Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub publishes DMCA deletion notifications sent by Bilibili

github.com

Post reply on HN
Print view View original

71–80 of 117 posts

Re: GitHub publishes DMCA deletion notifications sent by Bilibili

#71

Post by bArray »

dustinmoris wrote: post #36

Not great... MD5 password hashing: https://github.com/swituo/openbilibili-go-common/blob/8866d1... Hardcoded credentials: https://github.com/swituo/openbilibili-go-common/blob/8866d1... More hard coded secrets: https://github.com/swituo/openbilibili-go-common/blob/8866d1... This configuration is my favourite: https://github.com/swituo/openbilibili-go-common/blob/8866d1... And of course, RSA keys which they use for al…

Repository also appearing in GitLab:

https://gitlab.com/wkingfly/openbilibili

https://gitlab.com/panxue/openbilibili

https://gitlab.com/efsg/openbilibili

Either way, it's now spread to far and they need to take actions to protect their users.

Re: GitHub publishes DMCA deletion notifications sent by Bilibili

#72

Post by brenniemac »

silvester23 wrote: post #39
comex wrote: post #32

HERO.md: https://gitlab.com/wkingfly/openbilibili/blob/master/HERO.md I have no idea what it means, but I like it.

These are playable races and character classes from Warcraft III (and the expansion The Frozen Throne). Most of these probably also appear in World of Warcraft, though I cannot say for sure. As to why this file is in the top directory of the repo, your guess is as good as mine.

I think more specifically this is referring to heroes from Dota (which of course links back to Warcraft III as you said)

Re: GitHub publishes DMCA deletion notifications sent by Bilibili

#73

Post by chrismeller »

tinus_hn wrote: post #68
alias_neo wrote: post #42

Earlier quoted context omitted.

I've always wondered, how it could be that someone can be smart enough to write what on the surface is some fairly clean Golang, and yet at the same time, dumb enough to put secrets in the code. I can forgive the use of MD5, because they probably just don't know their hashing/crypto but secrets? It's literally in the name. There is so much material in your 5 links alone, that anyone who desires could utterly own thei…

Much of it is api keys they would distribute in the deployed app anyway. Not really ‘secret’.

That’s how it starts though. If everything is provided at deploy and nothing is ever embedded in source code there’s no way you can end up in this situation.

In some industries it’s also an audit or legal requirement that developers not have access to production credentials, so there’s no other way to reasonably handle that.

Edit: also, rebuilding your source because an API key changed... no thanks.

Re: GitHub publishes DMCA deletion notifications sent by Bilibili

#74

Post by phyzome »

rubatuga wrote: post #45
42yeah wrote: post #16

This letter seems like it was hastily written and sent out in quite a hurry.

This might be off topic, but why create an account just to say this?

Everyone creates their account at some point, probably in order to respond to something...

Re: GitHub publishes DMCA deletion notifications sent by Bilibili

#75

Post by brianpgordon »

calgaryeng wrote: post #66
pluma wrote: post #50

Earlier quoted context omitted.

I'll never understand what market cap has to do with company size. Stock prices are basically an arbitrary value mostly determined by how much people buying stock think the stock is worth, are they not? Correct me if I'm wrong but theoretically an overhyped two man operation running at a financial loss could generate the same market cap as a much larger company with massive profits? As I understand it, the only somew…

"Enterprise Value" is one of the legitimate measures of company size, and is defined as market capitalization + net debt. You can think of this as equivalent to the size of the company because it would be the amount of money you'd need (roughly speaking) to buy the entire company outright.

Don't forget to subtract cash in the EV formula. Otherwise you could take out a gigantic loan and magically get bigger, when really all you've done is shuffle some money from debt into cash.

Re: GitHub publishes DMCA deletion notifications sent by Bilibili

#76

Post by brianpgordon »

gnode wrote: post #64
praptak wrote: post #18

Code base is fair game DMCA-wise. I wonder about the private keys though. I don't think they are copyrightable (although it would cool to have a poem as the private key). So, does DMCA cover that too?

DMCA doesn't just cover distribution of copyrighted material, but also distribution of software / secrets intended to break copy protection measures. https://en.wikipedia.org/wiki/Anti-circumvention#Distributio...

These keys don't have anything to do with copyright protection circumvention though.

Re: GitHub publishes DMCA deletion notifications sent by Bilibili

#77

Post by ilikehurdles »

vthriller wrote: post #70
raxxorrax wrote: post #49

Earlier quoted context omitted.

> dumb enough to put secrets in the code. Man, I have tons of auth data in services like AWS just in environment variables. But pushing your rsa key to github must have happened on a bad monday. I do often have auth info in code, plainly because of time constraints. You just have to remember it before pushing anything on github. But aside from that, is it possible to file a DMCA for anything that has been forked if i…

> You just have to remember it before pushing anything on github. Do you read commit history looking for, say, relocated secrets? Do you go through the pain of rewriting said history regardless of whether you avoid merges with your current workflow or not? For me, that's too many risky and involving things to do. This advice will only work if you're only going to export squashed commits from private repo to the publi…

The best thing to do is assume the secret is fully compromised the second it hits GitHub, and consider it worthless to protect with these measures. Get a new secret immediately and trash the old one.

Re: GitHub publishes DMCA deletion notifications sent by Bilibili

#78

Post by gerbilly »

I use something like this to set a few global variables at build time.

This keeps my secrets out of the source code.

go build \

    -ldflags="\

    -X main.programVersion=`git describe` \

    -X main.username=$USERNAME \

    -X main.password=$PASSWORD"
This isn't perfect, of course, because you can just use strings(1) to find the secrets embedded in the binary, but it is a step up from what they did.

It's fine for our internal go apps. I'm not sure what I would do if the secrets were for connecting to public cloud infrastructure though.

Perhaps encrypt them with a separate key per customer, then feed in the key via an env variable?

Any ideas?

Re: GitHub publishes DMCA deletion notifications sent by Bilibili

#79

Post by Zekio »

brenniemac wrote: post #72
silvester23 wrote: post #39

Earlier quoted context omitted.

These are playable races and character classes from Warcraft III (and the expansion The Frozen Throne). Most of these probably also appear in World of Warcraft, though I cannot say for sure. As to why this file is in the top directory of the repo, your guess is as good as mine.

I think more specifically this is referring to heroes from Dota (which of course links back to Warcraft III as you said)

nah, they are just the default heroes that exist in Warcraft 3 Reign of Chaos and Frozen Throne, which is easily discerned by the names and the fact the races are listed as titles and the Neutral heroes doesn't have a race mentioned in English

Also there are a lot more heroes in the Dota map for Warcraft 3 than on that short list

Re: GitHub publishes DMCA deletion notifications sent by Bilibili

#80

Post by duncan-donuts »

gerbilly wrote: post #78

I use something like this to set a few global variables at build time. This keeps my secrets out of the source code. go build \ -ldflags="\ -X main.programVersion=`git describe` \ -X main.username=$USERNAME \ -X main.password=$PASSWORD" This isn't perfect, of course, because you can just use strings(1) to find the secrets embedded in the binary, but it is a step up from what they did. It's fine for our internal go ap…

I would read connection string information from the env. This[0] might be useful if you’re not familiar with 12 factor apps.

0: https://12factor.net/config

Post reply on HN