Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Github SSL replaced by self-signed certificate in China

news.ycombinator.com

Post reply on HN
Print view View original

51–60 of 78 posts

Re: Github SSL replaced by self-signed certificate in China

#51

Post by alistair77 »

bobcattr wrote: post #48
agl wrote: post #41

Firstly, thanks to GitHub using HSTS on github.com (although not www.github.com), the certificate error will be fatal in Chrome and (I believe, but haven't checked) Firefox as long as you have visited GitHub previously. (It's not preloaded HSTS so it would have to be learnt from a previous, unattacked connection.) I know that the unbypassable errors for some sites upset the more technically minded people, but I think…

didn't know of HSTS, thanks. where would one keep up with stuff like that other than keeping up with new rfc's?

OWASP has lots of useful security info, https://www.owasp.org

Re: Github SSL replaced by self-signed certificate in China

#54

Post by j45 »

AndrewKemendo wrote: post #13
j45 wrote: post #10

It sucks my client will be able to say he was right about now allowing source code to be hosted on github. (We ended up setting up a gitlab box and it works just as well)

I find this a sad commentary about your (and certainly others) relationship with your clients.

I'm not sure what's sad.

There's always a precarious balance between security and convenience.

The customers own their code. They have been around longer for more oscillations between the "cloud" and bare metal than most people who have an opinion on it.

They're forward thinking enough to not embrace the cloud, or bare metal, and instead are exploring hybrid cloud technology that can run on a combination, and more importantly, move dev ops between different environments.

One reality is many people who blindly think it's ok to put everything on in the cloud, don't always know of the reality of liability, or have a relationship with any codebase and the associated IP for more than a few years.

Re: Github SSL replaced by self-signed certificate in China

#55

Post by qschneier »

Censorship in China is a big business, for the companies that have connections to the officials, for the universities that rely on the funds, and for the officials who use this as a stepstone for their career. It is so common that you can even find many fresh graduates who worked for the GFW in the job market.

Re: Github SSL replaced by self-signed certificate in China

#56

Post by j45 »

venomsnake wrote: post #31
AndrewKemendo wrote: post #13

Earlier quoted context omitted.

I find this a sad commentary about your (and certainly others) relationship with your clients.

There is nothing wrong in insisting the repository to be hosted on the client metal. The way things were done in the ancient times before the cloud to become the favorite buzzword of the month.

I agree. The cloud isn't new. VPN's have existed for ever as well as client-mainframe.

The perception that the cloud is somehow re-invented is in fact the saddening thing. It's just more accessible and faster than in the fast, but ultimately you can't manage infrastructure by abdication and farming it out.

There's always an uneasy balance between security and convenience.

Re: Github SSL replaced by self-signed certificate in China

#57

Post by jacquesm »

philwelch wrote: post #44
andrewtbham wrote: post #17

Earlier quoted context omitted.

I have always imagined that github would be a huge target for the chinese... for industrial espionage. they could get the source for private repositories for many startups and successful companies.

I doubt very much of value is on github.com as opposed to more secure Github Enterprise installations behind company firewalls.

Uncounted open source projects that end up being run with root privileges are on github. It all depends on how you determine value.

If value is defined as the number of machines that can be backdoored, communications intercepted and so on then it may very well be that that other form of value will be realized in good time as well.

Re: Github SSL replaced by self-signed certificate in China

#58

Post by tedunangst »

jacquesm wrote: post #46

What bugs me about stuff like this is that there will always be mercenaries, guys just like you and me that will do anything as long as it pays. The Chinese government wouldn't stand a chance if they had to do this stuff themselves. Mercenary coders are nothing new, we have them in every country (and sysadmins, companies and so on). But you have to wonder what goes on in their heads, what mindset would prompt you to…

I kind of get what you're saying, but I think there's a lot of hubris in thinking "my profession is special, only good guys (can learn to) do it". Craftsmen have been complaining about the wrong people getting into their trade for as long as there have been crafts.

Re: Github SSL replaced by self-signed certificate in China

#59

Post by qschneier »

khuey wrote: post #47
songgao wrote: post #5

This reminds me the Firefox certificate "bug"[1] two years ago. A China certificate root server was added into trusted servers in Firefox and Chinese hackers started to submit bug report regarding this, since people don't trust certificate servers run by China government. Man-in-the-middle attack was exact what Chinese hackers worried about. If they put this fake certificate in a certificate root server that's in the…

If CNNIC is complicit in a MITM attack there will be a paper trail (namely a certificate signed by them) proving their involvement. To this day nobody has produced a cert signed by CNNIC that was used for a MITM attack. There's no reason to believe that CNNIC is bad/evil/whatever other than their affiliation with the PRC. Disclosure: I work for Mozilla, but not on security.

CNNIC is notorious for producing malware and many other things. Some is list here http://en.wikipedia.org/wiki/CNNIC

Having been in the internet industry in China for more than 10 years before I decided to move to the US I would say CNNIC is just as evil as any government organization in China if not worse. There are some well known rules regarding CNNIC: don't buy a .cn domain, don't install any software from them and don't trust what they say.

BTW non government organizations are technically banned in China. You need to apply for a permit and you seldom get one.

Re: Github SSL replaced by self-signed certificate in China

#60

Post by seanmcdirmid »

teawithcarl wrote: post #38
moxie wrote: post #32

Earlier quoted context omitted.

Agreed there's nothing in the data to directly suggest government involvement. It's only "sloppy," though, when conceptualized as a MITM. China does have an extensive history of censoring access to sites, and recently censored access to GitHub entirely IIRC. It could be that they decided to block SSL access, but allow HTTP access, and this is how they implemented that.

Everything in my bones (25 years, 中文研究, China research) tells me the China government is directly involved with this. China is corrupt beyond belief, and any smaller destabilization can lead to further problems. I agree that this may be a further extending of the "New Years train ticket" block on Github. It may also be new toying after the recent "experiment". Leaving Github without SSL inside China still makes troub…

As an sort of old china hand, china is corrupt but not beyond belief, there are plenty of countries that are much more corrupt, even India is worse than china and they even have democracy.

The level of sophistication that the GFW seems to be achieving is disturbing. We've had certificate attacks before, perhaps they are testing something out that will be deployed more broadly to solve there "gmail" problem?

Post reply on HN