Earlier quoted context omitted.
Hitler didn't start murdering jews in mass until after he invaded countries.
En masse https://www.dictionary.com/browse/en-masse
en masse
adverb
_in a mass_; all together; as a group:
The Great Cannon has been deployed again
361–370 of 470 posts
Re: The Great Cannon has been deployed again
#362This should be mitigated by browser vendors by integrating HTTPSEverywhere as a core functionality of the browser that needs to be explicitly turned off (instead of the current state of affairs where we have a tiny minority on the web who are familiar with installing security add-ons). Visiting a HTTP site should come with a scary warning. I understand this throws old sites under the bus, but there could be other sol…
I recently (4 or 5 months ago) joined an online community of aircraft owners and pilots that is primarily focused around a single brand of aircraft (although it's not an official site of, property of, that brand nor is it endorsed by that brand). When I signed up, they emailed me to welcome me to the site (they actually require manual authorization of users by an admin, which is... refreshing, but uncommon). The emai…
I'll top that. I used TABCPermit.com to get licensed to serve alcohol in Texas. Their signup form says "no special characters in password". I used one anyway, putting in "password$1" for example. It accepted it, and I worked on the test.
Next day, I can't login. I use the "forgot password" link. They send me and email, and it has my password in it! Bad, right?
That isn't all. My password, they said, was "password1". They silently stripped out the special character.
I just about flipped a table at how security-shallow people who build websites can be.
Re: The Great Cannon has been deployed again
#363Earlier quoted context omitted.
The west is constantly pushing for stuff like this in every trade policy with China and others... There’s a limit to how much leverage any one side has on a sovereign countries policies (and how much they actually enforce them when they agree). There’s also the question of the benefits of having China at all in these deals, some concessions and a growing dependence on western markets from initial deals is better than…
> There’s a limit to how much leverage any one side has on a sovereign countries policies (and how much they actually enforce them when they agree). I’m not advocating for anyone controlling sovereign Chinese policies. They can continue their awful anti-humanitarian policies, fraud, IP theft, etc. I just don’t want my country aiding and abetting it. At very least I want my fellow citizens to be able to make informed…
The UK kept trade with the US when slavery there was rampant. Any country will have hiccups throughout its development.
It's convenient but counterproductive to categorize every argument against yours as "whatabouttism".
Re: The Great Cannon has been deployed again
#364Earlier quoted context omitted.
I recently (4 or 5 months ago) joined an online community of aircraft owners and pilots that is primarily focused around a single brand of aircraft (although it's not an official site of, property of, that brand nor is it endorsed by that brand). When I signed up, they emailed me to welcome me to the site (they actually require manual authorization of users by an admin, which is... refreshing, but uncommon). The emai…
That response is pretty typical from the GA community.
What is "GA"?
Re: The Great Cannon has been deployed again
#365Earlier quoted context omitted.
pwn a couple ad servers and service the poisoned js. It doesn't seem something that a dedicated malicious hacker group couldn't do.
Except that's not what's happening here, unless your claim is they compromised baidu and Qihoo 360 and both don't care to fix it. baidu and Qihoo 360 are massive companies. Serving the stuff either means they are doing it deliberately (on behalf of the government), or an active MITM is doing it, which given the scale can only mean ISP and ergo (since this is China) government level. The active MITM seems plausible si…
Baidu could be doing it only to http traffic to make people think it's the government... But I can't imagine that they would want to seem as if they're putting words in the government's mouth.
Re: The Great Cannon has been deployed again
#366Re: The Great Cannon has been deployed again
#367Re: The Great Cannon has been deployed again
#368Earlier quoted context omitted.
That's not the issue. The issue is that there is speech accompanying the malware, which should not be systematically censored. (Though any individual is free to do so for themselves.)
> The issue is that there is speech accompanying the malware I'm either misunderstanding what you're saying, or it doesn't make sense. If a bunch of people take signs (with legitimate messages, free speech) and hang them off a bridge over the highway (causing accidents), then those people go jail. The fact that their message is free speech is irrelevant. The source of the message is being punished/jailed, not the mes…
The problem is closer to a ne'er-do-well taking someone else's signs and hanging them off a bridge over a highway. The person producing the speech is having their speech hijacked for malicious purposes by an MITM; that doesn't mean that it's not censorship when the sign's/webpage's creator gets caught in the censorship crossfire during the attempt to take down the malicious actor.
To put it another way: if someone steals my car and uses it to rob a bank, even if that car is now evidence in a criminal investigation, it's still my car. The police have every right to confiscate it from the thief—it's not their car—but that doesn't mean that it suddenly belongs to them; it belongs to me. In both this case and the above case, I have a right to not be unduly punished for the actions of an unrelated third party (by having my website taken down; or by having my car permanently confiscated, respectively.)
The context here is very similar to a story that was on HN just yesterday (https://news.ycombinator.com/item?id=21671579). Banning a site from the internet for happening to be MITMed by China is very similar in its ethical implications to banning a site from the Internet for happening to have a domain-name that fits a pattern used by a botnet.
Re: The Great Cannon has been deployed again
#369Earlier quoted context omitted.
I recently (4 or 5 months ago) joined an online community of aircraft owners and pilots that is primarily focused around a single brand of aircraft (although it's not an official site of, property of, that brand nor is it endorsed by that brand). When I signed up, they emailed me to welcome me to the site (they actually require manual authorization of users by an admin, which is... refreshing, but uncommon). The emai…
I'd recommend using an OpenID Connect provider to authenticate if you're concerned about their practices but it's just as easy to improperly implement auth even with mainstream libraries to help you connect something like Auth.0 to your app. e.g. Don't assume the email address is owned by the person making the claim. You can sign up for an account with an email and if it's not verified or the verification is mis-clic…
Are there any sites that accept OpenID but that you still suspect of poor password/auth practices?
Re: The Great Cannon has been deployed again
#370Earlier quoted context omitted.
And what do you think happens to sites caught serving malware? They get put on safebrowsing blacklists. That problem solves itself.
If the Chinese government wants to man in the middle traffic to foreign sites they can just force PC vendors to install a CCP controlled CA root on systems and make it illegal and/or very difficult to remove it. Shit, they can require vendors include a hardware backdoor, especially since so much of that hardware is produced domestically. Then they can view the traffic even going to and from foreign sites who would no…
The Chinese government can do this for systems sold within China. They don't have the authority to do it for computers globally.
If I'm understanding other comments correctly, browser vendors installing HTTPSEverywhere cuts down the potential for this Great Cannon attack from 7.7 billion users to 1.4 billion. An 80% reduction seems significant.