, market cap gives an indication of the future value investors place in the company. Your 2-man shop would unlikely have a similar market cap unless they can demonstrate some blindingly simple strategy to take over the world. Your big corp already has access to a large userbase (100m users in Bilibili's case if the previous poster is to be believed). That makes future growth and profits much more likely.
Re: GitHub publishes DMCA deletion notifications sent by Bilibili
#53Earlier quoted context omitted.
Elaborating a bit more on the size of bilibili: it has around 100m monthly users and trades as NASDAQ:BILI with a market cap of ~$5.7B. This is not some small-time shop, as far as social media companies go bilibili is one of the more established companies out there.
I'll never understand what market cap has to do with company size. Stock prices are basically an arbitrary value mostly determined by how much people buying stock think the stock is worth, are they not? Correct me if I'm wrong but theoretically an overhyped two man operation running at a financial loss could generate the same market cap as a much larger company with massive profits? As I understand it, the only somew…
Well if your company only has one product with all the secrets leaked on github, it matters whether the company was worth 10 Million or 6 Billion before bad things happen.
Re: GitHub publishes DMCA deletion notifications sent by Bilibili
#54Sure, Bilibili's copyright must be respected, no question on that whatsoever. That being said, let's have a look on how this multi-billion company treats its programmers -
flv.js is opened sourced by bilibili, it has 14,668 starts on github [1]. Bilibili paid the smart & hardworking programmer who single handedly started this project and made it popular $700 USD per month [2], there is a very long zhihu.com thread [2] on this matter with 4 million views and almost 400 detailed responses. $700 is about 10% of the fair market rate in China for skills like that.
Sorry, but I am not going to take the moral high ground and defend bilibili's rights any time soon. It is a company violating the rights of its programmers on hourly basis.
Shame on you BiliBili.
Re: GitHub publishes DMCA deletion notifications sent by Bilibili
#55Earlier quoted context omitted.
I've always wondered, how it could be that someone can be smart enough to write what on the surface is some fairly clean Golang, and yet at the same time, dumb enough to put secrets in the code. I can forgive the use of MD5, because they probably just don't know their hashing/crypto but secrets? It's literally in the name. There is so much material in your 5 links alone, that anyone who desires could utterly own thei…
> dumb enough to put secrets in the code. Man, I have tons of auth data in services like AWS just in environment variables. But pushing your rsa key to github must have happened on a bad monday. I do often have auth info in code, plainly because of time constraints. You just have to remember it before pushing anything on github. But aside from that, is it possible to file a DMCA for anything that has been forked if i…
I think they examples you've listed are different, and more acceptable than pushing secrets and private keys to Github because you had dozens of them hard-coded.
As for the aside, I imagine (with no background knowledge here) that as "owner" if you accidentally published something within that licensed code that does not belong or isn't covered by that license, you should probably have the right to remove it
Re: GitHub publishes DMCA deletion notifications sent by Bilibili
#56Earlier quoted context omitted.
I've always wondered, how it could be that someone can be smart enough to write what on the surface is some fairly clean Golang, and yet at the same time, dumb enough to put secrets in the code. I can forgive the use of MD5, because they probably just don't know their hashing/crypto but secrets? It's literally in the name. There is so much material in your 5 links alone, that anyone who desires could utterly own thei…
It’s one of those things that you dangerously start when your project is small then when you balloon in size, you find that everyone is hard coding secrets in code and standing up some secrets infrastructure would take weeks to get right. It’s easier now with tools like Vault but let’s say you joined bilibili today - where do you even begin? You have a massive cultural problem before you even begin to tackle the tech…
Oh you're absolutely right, but there are some fairly straightforward steps to take to mitigate the risk with little effort.
You can take arguments or env vars or config files (not added to Git) for your secrets. If you begin with a system of not putting the secrets in the code, ever, it's fairly straightforward to not make this mistake.
A few minutes of setup on a repository and a mindfulness to be sure not to commit any new secret files that may be in use (and add them to the .gitignore) is a great start before getting to secret management a la Vault.
Re: GitHub publishes DMCA deletion notifications sent by Bilibili
#57Heard about this a couple days ago, crazy stuff. For those who don't know, bilibili is a massive video hosting platform in China aimed toward the younger generation. So the question is who leaked it and why? Just a disgruntled employee or the effect of 996?
Probably a little of each. The repository "title" of swituo/openbilibili-go-common, when pushed through google translate, says: "I don't know if these are embarrassing... The troubles of morality are going out and turning right to pay attention to 996.icu"
"我不清楚这些是啥… 道德心泛滥的麻烦出门右转关注996.icu！" means "I don't know what these are... I hope those with an overflowingly moral heart won't be too bothered to go out and turn right to star 996.icu"
The original repo was taken down, so I don't think you can attribute that message to the leaker.
Re: GitHub publishes DMCA deletion notifications sent by Bilibili
#58Sure, Bilibili's copyright must be respected, no question on that whatsoever. That being said, let's have a look on how this multi-billion company treats its programmers - flv.js is opened sourced by bilibili, it has 14,668 starts on github [1]. Bilibili paid the smart & hardworking programmer who single handedly started this project and made it popular $700 USD per month [2], there is a very long zhihu.com thread [2…
I think you are taking a moral high ground by attacking the company's practices.
I think defending corporate legal rights is mostly not about morality which is why speaking about morals in this story is important.
Like in how the legal system it's not what's right or wrong or truth that's important but legal justice, so we need morality to play a part in making sure it doesn't get out of hand.
Re: GitHub publishes DMCA deletion notifications sent by Bilibili
#59Seems like a misuse of DMCA to me. Chinese company misusing powerful acts in USA.
Excuse me? Someone stole bilibili's code base and/or private keys and published it to github. How is it abuse to try and get that taken down?
Since when do the Chinese honor copyright? Did I miss something?
Re: GitHub publishes DMCA deletion notifications sent by Bilibili
#60Earlier quoted context omitted.
> dumb enough to put secrets in the code. Man, I have tons of auth data in services like AWS just in environment variables. But pushing your rsa key to github must have happened on a bad monday. I do often have auth info in code, plainly because of time constraints. You just have to remember it before pushing anything on github. But aside from that, is it possible to file a DMCA for anything that has been forked if i…
I think they examples you've listed are different, and more acceptable than pushing secrets and private keys to Github because you had dozens of them hard-coded. As for the aside, I imagine (with no background knowledge here) that as "owner" if you accidentally published something within that licensed code that does not belong or isn't covered by that license, you should probably have the right to remove it
What if I accidentally contributed a little bit too much code to the Linux kernel? What if that code had been in the last 10 releases? What about the users and distributions running those versions?
I'm not sure the answer is, or should be, as simple as "derp - delete immediately, this was never meant to be Open Source".
That said, if the code was stolen, and then published under an OS licence - it's not OS. The "publisher" never had the rights to make it OS, so the "contract" is null and void...