Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub publishes DMCA deletion notifications sent by Bilibili

github.com

Post reply on HN
Print view View original

81–90 of 117 posts

Re: GitHub publishes DMCA deletion notifications sent by Bilibili

#81

Post by gergles »

praptak wrote: post #18

Code base is fair game DMCA-wise. I wonder about the private keys though. I don't think they are copyrightable (although it would cool to have a poem as the private key). So, does DMCA cover that too?

> (although it would cool to have a poem as the private key)

Apple does this with Mac OS X. The System Management Controller contains a key, and the "Dont Steal Mac OS X" kernel extension (which checks for that key) contains a poem that must be present for Mac OS X to run.

http://osxdaily.com/2010/03/19/anti-piracy-message-in-mac-os...

Re: GitHub publishes DMCA deletion notifications sent by Bilibili

#82

Post by dustinmoris »

dustinmoris wrote: post #36

Not great... MD5 password hashing: https://github.com/swituo/openbilibili-go-common/blob/8866d1... Hardcoded credentials: https://github.com/swituo/openbilibili-go-common/blob/8866d1... More hard coded secrets: https://github.com/swituo/openbilibili-go-common/blob/8866d1... This configuration is my favourite: https://github.com/swituo/openbilibili-go-common/blob/8866d1... And of course, RSA keys which they use for al…

I don't know what to make of this, but this all feels like a deliberate attempt to damage this company.

Here are some interesting things I noticed:

- GitHub has a lot of DMCAs each month and going through them it seems that all repos have been taken down by GitHub, but in this case the entire source code is still online despite it being posted here on HN for hours now and after they have been notified.

- None of the other DMCAs (some of them really interesting) have ever trended on HN

- The above linked repo has been forked more than 5k times, which is so much more than what any other DMCA reported repo has been ever forked from what I could see

- The repo with the source code put a link to https://996.icu in the description

- The person who posted the DMCA here on HN seems to be a new user who has only posted or commented on topics related to 996. Potentially the person/group has also gamed HN to get this link to the front page

There is no proof, but it feels like there is a very coordinated and deliberate attempt to harm Bilibili which is kind of sad.

Re: GitHub publishes DMCA deletion notifications sent by Bilibili

#83

Post by tinus_hn »

chrismeller wrote: post #73
tinus_hn wrote: post #68

Earlier quoted context omitted.

Much of it is api keys they would distribute in the deployed app anyway. Not really ‘secret’.

That’s how it starts though. If everything is provided at deploy and nothing is ever embedded in source code there’s no way you can end up in this situation. In some industries it’s also an audit or legal requirement that developers not have access to production credentials, so there’s no other way to reasonably handle that. Edit: also, rebuilding your source because an API key changed... no thanks.

The choices are:

1. api key is publicly readable in a configuration files you ship

2. api key is compiled into the binary you ship.

There is only obfuscation. Then again api keys are not security keys.

Re: GitHub publishes DMCA deletion notifications sent by Bilibili

#84

Post by [deleted] »

gergles wrote: post #81
praptak wrote: post #18

Code base is fair game DMCA-wise. I wonder about the private keys though. I don't think they are copyrightable (although it would cool to have a poem as the private key). So, does DMCA cover that too?

> (although it would cool to have a poem as the private key) Apple does this with Mac OS X. The System Management Controller contains a key, and the "Dont Steal Mac OS X" kernel extension (which checks for that key) contains a poem that must be present for Mac OS X to run. http://osxdaily.com/2010/03/19/anti-piracy-message-in-mac-os...

[deleted]

Re: GitHub publishes DMCA deletion notifications sent by Bilibili

#85

Post by heavenlyblue »

nemothekid wrote: post #46
alias_neo wrote: post #42

Earlier quoted context omitted.

I've always wondered, how it could be that someone can be smart enough to write what on the surface is some fairly clean Golang, and yet at the same time, dumb enough to put secrets in the code. I can forgive the use of MD5, because they probably just don't know their hashing/crypto but secrets? It's literally in the name. There is so much material in your 5 links alone, that anyone who desires could utterly own thei…

It’s one of those things that you dangerously start when your project is small then when you balloon in size, you find that everyone is hard coding secrets in code and standing up some secrets infrastructure would take weeks to get right. It’s easier now with tools like Vault but let’s say you joined bilibili today - where do you even begin? You have a massive cultural problem before you even begin to tackle the tech…

>> you find that everyone is hard coding secrets in code and standing up some secrets infrastructure would take weeks to get right.

You open up the code, find all of the secrets (e.g. using high-entropy substring search), replace them with access to a global variable, and set it from a file set by a configuration from a command line.

Done.

Re: GitHub publishes DMCA deletion notifications sent by Bilibili

#86

Post by chrismeller »

tinus_hn wrote: post #83
chrismeller wrote: post #73

Earlier quoted context omitted.

That’s how it starts though. If everything is provided at deploy and nothing is ever embedded in source code there’s no way you can end up in this situation. In some industries it’s also an audit or legal requirement that developers not have access to production credentials, so there’s no other way to reasonably handle that. Edit: also, rebuilding your source because an API key changed... no thanks.

The choices are: 1. api key is publicly readable in a configuration files you ship 2. api key is compiled into the binary you ship. There is only obfuscation. Then again api keys are not security keys.

But literally in this case it was security keys.

Even including an API key into the binary build is avoidable. Add an OAuth-style negotiation for the key as the first startup process.

Start digging deeper and there are fewer and fewer reasons.

Re: GitHub publishes DMCA deletion notifications sent by Bilibili

#87

Post by andrew_n »

pluma wrote: post #50
rococode wrote: post #31

Earlier quoted context omitted.

Elaborating a bit more on the size of bilibili: it has around 100m monthly users and trades as NASDAQ:BILI with a market cap of ~$5.7B. This is not some small-time shop, as far as social media companies go bilibili is one of the more established companies out there.

I'll never understand what market cap has to do with company size. Stock prices are basically an arbitrary value mostly determined by how much people buying stock think the stock is worth, are they not? Correct me if I'm wrong but theoretically an overhyped two man operation running at a financial loss could generate the same market cap as a much larger company with massive profits? As I understand it, the only somew…

Market capitalization = share price * number of shares

As a first approximation, this is how much money it would cost to buy all the shares. You’d pay $SHARE_PRICE for each share and then own the entire company. Therefore the concept is a decent measure for what the market has decided the company as a whole is worth.

A company with 10x the market cap of a competitor is considered 10x bigger, because it would take about 10x as many dollars to acquire.

I say “first approximation” because if you actually tried to buy all the shares on the open market, then increased demand would drive the price up, and not everyone would want to sell right away. In an acquisition, the acquirer offers a deal where all shareholders get, say, 1.25x the current share price, but only if all shareholders sell all their stock. And the board of directors of the company being acquired can compel all shareholders to do so, if that’s in the best interest of the shareholders.

Re: GitHub publishes DMCA deletion notifications sent by Bilibili

#88

Post by colejohnson66 »

heavenlyblue wrote: post #85
nemothekid wrote: post #46

Earlier quoted context omitted.

It’s one of those things that you dangerously start when your project is small then when you balloon in size, you find that everyone is hard coding secrets in code and standing up some secrets infrastructure would take weeks to get right. It’s easier now with tools like Vault but let’s say you joined bilibili today - where do you even begin? You have a massive cultural problem before you even begin to tackle the tech…

>> you find that everyone is hard coding secrets in code and standing up some secrets infrastructure would take weeks to get right. You open up the code, find all of the secrets (e.g. using high-entropy substring search), replace them with access to a global variable, and set it from a file set by a configuration from a command line. Done.

And when your manager says don’t do that because it’s a waste of time?

Re: GitHub publishes DMCA deletion notifications sent by Bilibili

#89

Post by jasonlotito »

alias_neo wrote: post #42
dustinmoris wrote: post #36

Not great... MD5 password hashing: https://github.com/swituo/openbilibili-go-common/blob/8866d1... Hardcoded credentials: https://github.com/swituo/openbilibili-go-common/blob/8866d1... More hard coded secrets: https://github.com/swituo/openbilibili-go-common/blob/8866d1... This configuration is my favourite: https://github.com/swituo/openbilibili-go-common/blob/8866d1... And of course, RSA keys which they use for al…

I've always wondered, how it could be that someone can be smart enough to write what on the surface is some fairly clean Golang, and yet at the same time, dumb enough to put secrets in the code. I can forgive the use of MD5, because they probably just don't know their hashing/crypto but secrets? It's literally in the name. There is so much material in your 5 links alone, that anyone who desires could utterly own thei…

> dumb enough to put secrets in the code.

Even Apple has released code doing "dumb" things. goto goto for example [1]. This is a simple mistake, easily caught using proper code reviewing techniques and tools, and yet it still happened. This means they could have prevented someone making this mistake if they invested the time and energy doing things properly. This is Apple here. We aren't even talking about mistakes from Microsoft or Amazon or other major software companies.

And these people aren't dumb. Facebook isn't filled with "dumb" people, and yet, they've done far worse than Bilibili here with just their 'mistakes'.

The reality is, smart people do dumb things all the time because they are trying to get things done.

I'm not going to pass judgement on what other people did. I'm going to assume they did the best they could, and while they made mistakes, it doesn't make them dumb. Maybe someone got lazy, maybe someone was under pressure, and things just piled up.

"It's bad, but we'll get to it later when we have the time."

No one plans to have their code shared out to the public. I wonder how many of us could honestly come out clean for code they've written along the way. To not have someone say "Oh, you are using an older library there that's got a security bug" or "You shouldn't have done this" and what not.

[1]: https://nakedsecurity.sophos.com/2014/02/24/anatomy-of-a-got...

Re: GitHub publishes DMCA deletion notifications sent by Bilibili

#90

Post by sandworm101 »

saint_abroad wrote: post #67
sandworm101 wrote: post #47

Earlier quoted context omitted.

They are copyrightable as works, and even if they arent then they are as devices protecting works. The level of creativity needed for copyright is minimal. A key pair is generated by machine, but at the request of a human according to parameters selected by the human. That is likely enough.

Since recipes are not protected under copyright law [1] it's unlikely mathematical parameter lists have sufficient "literary expression" for protection. OTOH, a passphrase of substantial creativity [2] may be protected by copyright. Crucially (for any takedown), this would cover transformations by key derivation functions. IANAL. [1] https://www.copyright.gov/help/faq/faq-protect.html [2] https://fairuse.stanford.edu…

A purely random number is almost certainly always beyond copyright, but as soon as someone puts limitations on that randomness a court may find that enough.

And what matters for a takedown is not the number, but the actually document being published. Github is not hosting the random number. It is hosting that number in the context of a larger document and it is that document that is subject to the takedown request. Things might be different if github hosted only the number without the associated labels and code.

Post reply on HN