Hacker News new | ask | show | jobs
by femto113 1624 days ago
Think I have to side with Readium on this one, since the source code contains the actual bytes of the master key:

    def secret_transform_profile10(input_hash): 
        ... 
        # This 64-byte master key is basically all that distinguishes
        # the open source "open for everyone" version from the so-called
        # "open source" closed-source-version that's actually being used
        # by book distributors.
        ...
        masterkey = "b3a0..."
If it read that from an environment variable or a config file that wasn't included in the source I think this DMCA notice would have a lot harder time holding up.
3 comments

The full number seems to be b3a07c4d42880e69398e05392405050efeea0664c0b638b7c986556fa9b58d77b31a40eb6a4fdba1e4537229d9f779daad1cc41ee968153cb71f27dc9696d40f .
In case you wanted the number in flag form (a-la AACS): https://imgur.com/a/EX8RWXM.
You mean the number between b3a07c4d42880e69398e05392405050efeea0664c0b638b7c986556fa9b58d77b31a40eb6a4fdba1e4537229d9f779daad1cc41ee968153cb71f27dc9696d40e and b3a07c4d42880e69398e05392405050efeea0664c0b638b7c986556fa9b58d77b31a40eb6a4fdba1e4537229d9f779daad1cc41ee968153cb71f27dc9696d410 ?
Explanation what it's used for: https://www.edrlab.org/readium-lcp/principles/
Illegal number?
Reminds me of when the Google widevine key was leaked a bit ago on GitHub and they similarly nuked that repo.