The Great Cannon has been deployed again • Hacker News Board

Re: The Great Cannon has been deployed again

#421

Post by Zanneth » Sat, Dec 07, 2019, 4:11 AM UTC

taneq wrote: post #412

threeseed wrote: post #407

Earlier quoted context omitted.

> But that is literally what web users want. No it absolutely does not. Just because a user doesn't understand what Javascript is or how to diagnose why their computer is slow (is it an app, website, update, virus etc) does not imply consent. Pretty sure that most people just want to be able to visit a website without it causing problems to their computer or to others.

But a “website” isn’t an HTML page any more. It’s a network-deployed application. Most people want to run these applications.

To reiterate threeseed’s point: the user wants the website to work well and work efficiently. They don’t care if it’s HTML or an interactive app. In a lot of cases, the web works better when pages are served as plain static HTML.

Re: The Great Cannon has been deployed again

#422

Post by wnoise » Sat, Dec 07, 2019, 4:14 AM UTC

cc81 wrote: post #279

wnoise wrote: post #261

Earlier quoted context omitted.

> I'm just saying it is nothing like the holocaust and it is pretty absurd when people do those kind of comparisons. It's clearly not exactly the same as the Holocaust. But it's disingenuous to say it's nothing like the Holocaust either, because there are a lot of similarities.

Do you think they are more similar to the Holocaust than the US internment camps?

I think they're closer to Nazi internment camps (which rather quickly transitioned to death camps) than the various US internment camps, yes.

Are they death camps yet? Well, perhaps not. But there are none the less a hell of lot dehumanization. There are reports of forced abortions, rapes, medical experiments, and other tortures.

To be clear, the US internment of the Japanese is a horrendous stain, but it clearly is far less evil than these camps.

Re: The Great Cannon has been deployed again

#423

Post by yumraj » Sat, Dec 07, 2019, 4:19 AM UTC

s1k3b8 wrote: post #414

yumraj wrote: post #380

Earlier quoted context omitted.

I agree that such bad behavior should be punished, but why just couple of days? This would be similar to UN trade sanctions that are imposed on bad state actors. I think we generally overestimate the hurt on the outside and underestimate the hurt on the inside considering the massive trade imbalance that China enjoys with the rest of the world. Personally I have already pi-holed entire .cn and other domains.

> This would be similar to UN trade sanctions that are imposed on bad state actors. UN sanctions are not imposed on bad state actors. They are imposed on weak state actors. UN sanctions have never been imposed on the US, China, Russia, Britain and France easily the worst state actors globally - the biggest weapons sellers and the cause of instability all over the world. They also are the 5 permanent security council…

> UN sanctions are not imposed on bad state actors. They are imposed on weak state actors.

That is a great point and I agree with it.

However, the way I look at it, a state sponsored attack like this is no different from a country firing missiles or shells on another country from over the border. And as such, such attacks should not go unpunished and there need to be consequences. In addition, the countries being attached have a right and a moral duty to protect themselves.

The mechanisms of such I leave to those with the power to make it happen.

And yes, blocking .cn doesn't do much, but it does some.

Re: The Great Cannon has been deployed again

#424

Post by dredmorbius » Sat, Dec 07, 2019, 4:46 AM UTC

kortilla wrote: post #231

dredmorbius wrote: post #189

Earlier quoted context omitted.

At best, that has held in limited places and times since WWII. At worst, it was an affirmation repeated, as with most affirmations, in the hopes that the repetition would make it true, which it doesn't, and for the usual reason, that it generally wasn't.

So presumably you have evidence of most countries trading with each other while going to war with each other?

The United States and Germany during WWII, as evidenced by Ford, General Motors, IBM, Coca-Cola, Kodak, Chase Bank, Random House, Associated Press, Dow Chemical, Brown Brothers Harriman, Woolworths, Alcoa, AT&T, and others.

https://www.theatlantic.com/magazine/archive/2001/04/hitlers...

https://www.phactual.com/8-american-companies-that-worked-wi...

https://www.toptenz.net/top-10-american-companies-that-aided...

Re: The Great Cannon has been deployed again

#425

Post by Thorrez » Sat, Dec 07, 2019, 5:02 AM UTC

jacquesm wrote: post #316

pwnguin wrote: post #265

Earlier quoted context omitted.

I'm not sure 'We have the technology to censor the internet, and it's okay to deploy it' is the message you want to give the CCP.

That's not censorship. https://en.wikipedia.org/wiki/Censorship The criminal co-opting of networks and nodes on those networks is not speech by any definition.

There are innocent users outside China who like to view innocent websites inside China. If you block the connection, you make the innocent users, and the innocent websites, mad. They might very well interpret it as censorship.

Re: The Great Cannon has been deployed again

#426

Post by andykx » Sat, Dec 07, 2019, 5:12 AM UTC

Zanneth wrote: post #421

taneq wrote: post #412

Earlier quoted context omitted.

But a “website” isn’t an HTML page any more. It’s a network-deployed application. Most people want to run these applications.

To reiterate threeseed’s point: the user wants the website to work well and work efficiently. They don’t care if it’s HTML or an interactive app. In a lot of cases, the web works better when pages are served as plain static HTML.

Sure, a simple marketing site for a local restaurant can work with only HTML and CSS, but practically all of the top 20 most popular sites would cease to function without JS.

Re: The Great Cannon has been deployed again

#427

Post by lawrenceyan » Sat, Dec 07, 2019, 5:23 AM UTC

The fact that you can see these malicious scripts being served directly from a Baidu domain is a good reminder that effectively all major Chinese tech companies are totally at the whim of the Chinese government.

It makes using any product / service from a Chinese based company basically never worth it just because of the security concerns.

Re: The Great Cannon has been deployed again

#428

Post by jrockway » Sat, Dec 07, 2019, 5:28 AM UTC

upofadown wrote: post #218

Browsers really have to be a lot more skeptical about the code they run. Running code should not be able to randomly attack any IP address on the internet. Code from non-TLS pages should not be able to run at all. Perhaps that should also apply to code loaded from 3rd party sites. Connecting to a web page should not be consent to allow the operators of that web page to make my computer/phone do whatever they want on…

TLS should be required, but it seems likely to me that the Chinese government can issue TLS certificates for MITM purposes that their browsers will trust.

As for the DoS aspect, maybe it's time to do a CORS preflight on ALL cross-origin requests, including images. (Webfonts, for whatever reason, already require a CORS preflight. Probably because Adobe is on the W3C and they sell a service where certain origins can legally use certain fonts from their servers. I hate it when user security features get turned into subsidies for large corporations, but here we are.)

Of course, if you have broken TLS I guess you can just forge the CORS response.

Edit to add: I have read more comments and better understand the attack now. China is modifying the Javascript on Chinese websites that are being viewed from outside China. Making TLS mandatory would be a big help here. China could say "all Chinese companies must buy certificates from the Great Chinese CA" and they could still do the MITM. But with evidence of the CA issuing fake certificates to DoS websites, browsers would probably stop trusting that CA entirely. I imagine China would like to avoid that, so I feel like this would have stopped the attack.

Re: The Great Cannon has been deployed again

#429

Post by jrockway » Sat, Dec 07, 2019, 5:37 AM UTC

dmead wrote: post #205

jacquesm wrote: post #70

So, maybe firewall off China for a couple of days? Sure, it would hurt on both sides but at least it would be clear that abuse at this scale leads to being blackholed.

that's what they want. a bifurcation of the internet.

I doubt it. China gets a lot of business from overseas via the Internet. Think about all those fabs where you upload a PCB design and for $2, they manufacture it and mail them to you. If Americans could not visit the Chinese Internet, those companies would be out of business overnight. When nobody has a job or money, people start questioning the government, which the government would probably like to avoid.

The reality of China is that they need the global economy as much as the global economy needs them. No one entity can really pick up their ball and go home, as much as China would probably love to.

Re: The Great Cannon has been deployed again

#430

Post by mlyle » Sat, Dec 07, 2019, 6:13 AM UTC

gruez wrote: post #339

crazygringo wrote: post #209

I'm curious: is it technically and politically possible for the operators of all internet cables receiving traffic from China to filter out malicious scripts? AT&T's writeup says the injection is only possible because it's HTTP (not HTTPS), and that there are two specific JavaScript files which sometimes serve up the malicious code. So in case of known malware like this being served from within a geographic region...…

>I'm curious: is it technically and politically possible for the operators of all internet cables receiving traffic from China to filter out malicious scripts? Considering that the halting problem is undecidable, it's impossible to filter out the malicious scripts with complete certainty. The best you can do is use blacklists/heuristics which lead to an arms race. >So in case of known malware like this being served f…

> Considering that the halting problem is undecidable,

This doesn't mean that you can't prove a big subset of scripts safe.

> The best you can do is use blacklists/heuristics which lead to an arms race.

You can also allow the scripts that automatically prove safe, plus other popular scripts you decide to explicitly allow, plus other scripts that are low-rate enough that you don't believe them to be a concern.