I see a lot of arguments for specific technical mitigations for the specific implementation of this attack. All these technical approaches are doomed to fail.
The attack uses network-level injection to add malware to HTTP requests for resources served from inside China. This malware then runs on hosts anywhere in the world and effectively DDoSes the targets. It is true that if these specific requests were made over HTTPS rather than HTTP, this particular attack would be mitigated.
Unfortunately the point that is being missed here is that if these resources had been served over HTTPS, this attack simply would have been implemented in a slightly different way. The suggested mitigations would work post-facto. However, if had they been in place prior to this attack, which is the alternative we have to consider, other means would have rendered them useless.
The fact is that any website hosted in China is directly accessible to the CCP for hosting these attack payloads. There is an ICP registration system and a chain of access to hosting environments that grants full network control and full access to any server to the authorities at any time they choose. Servers that are not part of this system are simply not allowed to host websites on the Chinese internet. Further, there is direct political control over every major internet company.
This is such a fundamentally different situation that it can be hard for American observers to understand what range of potential responses are meaningful.
The reality is that any network request that is served from China is fully within the political power of the CCP to alter. Whether this involves HTTP or HTTPS or whether implemented via the GFW or by direct changes to endpoints within internet companies is immaterial. Beyond the logistical costs of these actions within China, nothing of any consequence is changed by such minor technical mitigations.
What these attacks show is not just the capability but the willingness to use that capability in an offensive capacity against political targets.
The difference between the internet of independent sites in the US and the situation of near-total political control over resources on the network in China can hardly be overstated. This is why technical solutions that seem completely reasonable from an American perspective are pointless in reality. The threat model of the world's largest online population with all network resources under direct political control is simply too unfamiliar. If the political will exists to use those resources offensively, technical countermeasures will always be ineffective, unless they are so seemingly disproportionate that they become essentially political acts, like depeering.
Meaningful responses are those that affect the political willingness of the CCP to weaponize the internet. Weaponization will destroy the internet as we know it, and raising awareness before this kind of thing becomes routine may be the last chance we have to avoid it.
This is a political problem, and does not have a technical solution.