Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub publishes DMCA deletion notifications sent by Bilibili

github.com

Post reply on HN
Print view View original

61–70 of 117 posts

Re: GitHub publishes DMCA deletion notifications sent by Bilibili

#61

Post by rqs »

yorwba wrote: post #57
pferde wrote: post #48

Earlier quoted context omitted.

Probably a little of each. The repository "title" of swituo/openbilibili-go-common, when pushed through google translate, says: "I don't know if these are embarrassing... The troubles of morality are going out and turning right to pay attention to 996.icu"

"我不清楚这些是啥… 道德心泛滥的麻烦出门右转关注996.icu！" means "I don't know what these are... I hope those with an overflowingly moral heart won't be too bothered to go out and turn right to star 996.icu" The original repo was taken down, so I don't think you can attribute that message to the leaker.

Should be translated to: "I have no idea what are these (or what is this) ... If you have too many moralities to spend, go spend them on 996icu!"

Re: GitHub publishes DMCA deletion notifications sent by Bilibili

#62

Post by alias_neo »

kiallmacinnes wrote: post #60
alias_neo wrote: post #55

Earlier quoted context omitted.

I think they examples you've listed are different, and more acceptable than pushing secrets and private keys to Github because you had dozens of them hard-coded. As for the aside, I imagine (with no background knowledge here) that as "owner" if you accidentally published something within that licensed code that does not belong or isn't covered by that license, you should probably have the right to remove it

What if I accidentally contributed a little bit too much code to the Linux kernel? What if that code had been in the last 10 releases? What about the users and distributions running those versions? I'm not sure the answer is, or should be, as simple as "derp - delete immediately, this was never meant to be Open Source". That said, if the code was stolen, and then published under an OS licence - it's not OS. The "publ…

This is what I was thinking. If it's something that wasn't meant to be published, I assume your right as the owner hold.

How you'd solve this, logistically in an example like yours (Linux kernel) I have no idea, but I presume by the time it's been made public long enough to be cloned/forked (a la the company in question in OP) all of your efforts should be focused on damage control.

Re: GitHub publishes DMCA deletion notifications sent by Bilibili

#63

Post by steve19 »

sandworm101 wrote: post #47
neiman wrote: post #40

Earlier quoted context omitted.

Good question. My guess is that the only thing needed to be copyrightable is the one thing which is not.

They are copyrightable as works, and even if they arent then they are as devices protecting works. The level of creativity needed for copyright is minimal. A key pair is generated by machine, but at the request of a human according to parameters selected by the human. That is likely enough.

A key is just a long number. The AACS encryption key controversy was the subject of DCMA take downs because the key could be used to strip DRM, not because it was a number.

Re: GitHub publishes DMCA deletion notifications sent by Bilibili

#64

Post by gnode »

praptak wrote: post #18

Code base is fair game DMCA-wise. I wonder about the private keys though. I don't think they are copyrightable (although it would cool to have a poem as the private key). So, does DMCA cover that too?

DMCA doesn't just cover distribution of copyrighted material, but also distribution of software / secrets intended to break copy protection measures.

https://en.wikipedia.org/wiki/Anti-circumvention#Distributio...

Re: GitHub publishes DMCA deletion notifications sent by Bilibili

#66

Post by calgaryeng »

pluma wrote: post #50
rococode wrote: post #31

Earlier quoted context omitted.

Elaborating a bit more on the size of bilibili: it has around 100m monthly users and trades as NASDAQ:BILI with a market cap of ~$5.7B. This is not some small-time shop, as far as social media companies go bilibili is one of the more established companies out there.

I'll never understand what market cap has to do with company size. Stock prices are basically an arbitrary value mostly determined by how much people buying stock think the stock is worth, are they not? Correct me if I'm wrong but theoretically an overhyped two man operation running at a financial loss could generate the same market cap as a much larger company with massive profits? As I understand it, the only somew…

"Enterprise Value" is one of the legitimate measures of company size, and is defined as market capitalization + net debt.

You can think of this as equivalent to the size of the company because it would be the amount of money you'd need (roughly speaking) to buy the entire company outright.

Re: GitHub publishes DMCA deletion notifications sent by Bilibili

#67

Post by saint_abroad »

sandworm101 wrote: post #47
neiman wrote: post #40

Earlier quoted context omitted.

Good question. My guess is that the only thing needed to be copyrightable is the one thing which is not.

They are copyrightable as works, and even if they arent then they are as devices protecting works. The level of creativity needed for copyright is minimal. A key pair is generated by machine, but at the request of a human according to parameters selected by the human. That is likely enough.

Since recipes are not protected under copyright law [1] it's unlikely mathematical parameter lists have sufficient "literary expression" for protection.

OTOH, a passphrase of substantial creativity [2] may be protected by copyright. Crucially (for any takedown), this would cover transformations by key derivation functions.

IANAL.

[1] https://www.copyright.gov/help/faq/faq-protect.html

[2] https://fairuse.stanford.edu/2003/09/09/copyright_protection...

Re: GitHub publishes DMCA deletion notifications sent by Bilibili

#68

Post by tinus_hn »

alias_neo wrote: post #42
dustinmoris wrote: post #36

Not great... MD5 password hashing: https://github.com/swituo/openbilibili-go-common/blob/8866d1... Hardcoded credentials: https://github.com/swituo/openbilibili-go-common/blob/8866d1... More hard coded secrets: https://github.com/swituo/openbilibili-go-common/blob/8866d1... This configuration is my favourite: https://github.com/swituo/openbilibili-go-common/blob/8866d1... And of course, RSA keys which they use for al…

I've always wondered, how it could be that someone can be smart enough to write what on the surface is some fairly clean Golang, and yet at the same time, dumb enough to put secrets in the code. I can forgive the use of MD5, because they probably just don't know their hashing/crypto but secrets? It's literally in the name. There is so much material in your 5 links alone, that anyone who desires could utterly own thei…

Much of it is api keys they would distribute in the deployed app anyway. Not really ‘secret’.

Re: GitHub publishes DMCA deletion notifications sent by Bilibili

#69

Post by zhte415 »

ghomrassen wrote: post #2

Heard about this a couple days ago, crazy stuff. For those who don't know, bilibili is a massive video hosting platform in China aimed toward the younger generation. So the question is who leaked it and why? Just a disgruntled employee or the effect of 996?

Bilibili was also criticised by the Chinese government last week for the 'quality' of some hosted content (read: pornography, satire). The next day its foothold in younger generations was praised by the same relevant organs (read: being told to focus or educational and 'moral' content).

Re: GitHub publishes DMCA deletion notifications sent by Bilibili

#70

Post by vthriller »

raxxorrax wrote: post #49
alias_neo wrote: post #42

Earlier quoted context omitted.

I've always wondered, how it could be that someone can be smart enough to write what on the surface is some fairly clean Golang, and yet at the same time, dumb enough to put secrets in the code. I can forgive the use of MD5, because they probably just don't know their hashing/crypto but secrets? It's literally in the name. There is so much material in your 5 links alone, that anyone who desires could utterly own thei…

> dumb enough to put secrets in the code. Man, I have tons of auth data in services like AWS just in environment variables. But pushing your rsa key to github must have happened on a bad monday. I do often have auth info in code, plainly because of time constraints. You just have to remember it before pushing anything on github. But aside from that, is it possible to file a DMCA for anything that has been forked if i…

> You just have to remember it before pushing anything on github.

Do you read commit history looking for, say, relocated secrets? Do you go through the pain of rewriting said history regardless of whether you avoid merges with your current workflow or not? For me, that's too many risky and involving things to do. This advice will only work if you're only going to export squashed commits from private repo to the public one once in a while.

Post reply on HN