It was added once (rPUPCa0ad7), but must've been removed at some point, as it doesn't seem to be in

Since the initial CSP review has been done by a non-SRE user, I will comment on my additional findings.

• Regarding GDPR, I don't see any specific mentions of GDPR being complied with but relevant elements seem to exist. I'm not sure whether that's enough?

• Regarding whether measures to protect security are described, it seems like there is a relatively detailed paragraph explaining

• Regarding privacy reputation, there is a potential issue

• Regarding security reputation, while this was 3 years ago, it is still relevant - "Bilibili source code containing user names and passwords leaked on GitHub"

Overall, it seems like while Bilbili may have had some problems in the past, it has (as far as I can see) not had any clear issues with reputation, etc. and generally the privacy policy seems appropriate. The main issue would be whether them not specifically making mention of the GDPR would be an issue. I will transfer this to Trust & Safety for the next step, especially to review the GDPR aspect. I would likely say though that on the 'approval' scale, this website would likely be on the lower end.

• About GDPR, it mostly goes through the 2 third-parties and you can opt-out right on the appsflyer website. For the Firebase, it's probably for people who use Google account on the English platform to sign-in.
• About privacy reputation from the above article (for the Chinese platform, not English one), it's the article is kinda wrong anyway as you can register account without entering any private information. The only thing that require verify private information is when uploading and commenting which is required by the Chinese government. And technically you can't verify account to upload as a foreign user unless explicit consent by sending an email, the automated verify system only accept Chinese info.

In T9252#187798, @Reception123 wrote:

Since the initial CSP review has been done by a non-SRE user, I will comment on my additional findings.

• Regarding GDPR, I don't see any specific mentions of GDPR being complied with but relevant elements seem to exist. I'm not sure whether that's enough?

• Regarding whether measures to protect security are described, it seems like there is a relatively detailed paragraph explaining

• Regarding privacy reputation, there is a potential issue

• Regarding security reputation, while this was 3 years ago, it is still relevant - "Bilibili source code containing user names and passwords leaked on GitHub"

Overall, it seems like while Bilbili may have had some problems in the past, it has (as far as I can see) not had any clear issues with reputation, etc. and generally the privacy policy seems appropriate. The main issue would be whether them not specifically making mention of the GDPR would be an issue. I will transfer this to Trust & Safety for the next step, especially to review the GDPR aspect. I would likely say though that on the 'approval' scale, this website would likely be on the lower end.

What are the approval scale possibilities?

The concern I have with this website is we've had a number of Terms of Use-related issues, both pre-Trust and Safety and since then, with wikis posting unauthorized personally identifying information, usually involving the BiliBili website in some way. Given the length of time such information was allowed to remain on the BiliBili platform, I'm not terribly confident in the responsiveness of the BiliBili's Data Protection Officer together with BiliBili's legal jurisdiction in which they operate.

What's the specific need here, and, given my concern above, is there not a video sharing site the videos could be posted to and we could whitelist that? For example, YouTube, or, failing that, a site like Google Drive (if that is already whitelisted), the The Internet Archive, or similar.

! In T9252#187988, @Dmehus wrote:
Given the length of time such information was allowed to remain on the BiliBili platform, I'm not terribly confident in the responsiveness of the BiliBili's Data Protection Officer together with BiliBili's legal jurisdiction in which they operate.

Not sure when did you see those stuffs but recently, the Chinese's GDPR equivalent was launched and most of companies in CN are already comply the law.
And yes, the law doesn't have timescale required to process data but if the issue is big enough, the company's reputation will get ruined pretty fast (aka recorded in CN's Social Credit System and you may know how horrible it was).
It is also much faster to remove those by requesting to the gov in case of having serious issues (they do have pages to specifically handle these stuffs).

! In T9252#187988, @Dmehus wrote:
What's the specific need here, and, given my concern above, is there not a video sharing site the videos could be posted to and we could whitelist that? For example, YouTube, or, failing that, a site like Google Drive (if that is already whitelisted), the The Internet Archive, or similar.

There are stuffs that can't be posted outside of the requested page (both personal issues and since most videos on that site mostly have owner's signature embedded), attempting to post the video to other sites is basically breaking the ToS on both sides.
My best bet is to only whitelist player.bilibili.com (aka only video player) in case of security or privacy concerns.

If the end goal is just to get the video player working, you can also consider making a feature request to the EmbedVideo extension. In that way, the CSP is only applied by the extension when needed.

In T9252#188617, @Alistair3149 wrote:

If the end goal is just to get the video player working, you can also consider making a feature request to the EmbedVideo extension. In that way, the CSP is only applied by the extension when needed.

Our CSP overrides anything added by other extensions, so it wouldn't work unless in our CSP also I believe.

In T9252#187988, @Dmehus wrote:

What's the specific need here, and, given my concern above, is there not a video sharing site the videos could be posted to and we could whitelist that? For example, YouTube, or, failing that, a site like Google Drive (if that is already whitelisted), the The Internet Archive, or similar.

Bilibili is one of the largest video streaming platform in China. Given the nature of the Great Firewall, visiting other sites is an issue for users resides within China, let alone the copyright issues associated with reuploading. I think it is worth considering because of its popularity, as long as it passes Trust & Safety.

In T9252#188618, @Universal_Omega wrote:

Our CSP overrides anything added by other extensions, so it wouldn't work unless in our CSP also I believe.

Thanks, didn't know that. In that case I do still suggest a feature request to the EmbedVideo fork as it adds a layer of security by asking for explicit user consent to load the iframe and external resources.

@Owen, can you review this? Thanks!

So if 1 doesn't work, what about whitelisting it per wiki that have strict management? You can't just claim 1 bad apple spoils the barrel, right?

That is not possible as far as I am aware. Our CSP whitelist is basically global or not at all. It can not be done on a per wiki basis.