<story><title>GitHub publishes DMCA deletion notifications sent by Bilibili</title><url>https://github.com/github/dmca/blob/master/2019/04/2019-04-23-bilibili.md</url></story><parent_chain></parent_chain><comment><author>dustinmoris</author><text>Not great...&lt;p&gt;MD5 password hashing:
&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;swituo&amp;#x2F;openbilibili-go-common&amp;#x2F;blob&amp;#x2F;8866d1359a2a501009b976b02bb27e4949cc4e77&amp;#x2F;app&amp;#x2F;service&amp;#x2F;main&amp;#x2F;passport-game&amp;#x2F;service&amp;#x2F;passport_login.go#L185&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;swituo&amp;#x2F;openbilibili-go-common&amp;#x2F;blob&amp;#x2F;8866d1...&lt;/a&gt;&lt;p&gt;Hardcoded credentials:
&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;swituo&amp;#x2F;openbilibili-go-common&amp;#x2F;blob&amp;#x2F;8866d1359a2a501009b976b02bb27e4949cc4e77&amp;#x2F;app&amp;#x2F;admin&amp;#x2F;ep&amp;#x2F;marthe&amp;#x2F;dao&amp;#x2F;tapd.go#L17&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;swituo&amp;#x2F;openbilibili-go-common&amp;#x2F;blob&amp;#x2F;8866d1...&lt;/a&gt;&lt;p&gt;More hard coded secrets:
&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;swituo&amp;#x2F;openbilibili-go-common&amp;#x2F;blob&amp;#x2F;8866d1359a2a501009b976b02bb27e4949cc4e77&amp;#x2F;app&amp;#x2F;service&amp;#x2F;ep&amp;#x2F;footman&amp;#x2F;cmd&amp;#x2F;tapd&amp;#x2F;tapd.go#L54&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;swituo&amp;#x2F;openbilibili-go-common&amp;#x2F;blob&amp;#x2F;8866d1...&lt;/a&gt;&lt;p&gt;This configuration is my favourite:
&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;swituo&amp;#x2F;openbilibili-go-common&amp;#x2F;blob&amp;#x2F;8866d1359a2a501009b976b02bb27e4949cc4e77&amp;#x2F;library&amp;#x2F;queue&amp;#x2F;databus&amp;#x2F;report&amp;#x2F;conf.go&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;swituo&amp;#x2F;openbilibili-go-common&amp;#x2F;blob&amp;#x2F;8866d1...&lt;/a&gt;&lt;p&gt;And of course, RSA keys which they use for all of their RSA encryption: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;swituo&amp;#x2F;openbilibili-go-common&amp;#x2F;blob&amp;#x2F;8866d1359a2a501009b976b02bb27e4949cc4e77&amp;#x2F;app&amp;#x2F;service&amp;#x2F;main&amp;#x2F;passport-game&amp;#x2F;service&amp;#x2F;passport_key.go&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;swituo&amp;#x2F;openbilibili-go-common&amp;#x2F;blob&amp;#x2F;8866d1...&lt;/a&gt;&lt;p&gt;... their problem is not that the source code is all public over the internet now... their problem is the engineering team. If source code leaks the worst outcome should be some IP leakage, but not a compromised live system. That can and should be easily avoided by not having everything in your source code, especially when you are such a big company with so many employees...</text></comment>
<story><title>GitHub publishes DMCA deletion notifications sent by Bilibili</title><url>https://github.com/github/dmca/blob/master/2019/04/2019-04-23-bilibili.md</url></story><parent_chain></parent_chain><comment><author>counter2015</author><text>As far as I know, an employee who was illegally laid off by bilibili put part of the company&amp;#x27;s background code on GitHub to vent his anger.
And then GitHub has directionally shielded the keywords &amp;quot;bilibili&amp;quot; and &amp;quot;go-common&amp;quot;, 
But it can be bypassed by typing only one character less. there are still a lot of projects alive.
It is not yet known who leaked it.
Also for the reason.</text></comment>