GitHub publishes DMCA deletion notifications sent by Bilibili

https://github.com/github/dmca/blob/master/2019/04/2019-04-23-bilibili.md

by counter2015 • 7 years ago

160 104 7 years ago

ghomrassen• 7 years ago

Heard about this a couple days ago, crazy stuff. For those who don't know, bilibili is a massive video hosting platform in China aimed toward the younger generation.

So the question is who leaked it and why? Just a disgruntled employee or the effect of 996?

toomuchtodo• 7 years ago

hubot (a Github bot) automatically publishes DMCA takedown requests into the repo [1] in question.

[1] https://github.com/github/dmca/

akerl_• 7 years ago

I suspect the commenter you’re responding to means ~”who leaked the source code referenced in the DMCA, and why”. The DMCA takedown request refers to a repo that it claims contains internal information and data from the claiming company.

josteink• 7 years ago

According to this repo Symantec just filed a DMCA notice to Android source code about a week ago:

https://github.com/github/dmca/blob/master/2019/04/2019-04-0...

Crazy.

NegativeLatency• 7 years ago

What is 996?

hollerith• 7 years ago

The practice of requiring employees to work from 9 to 9 6 days a week.

sjcsjc• 7 years ago

I first heard of it last week from this article:

https://www.bbc.co.uk/news/business-47934513

imhoguy• 7 years ago

https://en.wikipedia.org/wiki/996_working_hour_system

rococode• 7 years ago

Elaborating a bit more on the size of bilibili: it has around 100m monthly users and trades as NASDAQ:BILI with a market cap of ~$5.7B.

This is not some small-time shop, as far as social media companies go bilibili is one of the more established companies out there.

pluma2• 7 years ago

I'll never understand what market cap has to do with company size. Stock prices are basically an arbitrary value mostly determined by how much people buying stock think the stock is worth, are they not?

Correct me if I'm wrong but theoretically an overhyped two man operation running at a financial loss could generate the same market cap as a much larger company with massive profits? As I understand it, the only somewhat tangible factor is the actual money in the company which again can be bloated by overeager investors.

I'm not being facetious, I'm genuinely curious about the rationale.

pferde• 7 years ago

Probably a little of each. The repository "title" of swituo/openbilibili-go-common, when pushed through google translate, says:

"I don't know if these are embarrassing... The troubles of morality are going out and turning right to pay attention to 996.icu"

yorwba2• 7 years ago

"我不清楚这些是啥… 道德心泛滥的麻烦出门右转关注996.icu！" means "I don't know what these are... I hope those with an overflowingly moral heart won't be too bothered to go out and turn right to star 996.icu"

The original repo was taken down, so I don't think you can attribute that message to the leaker.

zhte415• 7 years ago

Bilibili was also criticised by the Chinese government last week for the 'quality' of some hosted content (read: pornography, satire). The next day its foothold in younger generations was praised by the same relevant organs (read: being told to focus or educational and 'moral' content).

akerro• 7 years ago

Backups https://github.com/search?q=go-common

avip• 7 years ago

Too late. GitHub is scraped very frequently (as in seconds) for sensitive stuff. It’s out and github cannot do anything about it

dannyw• 7 years ago

Just because the information is out there doesn’t mean taking remedy action is useless.

usernam33• 7 years ago

"...the median time to discovery for a key leaked to GitHub is 20 seconds..." https://news.ycombinator.com/item?id=19602279

counter20153• 7 years ago

As far as I know, an employee who was illegally laid off by bilibili put part of the company's background code on GitHub to vent his anger. And then GitHub has directionally shielded the keywords "bilibili" and "go-common", But it can be bypassed by typing only one character less. there are still a lot of projects alive. It is not yet known who leaked it. Also for the reason.

4684499• 7 years ago

illegally laid off

Source please?

counter20153• 7 years ago

You can find some reports here by using Translation software(If this report hasn't been deleted yet)。 BiliBili once made a statement on Weibo， but delete in a few minutes. https://www.heibai.org/post/1214.html

counter20153• 7 years ago

illegally laid off for this part, I can't give credible sources, I know it from hearsay

42yeah• 7 years ago

This letter seems like it was hastily written and sent out in quite a hurry.

baroffoos• 7 years ago

You would think it would be faster to just change the keys. Although looking at the repo the credentials they are worried about getting leaked are "admin" "admin"

rubatuga• 7 years ago

This might be off topic, but why create an account just to say this?

phyzome• 7 years ago

Everyone creates their account at some point, probably in order to respond to something...

DarkWiiPlayer• 7 years ago

Now this is embarrasing

https://github.com/swituo/openbilibili-go-common/blob/8866d1...

stestagg• 7 years ago

It’s a test file referencing a service running on local host ...

happppy• 7 years ago

these are test functions.

praptak• 7 years ago

Code base is fair game DMCA-wise. I wonder about the private keys though. I don't think they are copyrightable (although it would cool to have a poem as the private key). So, does DMCA cover that too?

neiman• 7 years ago

Good question. My guess is that the only thing needed to be copyrightable is the one thing which is not.

sandworm1012• 7 years ago

They are copyrightable as works, and even if they arent then they are as devices protecting works.

The level of creativity needed for copyright is minimal. A key pair is generated by machine, but at the request of a human according to parameters selected by the human. That is likely enough.

gnode• 7 years ago

DMCA doesn't just cover distribution of copyrighted material, but also distribution of software / secrets intended to break copy protection measures.

https://en.wikipedia.org/wiki/Anti-circumvention#Distributio...

brianpgordon2• 7 years ago

These keys don't have anything to do with copyright protection circumvention though.

gergles• 7 years ago

(although it would cool to have a poem as the private key)

Apple does this with Mac OS X. The System Management Controller contains a key, and the "Dont Steal Mac OS X" kernel extension (which checks for that key) contains a poem that must be present for Mac OS X to run.

http://osxdaily.com/2010/03/19/anti-piracy-message-in-mac-os...

ddtaylor4• 7 years ago

That's the saddest poem I've ever read.

founderling• 7 years ago

Why do you think that the DMCA would lead to some sort of deletion of repositories that was sent over a wire to a website that the DMCA was meant to be into?

It's not a simple case either. But it feels a bit strange that there aren't any links to this kind of DMCA takedown. It seems strange that a company like BitBucket would even have this kind of information without the DMCA notice.

Or maybe I'm just a cynic.

ddtaylor4• 7 years ago

It appears to already be on IPFS

https://ipfs.io/ipfs/QmYiQ5jbtmx24ketNA65MJ3VpSDFWikGmvnBErq...

comex• 7 years ago

HERO.md: https://gitlab.com/wkingfly/openbilibili/blob/master/HERO.md

I have no idea what it means, but I like it.

silvester23• 7 years ago

These are playable races and character classes from Warcraft III (and the expansion The Frozen Throne).

Most of these probably also appear in World of Warcraft, though I cannot say for sure.

As to why this file is in the top directory of the repo, your guess is as good as mine.

brenniemac• 7 years ago

I think more specifically this is referring to heroes from Dota (which of course links back to Warcraft III as you said)

dustinmoris2• 7 years ago

Not great...

MD5 password hashing: https://github.com/swituo/openbilibili-go-common/blob/8866d1...

Hardcoded credentials: https://github.com/swituo/openbilibili-go-common/blob/8866d1...

More hard coded secrets: https://github.com/swituo/openbilibili-go-common/blob/8866d1...

This configuration is my favourite: https://github.com/swituo/openbilibili-go-common/blob/8866d1...

And of course, RSA keys which they use for all of their RSA encryption: https://github.com/swituo/openbilibili-go-common/blob/8866d1...

... their problem is not that the source code is all public over the internet now... their problem is the engineering team. If source code leaks the worst outcome should be some IP leakage, but not a compromised live system. That can and should be easily avoided by not having everything in your source code, especially when you are such a big company with so many employees...

alias_neo5• 7 years ago

I've always wondered, how it could be that someone can be smart enough to write what on the surface is some fairly clean Golang, and yet at the same time, dumb enough to put secrets in the code.

I can forgive the use of MD5, because they probably just don't know their hashing/crypto but secrets? It's literally in the name.

There is so much material in your 5 links alone, that anyone who desires could utterly own their infrastructure, and then some.

nemothekid2• 7 years ago

It’s one of those things that you dangerously start when your project is small then when you balloon in size, you find that everyone is hard coding secrets in code and standing up some secrets infrastructure would take weeks to get right. It’s easier now with tools like Vault but let’s say you joined bilibili today - where do you even begin? You have a massive cultural problem before you even begin to tackle the technical one. Even a smart engineer may just resign to doing things the wrong way than trying to fight a huge political battle.

raxxorrax• 7 years ago

dumb enough to put secrets in the code.

Man, I have tons of auth data in services like AWS just in environment variables. But pushing your rsa key to github must have happened on a bad monday.

I do often have auth info in code, plainly because of time constraints. You just have to remember it before pushing anything on github.

But aside from that, is it possible to file a DMCA for anything that has been forked if it was published under a license that permitted that action?

tinus_hn3• 7 years ago

Much of it is api keys they would distribute in the deployed app anyway. Not really ‘secret’.

jasonlotito• 7 years ago

dumb enough to put secrets in the code.

Even Apple has released code doing "dumb" things. goto goto for example [1]. This is a simple mistake, easily caught using proper code reviewing techniques and tools, and yet it still happened. This means they could have prevented someone making this mistake if they invested the time and energy doing things properly. This is Apple here. We aren't even talking about mistakes from Microsoft or Amazon or other major software companies.

And these people aren't dumb. Facebook isn't filled with "dumb" people, and yet, they've done far worse than Bilibili here with just their 'mistakes'.

The reality is, smart people do dumb things all the time because they are trying to get things done.

I'm not going to pass judgement on what other people did. I'm going to assume they did the best they could, and while they made mistakes, it doesn't make them dumb. Maybe someone got lazy, maybe someone was under pressure, and things just piled up.

"It's bad, but we'll get to it later when we have the time."

No one plans to have their code shared out to the public. I wonder how many of us could honestly come out clean for code they've written along the way. To not have someone say "Oh, you are using an older library there that's got a security bug" or "You shouldn't have done this" and what not.

[1] https://nakedsecurity.sophos.com/2014/02/24/anatomy-of-a-got...

bArray• 7 years ago

Repository also appearing in GitLab:

https://gitlab.com/wkingfly/openbilibili

https://gitlab.com/panxue/openbilibili

https://gitlab.com/efsg/openbilibili

Either way, it's now spread to far and they need to take actions to protect their users.

dustinmoris2• 7 years ago

I don't know what to make of this, but this all feels like a deliberate attempt to damage this company.

Here are some interesting things I noticed:

- GitHub has a lot of DMCAs each month and going through them it seems that all repos have been taken down by GitHub, but in this case the entire source code is still online despite it being posted here on HN for hours now and after they have been notified.

- None of the other DMCAs (some of them really interesting) have ever trended on HN

- The above linked repo has been forked more than 5k times, which is so much more than what any other DMCA reported repo has been ever forked from what I could see

- The repo with the source code put a link to https://996.icu in the description

- The person who posted the DMCA here on HN seems to be a new user who has only posted or commented on topics related to 996. Potentially the person/group has also gamed HN to get this link to the front page

There is no proof, but it feels like there is a very coordinated and deliberate attempt to harm Bilibili which is kind of sad.

kevin_thibedeau• 7 years ago

The only sad thing here is a fraudulent DMCA takedown for a trademark violation.

GoblinSlayer• 7 years ago

What harm? It's nice to have the source.

pavelbr• 7 years ago

I'm a new developer (an intern, actually). I just started writing a system that requires a couple secret strings. Currently I just have them as constants with my code, with the idea that I'll figure out something to do with them once I make sure everything is working.

What should I do with those secrets though? I'm not sure how to store them securely. So far I've been considering putting them in the server configuration so they can be read from environment variables, but that seems inconvenient for me and other developers and also not that much more secure.

farisjarrah• 7 years ago

How to handle organizational secrets is definitely your concern, however, you are probably too junior to be making decisions on implementing security best practices in production. Likely your company has methodologies in place to deal with deployment secrets. Ask a senior dev how they handle secret management. In many companies there are key management tools such as Hashicorp Vault or Ansible vault. Basically without knowing your environment its hard to tell you what to do, but there are lots of options out there, and your company may have already implemented some of them.

nickflood• 7 years ago

You read them from a config file and fill them into the config by hand while deploying. Never push secrets embedded into code or portions of the config file to your source repo.

You can hardcode the secrets to test stuff, but the first time you push the code to the repo should be the time you change it to reading from config. And add config to gitignore cause even if you don't stage the particular lines with the secrets in them, there will come one time where you'll rush or will have too long of a day when you'll push those secrets by accident. If you've got a public repo, then it's over. On a private repo then you may not notice this or not remember to remove it with a force push.

A point in time when you get tired of juggling config files manually in dev/prod is the point in time you explore the system for secret management and auto build/deployment as clearly your project has become useful/popular enough.

Those are my IMO and what I use as thresholds. Of course, if your environment is more relaxed there's no limit on further improving this practice.

danenania• 7 years ago

We built https://www.envkey.com to solve this problem in a secure and developer-friendly way—perhaps it can help!

princekolt• 7 years ago

The long standard for lots of software is to have a blank "file.conf.example" file (with only the variable names but blank values) which you commit to git, and have the code look for a file named "file.conf" which you explicitly exclude from git using gitignore. This allows you to have a template config file while still preventing the secrets from being written to git. Then you can have the software provide some sort of alert when it is launched for the first time saying "config file not found, please duplicate file.conf.example, fill in your details, and name it file.conf."

tracker13• 7 years ago

At the VERY least, extract them to Environment Variables... ensure .env is on your .gitignore, and have your localized/dev configs in your local .env ... production environments should have them set. For more complex environments you can set via a secure key service, or build from there.

Again,. the LEAST you should do is use environment variables and keep the actual keys out of your code. .env files are a developer convenience measure, and easy enough to use side channels. I go a step further and ensure a fallback that might be the dev environment, but that is not the same as any higher environment

dikei• 7 years ago

Apart from the storing secret in repository, I'm quite impressed by their repository structure. It looks a lot better than the mess I often see in our internal projects.

dis-sys3• 7 years ago

Sure, Bilibili's copyright must be respected, no question on that whatsoever. That being said, let's have a look on how this multi-billion company treats its programmers -

flv.js is opened sourced by bilibili, it has 14,668 starts on github [1]. Bilibili paid the smart & hardworking programmer who single handedly started this project and made it popular $700 USD per month [2], there is a very long zhihu.com thread [2] on this matter with 4 million views and almost 400 detailed responses. $700 is about 10% of the fair market rate in China for skills like that.

Sorry, but I am not going to take the moral high ground and defend bilibili's rights any time soon. It is a company violating the rights of its programmers on hourly basis.

Shame on you BiliBili.

[1] https://github.com/Bilibili/flv.js

[2] https://www.zhihu.com/question/53686737

chippy• 7 years ago

I think you are taking a moral high ground by attacking the company's practices.

I think defending corporate legal rights is mostly not about morality which is why speaking about morals in this story is important.

Like in how the legal system it's not what's right or wrong or truth that's important but legal justice, so we need morality to play a part in making sure it doesn't get out of hand.

ksec• 7 years ago

$700 is about 10% of the fair market rate in China for skills like that.

So you are suggesting $7000 for skills like that? There are still countless PHP / Golang / Rails jobs going for under $2K. While I agree $700 is insanely low even if you are in some Tier 3 cities, I don't think 10% paint an accurate picture of the current state of Programming Paid in China.

dis-sys3• 7 years ago

As clearly mentioned in the reply, $7,000/month is the fair market rate for someone who can propose/promote/complete such a project with visible impact on the community.

ddtaylor4• 7 years ago

Even in China, don't you chose to work for someone?

dis-sys3• 7 years ago

oh, you can ask the same question to those millions of Chinese developers forced to work 996. surely that is the solution to the problem.

owaislone• 7 years ago

If you don't have time to integrate with a secret store, at least use something like Blackbox to store encrypted in git: https://github.com/StackExchange/blackbox

gerbilly• 7 years ago

I use something like this to set a few global variables at build time.

This keeps my secrets out of the source code.

go build \

    -ldflags="\

    -X main.programVersion=`git describe` \

    -X main.username=$USERNAME \

    -X main.password=$PASSWORD"

This isn't perfect, of course, because you can just use strings(1) to find the secrets embedded in the binary, but it is a step up from what they did.

It's fine for our internal go apps. I'm not sure what I would do if the secrets were for connecting to public cloud infrastructure though.

Perhaps encrypt them with a separate key per customer, then feed in the key via an env variable?

Any ideas?

duncan-donuts• 7 years ago

I would read connection string information from the env. This[0] might be useful if you’re not familiar with 12 factor apps.

0: https://12factor.net/config

CameronNemo• 7 years ago

An example configuration file is also acceptable. It is also less prone to leakage if your application runs other untrusted (or simply less trusted) code and does not sanitize the environment first.

GitHub publishes DMCA deletion notifications sent by Bilibili

Related Stories